BEGIN BM telemetry GUID:{1121D2C9-13CA-E9BE-7785-BA8488A66750} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 16:54:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T16:54:05.568 [Cloud] End of cloud request. 2026-09-08T16:54:06.084 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T16:59:27.677 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T16:59:27.677 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T16:59:27.677 [Cloud] Queued cloud request. 2026-09-08T16:59:27.677 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T16:59:27.677 [Cloud] Dequeued cloud request. 2026-09-08T16:59:27.677 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T16:59:27.818 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1C3D968C-DD64-4919-AB64-8A3003602402} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 16:59:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T16:59:28.334 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T16:59:54.271 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T16:59:54.271 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T16:59:54.271 [Cloud] Queued cloud request. 2026-09-08T16:59:54.271 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T16:59:54.271 [Cloud] Dequeued cloud request. 2026-09-08T16:59:54.271 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T16:59:54.380 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{434460BE-8905-9F93-2B41-712B529C64AD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 16:59:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T16:59:54.880 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:01:57.224 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:01:57.224 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:01:57.224 [Cloud] Queued cloud request. 2026-09-08T17:01:57.224 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:01:57.224 [Cloud] Dequeued cloud request. 2026-09-08T17:01:57.224 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:01:57.396 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{05365655-6AB7-687F-AC67-24A6CD556A61} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:01:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:01:57.912 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:02:18.146 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T17:07:42.193 Bm signature throttled:0x000135b39c9104ce 2026-09-08T17:09:40.021 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:09:40.021 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:09:40.021 [Cloud] Queued cloud request. 2026-09-08T17:09:40.021 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:09:40.021 [Cloud] Dequeued cloud request. 2026-09-08T17:09:40.021 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:09:40.224 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{918CFFD3-DC14-3E78-D2B0-4D8E86FC5D7D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:09:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:09:40.740 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:12:33.693 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:12:33.693 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:12:33.693 [Cloud] Queued cloud request. 2026-09-08T17:12:33.693 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:12:33.693 [Cloud] Dequeued cloud request. 2026-09-08T17:12:33.693 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:12:33.880 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BA62BFFD-3734-312A-57BB-7FD7469BBA9C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:12:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:12:34.396 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:16:50.677 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:16:50.677 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:16:50.677 [Cloud] Queued cloud request. 2026-09-08T17:16:50.677 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:16:50.677 [Cloud] Dequeued cloud request. 2026-09-08T17:16:50.677 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:16:50.865 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9E08F573-BF2B-C735-064E-A5C880A6C504} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:16:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:16:51.380 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:17:23.146 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T17:22:02.146 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:22:02.146 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:22:02.146 [Cloud] Queued cloud request. 2026-09-08T17:22:02.146 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:22:02.161 [Cloud] Dequeued cloud request. 2026-09-08T17:22:02.161 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{776464AC-00E7-CDA7-F6E2-97BCF7B6B6A9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:22:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:22:02.333 [Cloud] End of cloud request. 2026-09-08T17:22:02.833 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:27:41.036 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:27:41.036 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:27:41.036 [Cloud] Queued cloud request. 2026-09-08T17:27:41.036 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:27:41.036 [Cloud] Dequeued cloud request. 2026-09-08T17:27:41.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:27:41.177 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F0AD7DF5-FD8D-8742-D014-DD317A1EEA64} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:27:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:27:41.692 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:31:15.567 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:31:15.567 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:31:15.567 [Cloud] Queued cloud request. 2026-09-08T17:31:15.567 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:31:15.567 [Cloud] Dequeued cloud request. 2026-09-08T17:31:15.567 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:31:15.708 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{11C8A745-E78A-F3CA-70B7-61D89CD9B539} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:31:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:31:16.208 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:31:17.333 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:31:17.333 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:31:17.333 [Cloud] Queued cloud request. 2026-09-08T17:31:17.333 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:31:17.333 [Cloud] Dequeued cloud request. 2026-09-08T17:31:17.333 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:31:17.426 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{12D57348-AB76-3F3C-7CC5-23B9A5DE34C5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:31:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:31:17.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:32:28.145 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T17:33:43.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:33:43.145 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:33:43.145 [Cloud] Queued cloud request. 2026-09-08T17:33:43.145 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:33:43.145 [Cloud] Dequeued cloud request. 2026-09-08T17:33:43.145 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:33:43.301 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{080B7A3C-523C-3790-6F0B-8708E33743BE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:33:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:33:43.801 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:33:52.442 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:33:52.442 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:33:52.442 [Cloud] Queued cloud request. 2026-09-08T17:33:52.442 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:33:52.442 [Cloud] Dequeued cloud request. 2026-09-08T17:33:52.442 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:33:52.536 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F6D92703-1B2B-5FB3-B760-87E45F7914FF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:33:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:33:53.036 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:42:19.801 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:42:19.801 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:42:19.801 [Cloud] Queued cloud request. 2026-09-08T17:42:19.801 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:42:19.801 [Cloud] Dequeued cloud request. 2026-09-08T17:42:19.801 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:42:19.957 [Cloud] End of cloud request. 2026-09-08T17:42:19.957 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:42:19.957 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:42:19.957 [Cloud] Queued cloud request. 2026-09-08T17:42:19.957 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:42:19.957 [Cloud] Dequeued cloud request. 2026-09-08T17:42:19.957 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:42:20.036 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{31F67CFE-BAAD-5C01-4787-8EDA5C452605} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:42:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry BEGIN BM telemetry GUID:{3EB0CFBE-05FE-E9BD-FE54-7571B17A6247} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:42:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:42:20.473 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:44:09.254 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:44:09.254 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:44:09.254 [Cloud] Queued cloud request. 2026-09-08T17:44:09.254 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:44:09.254 [Cloud] Dequeued cloud request. 2026-09-08T17:44:09.254 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:44:09.426 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{07BF0557-32C0-4B04-236B-380260F066DE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:44:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:44:09.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:47:28.238 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:47:28.238 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:47:28.238 [Cloud] Queued cloud request. 2026-09-08T17:47:28.238 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:47:28.238 [Cloud] Dequeued cloud request. 2026-09-08T17:47:28.238 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:47:28.426 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C2B57365-AC11-34AF-D022-5CB7DFD8DA7E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:47:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:47:28.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:47:33.145 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T17:50:44.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:50:44.145 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:50:44.145 [Cloud] Queued cloud request. 2026-09-08T17:50:44.145 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:50:44.145 [Cloud] Dequeued cloud request. 2026-09-08T17:50:44.145 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:50:44.301 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{463070F4-265F-E410-39C8-6BB22955122B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:50:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:50:44.817 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:51:55.801 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:51:55.801 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:51:55.801 [Cloud] Queued cloud request. 2026-09-08T17:51:55.801 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:51:55.801 [Cloud] Dequeued cloud request. 2026-09-08T17:51:55.817 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:52:05.910 [Cloud] End of cloud request. 2026-09-08T17:52:06.426 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T17:54:09.676 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T17:54:09.676 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T17:54:09.676 [Cloud] Queued cloud request. 2026-09-08T17:54:09.676 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T17:54:09.676 [Cloud] Dequeued cloud request. 2026-09-08T17:54:09.676 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T17:54:09.817 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{479DA62D-3D5F-4F80-F2A0-A2A00836CB4C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 17:54:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T17:54:10.317 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:01:00.285 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:01:00.285 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:01:00.285 [Cloud] Queued cloud request. 2026-09-08T18:01:00.285 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:01:00.285 [Cloud] Dequeued cloud request. 2026-09-08T18:01:00.285 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:01:00.488 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{697B3A84-DE37-D835-EE7D-E5FF5D04AD09} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:01:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:01:01.004 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:02:38.144 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T18:02:48.816 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:02:48.816 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:02:48.816 [Cloud] Queued cloud request. 2026-09-08T18:02:48.816 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:02:48.816 [Cloud] Dequeued cloud request. 2026-09-08T18:02:48.816 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:02:49.238 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F6758249-340B-B42A-0B3D-763820CEE553} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:02:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:02:49.738 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:05:08.738 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:05:08.738 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:05:08.738 [Cloud] Queued cloud request. 2026-09-08T18:05:08.738 [Cloud] Dequeued cloud request. 2026-09-08T18:05:08.738 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:05:08.738 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:05:08.941 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9A8F2D14-04AB-D652-ADC6-70E3846FD9D8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:05:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:05:09.457 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:09:12.301 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 283248, Count: 18648, MaxTime: 1906, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasbase.lkg, EstimatedImpact: 1% 2026-09-08T18:09:12.301 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 4842, Count: 344, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-08T18:09:12.301 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 123, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-08T18:09:12.301 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-08T18:09:12.301 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-08T18:09:42.629 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:09:42.629 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:09:42.629 [Cloud] Queued cloud request. 2026-09-08T18:09:42.629 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:09:42.629 [Cloud] Dequeued cloud request. 2026-09-08T18:09:42.629 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:09:52.769 [Cloud] End of cloud request. 2026-09-08T18:09:53.285 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:13:33.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:13:33.925 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:13:33.925 [Cloud] Queued cloud request. 2026-09-08T18:13:33.925 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:13:33.925 [Cloud] Dequeued cloud request. 2026-09-08T18:13:33.941 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:13:34.160 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3FBA707E-C1F4-690F-A634-77DF65C2B1AB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:13:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:13:34.660 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:13:37.597 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:13:37.597 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:13:37.597 [Cloud] Queued cloud request. 2026-09-08T18:13:37.597 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:13:37.597 [Cloud] Dequeued cloud request. 2026-09-08T18:13:37.597 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:13:37.738 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7DFE894F-CB0D-F7F5-FD38-FF4685CA2859} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:13:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:13:38.254 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:14:16.113 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:14:16.113 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:14:16.113 [Cloud] Queued cloud request. 2026-09-08T18:14:16.113 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:14:16.113 [Cloud] Dequeued cloud request. 2026-09-08T18:14:16.113 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:14:16.347 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{87B3DD06-7DCE-ECA7-FB5F-64CAC7321D0C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:14:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:14:16.847 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:14:41.316 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:14:41.316 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:14:41.316 [Cloud] Queued cloud request. 2026-09-08T18:14:41.316 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:14:41.316 [Cloud] Dequeued cloud request. 2026-09-08T18:14:41.316 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:14:41.410 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{13E0267A-0EF1-2CC7-5339-4A029E247F29} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:14:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:14:41.910 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:15:10.722 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:15:10.722 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:15:10.722 [Cloud] Queued cloud request. 2026-09-08T18:15:10.722 [Cloud] Dequeued cloud request. 2026-09-08T18:15:10.722 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:15:10.722 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:15:11.254 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D7460299-94D5-4486-56B5-288B839F5AF8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:15:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:15:11.754 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:15:15.019 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:15:15.019 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:15:15.019 [Cloud] Queued cloud request. 2026-09-08T18:15:15.019 [Cloud] Dequeued cloud request. 2026-09-08T18:15:15.019 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:15:15.019 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:15:15.207 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{91CAF549-3618-D585-D526-E49FE925C635} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:15:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:15:15.722 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:17:43.144 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T18:20:18.331 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:20:18.331 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:20:18.331 [Cloud] Queued cloud request. 2026-09-08T18:20:18.331 [Cloud] Dequeued cloud request. 2026-09-08T18:20:18.331 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:20:18.331 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:20:18.519 [Cloud] End of cloud request. 2026-09-08T18:20:19.050 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:23:10.003 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:23:10.003 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:23:10.003 [Cloud] Queued cloud request. 2026-09-08T18:23:10.003 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:23:10.003 [Cloud] Dequeued cloud request. 2026-09-08T18:23:10.003 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:23:10.160 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A83A9477-A580-4E1B-B355-6E5A30D6FAFF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:23:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:23:10.675 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:28:09.128 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:28:09.128 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:28:09.128 [Cloud] Queued cloud request. 2026-09-08T18:28:09.128 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:28:09.128 [Cloud] Dequeued cloud request. 2026-09-08T18:28:09.128 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:28:09.285 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3DE682D6-6A5D-D7A3-8528-B63D37F9AF74} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:28:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:28:09.785 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:32:48.144 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T18:34:00.550 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:34:00.550 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:34:00.550 [Cloud] Queued cloud request. 2026-09-08T18:34:00.550 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:34:00.550 [Cloud] Dequeued cloud request. 2026-09-08T18:34:00.566 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:34:00.769 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8DBA7E97-B654-F0C8-F0CE-BC05FCC28C41} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:34:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:34:01.284 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:37:54.878 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:37:54.878 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:37:54.878 [Cloud] Queued cloud request. 2026-09-08T18:37:54.878 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:37:54.878 [Cloud] Dequeued cloud request. 2026-09-08T18:37:54.878 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:37:58.472 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1C7AF7EA-9EAC-A459-7875-F226AD96052A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:37:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:37:58.988 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:42:33.456 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:42:33.456 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:42:33.456 [Cloud] Queued cloud request. 2026-09-08T18:42:33.456 [Cloud] Dequeued cloud request. 2026-09-08T18:42:33.456 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:42:33.456 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:42:33.691 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{376A0E58-E920-4EB8-9D06-C095ECAC1781} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:42:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:42:34.206 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:47:53.144 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T18:53:04.784 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:53:04.784 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:53:04.784 [Cloud] Queued cloud request. 2026-09-08T18:53:04.784 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:53:04.784 [Cloud] Dequeued cloud request. 2026-09-08T18:53:04.784 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:53:04.972 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{27C4AE53-37B6-E264-5826-A33BE2EECF72} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:53:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:53:05.487 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T18:59:39.440 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:59:39.440 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:59:39.440 [Cloud] Queued cloud request. 2026-09-08T18:59:39.440 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:59:39.440 [Cloud] Dequeued cloud request. 2026-09-08T18:59:39.440 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:59:39.628 [Cloud] End of cloud request. 2026-09-08T18:59:39.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T18:59:39.643 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T18:59:39.643 [Cloud] Queued cloud request. 2026-09-08T18:59:39.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T18:59:39.643 [Cloud] Dequeued cloud request. 2026-09-08T18:59:39.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T18:59:39.722 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0B111DA1-2E30-C600-F434-AB1C2E06DDBD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:59:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry BEGIN BM telemetry GUID:{3FE1113C-CDAF-D3EB-F6ED-FCE109F9590F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 18:59:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T18:59:40.143 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:02:58.143 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T19:07:18.956 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:07:18.956 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:07:18.956 [Cloud] Queued cloud request. 2026-09-08T19:07:18.956 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:07:18.956 [Cloud] Dequeued cloud request. 2026-09-08T19:07:18.956 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:07:19.159 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FCEEFA83-FFAB-3963-B1ED-35DFEF74AFA4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:07:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:07:19.675 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:07:32.737 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:07:32.737 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:07:32.737 [Cloud] Queued cloud request. 2026-09-08T19:07:32.737 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:07:32.737 [Cloud] Dequeued cloud request. 2026-09-08T19:07:32.737 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:07:32.815 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5A8FEE60-2698-BD2C-B5E9-79DC768C2045} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:07:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:07:33.331 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:08:49.268 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:08:49.268 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:08:49.268 [Cloud] Queued cloud request. 2026-09-08T19:08:49.268 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:08:49.268 [Cloud] Dequeued cloud request. 2026-09-08T19:08:49.268 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:08:59.409 [Cloud] End of cloud request. 2026-09-08T19:08:59.925 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:12:18.721 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:12:18.721 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:12:18.721 [Cloud] Queued cloud request. 2026-09-08T19:12:18.721 [Cloud] Dequeued cloud request. 2026-09-08T19:12:18.721 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:12:18.721 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{37EDBA9F-545F-FEE1-282C-43F6F44D75DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:12:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:12:18.909 [Cloud] End of cloud request. 2026-09-08T19:12:19.424 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:13:00.299 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:13:00.299 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:13:00.299 [Cloud] Queued cloud request. 2026-09-08T19:13:00.299 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:13:00.299 [Cloud] Dequeued cloud request. 2026-09-08T19:13:00.299 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:13:00.393 [Cloud] End of cloud request. 2026-09-08T19:13:00.893 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:13:56.205 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:13:56.205 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:13:56.205 [Cloud] Queued cloud request. 2026-09-08T19:13:56.205 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:13:56.205 [Cloud] Dequeued cloud request. 2026-09-08T19:13:56.205 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:13:56.284 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0AFD600B-93C3-5ED8-FF00-247F88FF17A1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:13:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:13:56.784 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:16:01.659 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:16:01.659 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:16:01.659 [Cloud] Queued cloud request. 2026-09-08T19:16:01.659 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:16:01.659 [Cloud] Dequeued cloud request. 2026-09-08T19:16:01.659 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:16:01.862 [Cloud] End of cloud request. 2026-09-08T19:16:02.362 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:17:48.158 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:17:48.158 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:17:48.158 [Cloud] Queued cloud request. 2026-09-08T19:17:48.158 [Cloud] Dequeued cloud request. 2026-09-08T19:17:48.158 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:17:48.158 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:17:48.362 [Cloud] End of cloud request. 2026-09-08T19:17:48.877 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:18:03.143 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T19:28:18.143 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-08T19:28:18.174 Job Notification: New process added to job (6372) 2026-09-08T19:28:18.190 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-08T19:28:18.190 Aggressive catchup quick scan threshold: 692443649104 / 25920000000000 2026-09-08T19:28:18.190 Job Notification: New process added to job (3240) 2026-09-08T19:28:18.205 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:6372] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:3240]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-08T19:28:18.361 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-08T19:28:18.361 Job Notification: New process added to job (6592) 2026-09-08T19:28:18.377 Job Notification: New process added to job (7996) 2026-09-08T19:28:18.455 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:6592] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7996]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-08T19:28:18.565 Job Notification: New process added to job (3492) 2026-09-08T19:28:18.580 Task(GetDeviceTicket -AccessKey 418BCA76-CA9D-57E2-03C3-9AC99479936B ) launched as network service 2026-09-08T19:28:18.705 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-08T19:28:18.705 [RTP] Duplicating the current plugin configuration object... 2026-09-08T19:28:18.705 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-08T19:28:18.705 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-08T19:28:18.705 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-08T19:28:18.705 [RTP] No config change detected. Not updating plugin configuration. 2026-09-08T19:28:18.705 [RTP] No config changes found. No configuration switch. 2026-09-08T19:28:18.705 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-08T19:28:19.361 Job Notification: Process exited from job (3492) 2026-09-08T19:28:20.236 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-08T19:28:20.236 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:28:20.236 [Cloud] Queued cloud request. 2026-09-08T19:28:20.236 [Cloud] Dequeued cloud request. 2026-09-08T19:28:20.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:28:20.424 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-08T19:28:20.424 [Cloud] End of cloud request. 2026-09-08T19:28:20.736 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:28:42.705 Job Notification: Process exited from job (6592) 2026-09-08T19:28:42.705 Job Notification: Process exited from job (7996) 2026-09-08T19:28:42.721 Job Notification: Process exited from job (6372) 2026-09-08T19:28:42.721 Job Notification: Process exited from job (3240) 2026-09-08T19:31:03.346 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:31:03.346 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:31:03.346 [Cloud] Queued cloud request. 2026-09-08T19:31:03.346 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:31:03.346 [Cloud] Dequeued cloud request. 2026-09-08T19:31:03.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:31:03.783 [Cloud] End of cloud request. 2026-09-08T19:31:04.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:33:08.143 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T19:33:12.236 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:33:12.236 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:33:12.236 [Cloud] Queued cloud request. 2026-09-08T19:33:12.236 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:33:12.236 [Cloud] Dequeued cloud request. 2026-09-08T19:33:12.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:33:12.424 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{21C284A2-3804-DF69-C309-D830393F949E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:33:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:33:12.924 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:33:23.908 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:33:23.908 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:33:23.908 [Cloud] Queued cloud request. 2026-09-08T19:33:23.908 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:33:23.908 [Cloud] Dequeued cloud request. 2026-09-08T19:33:23.908 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:33:24.002 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5BFE428B-26BD-5D09-8FED-B52E14E66A3E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:33:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:33:24.518 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:33:57.440 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:33:57.440 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:33:57.456 [Cloud] Queued cloud request. 2026-09-08T19:33:57.456 [Cloud] Dequeued cloud request. 2026-09-08T19:33:57.456 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:33:57.456 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:33:57.549 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DEF4026E-91EB-2AED-AC3C-719F00FBD804} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:33:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:33:58.064 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:34:09.846 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:34:09.846 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:34:09.846 [Cloud] Queued cloud request. 2026-09-08T19:34:09.846 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:34:09.846 [Cloud] Dequeued cloud request. 2026-09-08T19:34:09.846 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{3ED6A744-C049-77B9-A809-A8BCA2BB6C4F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:34:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:34:09.955 [Cloud] End of cloud request. 2026-09-08T19:34:10.471 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:37:02.768 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:37:02.768 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:37:02.768 [Cloud] Queued cloud request. 2026-09-08T19:37:02.768 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:37:02.768 [Cloud] Dequeued cloud request. 2026-09-08T19:37:02.768 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:37:02.955 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0204D54E-9D16-C3BC-0747-3C96AB9675F7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:37:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:37:03.455 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:42:32.705 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:42:32.705 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:42:32.705 [Cloud] Queued cloud request. 2026-09-08T19:42:32.705 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:42:32.705 [Cloud] Dequeued cloud request. 2026-09-08T19:42:32.705 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:42:32.861 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4CB6A5F0-C672-F568-2045-9E8FB4EB02CA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:42:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:42:33.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:42:40.455 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:42:40.455 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:42:40.455 [Cloud] Queued cloud request. 2026-09-08T19:42:40.455 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:42:40.627 [Cloud] Dequeued cloud request. 2026-09-08T19:42:40.627 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:42:40.705 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5480E566-DCAD-27A9-0D4E-AAA9617AB2CB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:42:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:42:41.205 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:44:35.736 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:44:35.736 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:44:35.736 [Cloud] Queued cloud request. 2026-09-08T19:44:35.736 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:44:35.736 [Cloud] Dequeued cloud request. 2026-09-08T19:44:35.736 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:44:35.908 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E3DD1F21-91BF-0EC4-ED3E-6A4FE0CF571E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:44:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:44:36.424 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:48:13.142 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T19:50:36.658 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:50:36.658 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:50:36.658 [Cloud] Queued cloud request. 2026-09-08T19:50:36.658 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:50:36.658 [Cloud] Dequeued cloud request. 2026-09-08T19:50:36.658 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:50:36.798 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1BDEF71D-D7F7-64C7-3365-FD4CE470AA32} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:50:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:50:37.314 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T19:54:32.361 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T19:54:32.361 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T19:54:32.361 [Cloud] Queued cloud request. 2026-09-08T19:54:32.361 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T19:54:32.361 [Cloud] Dequeued cloud request. 2026-09-08T19:54:32.361 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T19:54:32.798 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{21C5FB4F-F289-001D-31E7-AFC85E7434A9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 19:54:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T19:54:33.314 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T20:03:18.142 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T20:07:33.548 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T20:07:33.548 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T20:07:33.548 [Cloud] Queued cloud request. 2026-09-08T20:07:33.548 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T20:07:33.548 [Cloud] Dequeued cloud request. 2026-09-08T20:07:33.548 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T20:07:33.751 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ACDEAC27-4CAD-1010-4911-F2615CD11381} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 20:07:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T20:07:34.251 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T20:09:12.313 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 442557, Count: 30715, MaxTime: 1906, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasbase.lkg, EstimatedImpact: 2% 2026-09-08T20:09:12.313 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 7327, Count: 524, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-08T20:09:12.313 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 214, Count: 16, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-08T20:09:12.313 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-08T20:09:12.313 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-08T20:09:42.642 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T20:09:42.642 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T20:09:42.642 [Cloud] Queued cloud request. 2026-09-08T20:09:42.642 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T20:09:42.642 [Cloud] Dequeued cloud request. 2026-09-08T20:09:42.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T20:09:42.845 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{71CFCC61-B319-C93C-BBDA-12B848C7F2FF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 20:09:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T20:09:43.345 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T20:10:02.767 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T20:10:02.767 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T20:10:02.767 [Cloud] Queued cloud request. 2026-09-08T20:10:02.767 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T20:10:02.767 [Cloud] Dequeued cloud request. 2026-09-08T20:10:02.782 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T20:10:02.860 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C0F59DF0-342D-94D4-95E6-367A74CFAD84} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 20:10:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T20:10:03.376 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T20:11:04.517 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T20:11:04.517 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T20:11:04.517 [Cloud] Queued cloud request. 2026-09-08T20:11:04.517 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T20:11:04.517 [Cloud] Dequeued cloud request. 2026-09-08T20:11:04.517 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T20:11:04.720 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D68D01D2-F620-9646-DF8C-5251E495EF7B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 20:11:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T20:11:05.235 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T20:11:58.813 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T20:11:58.813 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T20:11:58.813 [Cloud] Queued cloud request. 2026-09-08T20:11:58.813 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T20:11:58.813 [Cloud] Dequeued cloud request. 2026-09-08T20:11:58.813 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T20:11:58.907 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DD3DF9FE-52E1-0EFD-372C-F2B38A31AC21} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 20:11:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T20:11:59.407 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T20:15:28.142 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T20:15:28.142 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T20:15:28.142 [Cloud] Queued cloud request. 2026-09-08T20:15:28.142 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T20:15:28.142 [Cloud] Dequeued cloud request. 2026-09-08T20:15:28.142 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T20:15:38.298 [Cloud] End of cloud request. 2026-09-08T20:15:38.798 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T20:18:10.001 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T20:18:10.001 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T20:18:10.001 [Cloud] Queued cloud request. 2026-09-08T20:18:10.001 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T20:18:10.001 [Cloud] Dequeued cloud request. 2026-09-08T20:18:10.001 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T20:18:10.173 [Cloud] End of cloud request. 2026-09-08T20:18:10.673 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T20:18:23.141 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T20:33:28.141 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T20:48:33.140 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{5E3F94BD-62C4-80E3-9AA9-FB30C6235D38} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-08-2026 20:51:09 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T20:51:10.922 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T20:51:10.922 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T20:51:10.922 [Cloud] Queued cloud request. 2026-09-08T20:51:10.922 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T20:51:10.922 [Cloud] Dequeued cloud request. 2026-09-08T20:51:10.922 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T20:51:11.062 [Cloud] End of cloud request. 2026-09-08T20:51:11.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T21:00:23.421 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T21:00:23.421 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T21:00:23.421 [Cloud] Queued cloud request. 2026-09-08T21:00:23.421 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T21:00:23.421 [Cloud] Dequeued cloud request. 2026-09-08T21:00:23.421 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T21:00:23.609 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C49A4F50-0167-F00D-3253-7914EA488539} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 21:00:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T21:00:24.109 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T21:03:38.140 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T21:16:02.484 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T21:16:02.484 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T21:16:02.484 [Cloud] Queued cloud request. 2026-09-08T21:16:02.484 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T21:16:02.484 [Cloud] Dequeued cloud request. 2026-09-08T21:16:02.484 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T21:16:12.593 [Cloud] End of cloud request. 2026-09-08T21:16:13.093 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T21:17:11.468 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T21:17:11.468 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T21:17:11.468 [Cloud] Queued cloud request. 2026-09-08T21:17:11.468 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T21:17:11.468 [Cloud] Dequeued cloud request. 2026-09-08T21:17:11.468 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T21:17:11.562 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1E960416-A0CD-B8D6-30BD-F41EE156D177} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 21:17:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T21:17:12.062 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T21:18:43.141 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T21:23:30.750 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T21:23:30.750 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T21:23:30.750 [Cloud] Queued cloud request. 2026-09-08T21:23:30.750 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T21:23:30.750 [Cloud] Dequeued cloud request. 2026-09-08T21:23:30.766 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{15722CE5-AC37-203B-4B28-E2C4BDA0E35E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 21:23:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T21:23:31.125 [Cloud] End of cloud request. 2026-09-08T21:23:31.625 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T21:25:33.203 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T21:25:33.203 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T21:25:33.203 [Cloud] Queued cloud request. 2026-09-08T21:25:33.203 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T21:25:33.203 [Cloud] Dequeued cloud request. 2026-09-08T21:25:33.203 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T21:25:33.360 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{05F97D40-C44A-C9F3-2E59-5D077337E34A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 21:25:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T21:25:33.875 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T21:26:40.485 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T21:26:40.485 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T21:26:40.485 [Cloud] Queued cloud request. 2026-09-08T21:26:40.485 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T21:26:40.485 [Cloud] Dequeued cloud request. 2026-09-08T21:26:40.485 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T21:26:40.703 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{09D0C2B3-0465-7000-3B7B-0EB6A0C89D88} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 21:26:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T21:26:41.203 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T21:30:18.485 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T21:30:18.485 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T21:30:18.485 [Cloud] Queued cloud request. 2026-09-08T21:30:18.485 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T21:30:18.485 [Cloud] Dequeued cloud request. 2026-09-08T21:30:18.500 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T21:30:18.703 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D931E94C-ADAF-EE50-0FFF-5FED8CA508D8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 21:30:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T21:30:19.203 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T21:33:48.141 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T21:47:27.828 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T21:47:27.828 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T21:47:27.828 [Cloud] Queued cloud request. 2026-09-08T21:47:27.828 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T21:47:27.828 [Cloud] Dequeued cloud request. 2026-09-08T21:47:27.844 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T21:47:28.047 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F76033E0-FE99-C6C1-D71B-5C288CCE62C5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 21:47:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T21:47:28.547 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T21:48:53.141 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T21:50:26.703 [NRI] Successfully updated NIS service with platform settings for enforcement level Log IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-08T21:50:26.735 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-08T21:50:26.735 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-08T21:50:26.735 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-08T21:50:26.735 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T21:50:26.735 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-08T21:50:26.735 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-08T21:50:26.735 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-08T21:50:26.735 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-08T21:50:26.735 MdCoreSvc is supported in this platform and OS 2026-09-08T21:50:27.219 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-08T21:50:27.219 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-08T21:50:27.219 [KSL] Leaving CKSLEngine::EnableKsl(0). BEGIN BM telemetry GUID:{951DFE54-AC6F-B8CD-3B50-5094B75043EF} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-08-2026 21:56:07 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T21:56:09.094 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T21:56:09.094 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T21:56:09.094 [Cloud] Queued cloud request. 2026-09-08T21:56:09.094 [Cloud] Dequeued cloud request. 2026-09-08T21:56:09.094 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T21:56:09.094 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T21:56:09.438 [Cloud] End of cloud request. 2026-09-08T21:56:09.938 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T22:03:58.141 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T22:09:12.312 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 646069, Count: 42191, MaxTime: 1906, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasbase.lkg, EstimatedImpact: 2% 2026-09-08T22:09:12.312 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 9454, Count: 689, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-08T22:09:12.312 ProcessImageName: powershell.exe, Pid: 7916, TotalTime: 1390, Count: 96, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-08T22:09:12.312 ProcessImageName: WmiPrvSE.exe, Pid: 1592, TotalTime: 845, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-08T22:09:12.312 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 583, Count: 44, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\CommandLine.dll, EstimatedImpact: 0% 2026-09-08T22:09:12.312 ProcessImageName: AgentShellService.exe, Pid: 7092, TotalTime: 480, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 36% 2026-09-08T22:09:12.312 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 320, Count: 24, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-08T22:09:12.312 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-08T22:09:12.312 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-08T22:09:12.312 ProcessImageName: taskhostw.exe, Pid: 7812, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 6% 2026-09-08T22:09:12.312 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 46, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-7867-0.MAI, EstimatedImpact: 0% 2026-09-08T22:09:12.312 ProcessImageName: taskhostw.exe, Pid: 5916, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-08T22:09:12.312 ProcessImageName: powershell.exe, Pid: 7472, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_uqpra3uv.uh0.ps1, EstimatedImpact: 0% 2026-09-08T22:09:12.312 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-08T22:10:24.922 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T22:10:24.922 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T22:10:24.922 [Cloud] Queued cloud request. 2026-09-08T22:10:24.922 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T22:10:24.922 [Cloud] Dequeued cloud request. 2026-09-08T22:10:24.922 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T22:10:25.140 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{99749E1F-9F59-6754-165E-EF36A0FCC721} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 22:10:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T22:10:25.656 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T22:15:08.234 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T22:15:08.234 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T22:15:08.234 [Cloud] Queued cloud request. 2026-09-08T22:15:08.234 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T22:15:08.234 [Cloud] Dequeued cloud request. 2026-09-08T22:15:08.234 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T22:15:08.453 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06D76919-3DCF-52FC-0174-B5E597E1D532} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 22:15:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T22:15:08.953 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T22:16:34.891 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T22:16:34.891 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T22:16:34.891 [Cloud] Queued cloud request. 2026-09-08T22:16:34.891 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T22:16:34.891 [Cloud] Dequeued cloud request. 2026-09-08T22:16:34.891 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T22:16:35.094 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F450D4FD-26FD-0E87-7A8C-71FBE2438646} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 22:16:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T22:16:35.609 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T22:19:03.140 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T22:20:10.797 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T22:20:10.797 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T22:20:10.797 [Cloud] Queued cloud request. 2026-09-08T22:20:10.797 [Cloud] Dequeued cloud request. 2026-09-08T22:20:10.797 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T22:20:10.797 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T22:20:11.000 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{58A14D6C-11A6-BC6F-F53A-CF385ACB1C50} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 22:20:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T22:20:11.500 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T22:20:47.937 Bm signature throttled:0x000135b39c9104ce 2026-09-08T22:26:28.359 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T22:26:28.359 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T22:26:28.359 [Cloud] Queued cloud request. 2026-09-08T22:26:28.359 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T22:26:28.359 [Cloud] Dequeued cloud request. 2026-09-08T22:26:28.375 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{19FB2D99-5A6B-A3F0-FD94-5C00E4811808} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 22:26:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T22:26:28.531 [Cloud] End of cloud request. 2026-09-08T22:26:29.047 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T22:31:01.750 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T22:31:01.750 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T22:31:01.750 [Cloud] Queued cloud request. 2026-09-08T22:31:01.750 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T22:31:01.953 [Cloud] Dequeued cloud request. 2026-09-08T22:31:01.953 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T22:31:02.125 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{45405FCE-3BA9-634D-167C-B07ECA7D802F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 22:31:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T22:31:02.640 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T22:34:08.140 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T22:41:35.078 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T22:41:35.078 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T22:41:35.078 [Cloud] Queued cloud request. 2026-09-08T22:41:35.078 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T22:41:35.078 [Cloud] Dequeued cloud request. 2026-09-08T22:41:35.078 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T22:42:59.359 [Cloud] End of cloud request. 2026-09-08T22:42:59.859 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T22:48:43.749 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T22:48:43.749 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T22:48:43.749 [Cloud] Queued cloud request. 2026-09-08T22:48:43.749 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T22:48:43.749 [Cloud] Dequeued cloud request. 2026-09-08T22:48:43.749 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T22:48:43.906 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{66CBC177-8757-759E-A51B-58C93E3A3995} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 22:48:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T22:48:44.421 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T22:48:45.546 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T22:48:45.546 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T22:48:45.546 [Cloud] Queued cloud request. 2026-09-08T22:48:45.546 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T22:48:45.546 [Cloud] Dequeued cloud request. 2026-09-08T22:48:45.546 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T22:48:45.687 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{988D944B-478E-9F23-FE1E-064F71C98A4F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 22:48:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T22:48:46.202 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T22:49:13.140 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T22:55:41.983 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T22:55:41.983 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T22:55:41.983 [Cloud] Queued cloud request. 2026-09-08T22:55:41.983 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T22:55:41.983 [Cloud] Dequeued cloud request. 2026-09-08T22:55:41.983 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T22:55:42.140 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{98451748-5C9B-48BC-3DE6-FCCF525AB354} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 22:55:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T22:55:42.640 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T23:02:09.030 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T23:02:09.030 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T23:02:09.030 [Cloud] Queued cloud request. 2026-09-08T23:02:09.030 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T23:02:09.030 [Cloud] Dequeued cloud request. 2026-09-08T23:02:09.030 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T23:02:09.233 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A63D53E2-77F9-26EC-1258-6BE32260AA46} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 23:02:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T23:02:09.733 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T23:04:18.140 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T23:19:23.139 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T23:31:24.483 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T23:31:24.483 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T23:31:24.483 [Cloud] Queued cloud request. 2026-09-08T23:31:24.483 [Cloud] Dequeued cloud request. 2026-09-08T23:31:24.483 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T23:31:24.483 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T23:31:24.670 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0CE81BCF-B662-EF31-A39B-690EDD4A355F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 23:31:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T23:31:25.186 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T23:34:28.139 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T23:37:09.670 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T23:37:09.670 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T23:37:09.670 [Cloud] Queued cloud request. 2026-09-08T23:37:09.670 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T23:37:09.670 [Cloud] Dequeued cloud request. 2026-09-08T23:37:09.670 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T23:37:09.826 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6494DC96-0E59-F86B-1EF4-5D915B932B0A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 23:37:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T23:37:10.326 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T23:41:33.482 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T23:41:33.482 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T23:41:33.482 [Cloud] Queued cloud request. 2026-09-08T23:41:33.482 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T23:41:33.482 [Cloud] Dequeued cloud request. 2026-09-08T23:41:33.482 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T23:41:33.638 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2DEC9150-332D-D9CA-C57F-9CC1276F1B75} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 23:41:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T23:41:34.154 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T23:49:33.138 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-08T23:49:36.154 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T23:49:36.154 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T23:49:36.154 [Cloud] Queued cloud request. 2026-09-08T23:49:36.154 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T23:49:36.154 [Cloud] Dequeued cloud request. 2026-09-08T23:49:36.154 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T23:49:36.451 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CD3DA90D-717B-161F-A8D9-3555539AD98B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 23:49:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T23:49:36.951 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-08T23:50:43.045 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-08T23:50:43.045 [Cloud] Start of cloud request. Passive mode: 0 2026-09-08T23:50:43.045 [Cloud] Queued cloud request. 2026-09-08T23:50:43.045 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-08T23:50:43.045 [Cloud] Dequeued cloud request. 2026-09-08T23:50:43.045 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-08T23:50:43.232 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{18ECAAD5-7611-5D41-B487-62C96BD5053D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-08-2026 23:50:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-08T23:50:43.748 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:00:26.154 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:00:26.154 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:00:26.154 [Cloud] Queued cloud request. 2026-09-09T00:00:26.154 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:00:26.154 [Cloud] Dequeued cloud request. 2026-09-09T00:00:26.169 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:00:26.497 [Cloud] End of cloud request. 2026-09-09T00:00:27.013 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:02:52.826 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:02:52.826 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:02:52.826 [Cloud] Queued cloud request. 2026-09-09T00:02:52.826 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:02:52.826 [Cloud] Dequeued cloud request. 2026-09-09T00:02:52.826 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:02:53.060 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0813F9EB-19DC-F86C-6D4E-07E7549BDC56} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:02:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:02:53.560 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:04:38.138 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T00:07:12.404 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:07:12.404 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:07:12.404 [Cloud] Queued cloud request. 2026-09-09T00:07:12.404 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:07:12.404 [Cloud] Dequeued cloud request. 2026-09-09T00:07:12.404 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:07:12.654 [Cloud] End of cloud request. 2026-09-09T00:07:13.169 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:07:49.794 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:07:49.794 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:07:49.794 [Cloud] Queued cloud request. 2026-09-09T00:07:49.794 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:07:49.810 [Cloud] Dequeued cloud request. 2026-09-09T00:07:49.810 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:07:49.888 [Cloud] End of cloud request. 2026-09-09T00:07:50.388 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:08:12.325 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:08:12.325 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:08:12.325 [Cloud] Queued cloud request. 2026-09-09T00:08:12.325 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:08:12.325 [Cloud] Dequeued cloud request. 2026-09-09T00:08:12.325 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:08:12.404 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5E69CCD1-5DDC-46CB-5525-E451C39CFC2E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:08:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:08:12.904 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:09:12.310 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 844283, Count: 57799, MaxTime: 1906, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasbase.lkg, EstimatedImpact: 2% 2026-09-09T00:09:12.310 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 9454, Count: 689, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T00:09:12.310 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 2801, Count: 229, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\CommandLine.dll, EstimatedImpact: 0% 2026-09-09T00:09:12.310 ProcessImageName: powershell.exe, Pid: 7916, TotalTime: 1390, Count: 96, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-09T00:09:12.310 ProcessImageName: WmiPrvSE.exe, Pid: 1592, TotalTime: 845, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-09T00:09:12.310 ProcessImageName: AgentShellService.exe, Pid: 7092, TotalTime: 480, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 36% 2026-09-09T00:09:12.310 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 320, Count: 24, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-09T00:09:12.310 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 135, Count: 11, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-09T00:09:12.310 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-09T00:09:12.310 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-7867-0.MAI, EstimatedImpact: 0% 2026-09-09T00:09:12.310 ProcessImageName: taskhostw.exe, Pid: 7812, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 6% 2026-09-09T00:09:12.310 ProcessImageName: taskhostw.exe, Pid: 5916, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-09T00:09:12.310 ProcessImageName: powershell.exe, Pid: 7472, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_uqpra3uv.uh0.ps1, EstimatedImpact: 0% 2026-09-09T00:09:12.310 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-09T00:09:19.154 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:09:19.154 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:09:19.154 [Cloud] Queued cloud request. 2026-09-09T00:09:19.154 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:09:19.154 [Cloud] Dequeued cloud request. 2026-09-09T00:09:19.154 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{00BC1B9F-BB20-8A2B-8E6E-867F40E04F07} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:09:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:09:19.372 [Cloud] End of cloud request. 2026-09-09T00:09:19.872 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:14:13.857 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:B8B3BD04-D9FC-4C89-A0E1-2133F1F5EF79, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-09T00:14:13.857 Scheduled scan with Id B8B3BD04-D9FC-4C89-A0E1-2133F1F5EF79 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-09T00:14:13.857 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-09T00:14:13.857 [SFC] System file cache build is not needed (already completed) 2026-09-09T00:14:37.732 Engine:Triggered AR EMS scan 2026-09-09T00:14:37.747 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.763 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.779 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.779 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.794 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.810 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.810 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.825 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.841 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.841 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.841 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.841 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.857 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.857 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.872 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.872 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.888 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.905 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.919 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.919 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.935 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.935 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.935 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.950 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.950 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.966 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.982 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:37.997 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.013 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.013 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.029 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.029 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.044 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.060 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.060 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.075 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.075 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.091 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.091 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.091 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.091 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.107 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.122 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.122 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.138 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.138 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.154 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.154 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.169 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.185 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.200 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.216 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.216 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.232 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.247 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.279 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.294 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.310 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.325 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.341 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:14:38.357 Engine:EMS scan for process: svchost pid: 7904, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-09T00:15:19.654 QuickScan:ScanID:B8B3BD04-D9FC-4C89-A0E1-2133F1F5EF79: Quick scan finished with error 0 2026-09-09T00:15:20.169 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-09T00:15:20.169 [RTP] Duplicating the current plugin configuration object... 2026-09-09T00:15:20.169 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-09T00:15:20.169 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-09T00:15:20.169 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-09T00:15:20.169 [RTP] No config change detected. Not updating plugin configuration. 2026-09-09T00:15:20.169 [RTP] No config changes found. No configuration switch. 2026-09-09T00:15:20.169 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-09T00:19:43.138 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T00:27:23.950 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:27:23.950 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:27:23.950 [Cloud] Queued cloud request. 2026-09-09T00:27:23.950 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:27:23.950 [Cloud] Dequeued cloud request. 2026-09-09T00:27:23.950 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:27:24.091 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F2F0816-42BB-DA70-45FD-39994BC5067F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:27:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:27:24.606 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:27:30.106 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:27:30.106 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:27:30.106 [Cloud] Queued cloud request. 2026-09-09T00:27:30.106 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:27:30.106 [Cloud] Dequeued cloud request. 2026-09-09T00:27:30.106 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:27:30.200 [Cloud] End of cloud request. 2026-09-09T00:27:30.716 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:29:40.012 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:29:40.012 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:29:40.012 [Cloud] Queued cloud request. 2026-09-09T00:29:40.012 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:29:40.012 [Cloud] Dequeued cloud request. 2026-09-09T00:29:40.012 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:29:40.153 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2A1C74AB-69A2-3AAE-823B-97C74C2CC6A4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:29:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:29:40.669 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:31:07.825 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:31:07.825 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:31:07.825 [Cloud] Queued cloud request. 2026-09-09T00:31:07.825 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:31:07.825 [Cloud] Dequeued cloud request. 2026-09-09T00:31:07.825 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:31:07.981 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D3DE502F-83B0-2990-E4F4-478AB251C72B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:31:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:31:08.497 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:31:35.856 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:31:35.856 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:31:35.856 [Cloud] Queued cloud request. 2026-09-09T00:31:35.856 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:31:35.856 [Cloud] Dequeued cloud request. 2026-09-09T00:31:35.856 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:31:35.934 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{01A8DAD4-D715-6FF9-9B1B-EE622E201298} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:31:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:31:36.434 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:33:13.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:33:13.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:33:13.387 [Cloud] Queued cloud request. 2026-09-09T00:33:13.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:33:13.387 [Cloud] Dequeued cloud request. 2026-09-09T00:33:13.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:33:13.528 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E33EEF31-A9A6-9F71-C1AF-8FD0777DD6E6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:33:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:33:14.044 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:34:48.137 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T00:42:37.153 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:42:37.153 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:42:37.153 [Cloud] Queued cloud request. 2026-09-09T00:42:37.153 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:42:37.153 [Cloud] Dequeued cloud request. 2026-09-09T00:42:37.153 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:42:37.309 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C8E5F47B-99EE-C9EF-FC1C-98C50D266339} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:42:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:42:37.809 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:44:37.825 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:44:37.825 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:44:37.825 [Cloud] Queued cloud request. 2026-09-09T00:44:37.825 [Cloud] Dequeued cloud request. 2026-09-09T00:44:37.825 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:44:37.825 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:44:37.997 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7259F2F4-0DC4-551C-0EA0-B2A7606A5C00} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:44:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:44:38.497 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:44:54.325 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:44:54.325 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:44:54.325 [Cloud] Queued cloud request. 2026-09-09T00:44:54.325 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:44:54.325 [Cloud] Dequeued cloud request. 2026-09-09T00:44:54.325 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{4156BBCC-C1CA-E9A9-39FF-C360B97E67EA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:44:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:44:54.450 [Cloud] End of cloud request. 2026-09-09T00:44:54.950 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:49:10.559 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:49:10.559 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:49:10.559 [Cloud] Queued cloud request. 2026-09-09T00:49:10.559 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:49:10.559 [Cloud] Dequeued cloud request. 2026-09-09T00:49:10.575 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:49:10.700 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7CBB3D40-BC19-9327-865F-D20933355750} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:49:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:49:11.200 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:49:53.137 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T00:53:18.918 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:53:18.918 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:53:18.918 [Cloud] Queued cloud request. 2026-09-09T00:53:18.918 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:53:18.918 [Cloud] Dequeued cloud request. 2026-09-09T00:53:18.918 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:53:19.075 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{465EB487-FF20-1E19-C8E5-E40E85A7CD56} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:53:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:53:19.590 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:54:21.637 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:54:21.637 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:54:21.637 [Cloud] Queued cloud request. 2026-09-09T00:54:21.637 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:54:21.637 [Cloud] Dequeued cloud request. 2026-09-09T00:54:21.637 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:54:21.793 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{582DD9BC-EB9B-A969-F3E0-F09F134AE520} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:54:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:54:22.309 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T00:59:25.889 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T00:59:25.889 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T00:59:25.889 [Cloud] Queued cloud request. 2026-09-09T00:59:25.889 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T00:59:25.889 [Cloud] Dequeued cloud request. 2026-09-09T00:59:25.889 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T00:59:26.059 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{489B5FB8-6DC8-48E9-3D01-CB00A0D0782D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 00:59:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T00:59:26.559 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T01:00:02.090 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680123, FileId: 0x1700000003b94a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.090 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680124, FileId: 0x4900000002cc34, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.106 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680129, FileId: 0x1900000003b94a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.106 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680130, FileId: 0x4b00000002cc34, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.121 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680135, FileId: 0x1b00000003b94a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.121 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680136, FileId: 0x4d00000002cc34, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.137 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680141, FileId: 0x1d00000003b94a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.137 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680142, FileId: 0x4f00000002cc34, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.153 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680151, FileId: 0x5100000002cc34, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.153 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680150, FileId: 0x1f00000003b94a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.168 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680156, FileId: 0x2100000003b94a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.168 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680157, FileId: 0x5300000002cc34, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.184 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680163, FileId: 0x5500000002cc34, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.184 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680162, FileId: 0x2300000003b94a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.199 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680169, FileId: 0x5700000002cc34, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.199 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680168, FileId: 0x2500000003b94a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.215 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680174, FileId: 0x2700000003b94a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.215 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680175, FileId: 0x5900000002cc34, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.231 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680180, FileId: 0x2900000003b94a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.231 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680181, FileId: 0x5b00000002cc34, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.246 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680186, FileId: 0x2b00000003b94a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.246 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680187, FileId: 0x5d00000002cc34, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.262 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680192, FileId: 0x2d00000003b94a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:00:02.262 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-862c-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2680193, FileId: 0x5f00000002cc34, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T01:04:58.137 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T01:05:06.106 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:05:06.106 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:05:06.106 [Cloud] Queued cloud request. 2026-09-09T01:05:06.106 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:05:06.106 [Cloud] Dequeued cloud request. 2026-09-09T01:05:06.121 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T01:05:06.324 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1FBB020E-3030-AA2C-CB5A-7A110FAE14F3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 01:05:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T01:05:06.840 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0x62fe7fc0 2026-09-09T01:12:41.355 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$R30CG93\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0x1044fcb3 2026-09-09T01:12:41.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:12:41.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:12:41.387 [Cloud] Queued cloud request. 2026-09-09T01:12:41.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:12:41.387 [Cloud] Dequeued cloud request. 2026-09-09T01:12:41.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T01:12:41.949 [Cloud] End of cloud request. 2026-09-09T01:12:41.949 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$R30CG93\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-09-09T01:12:42.465 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=true, source=2, resourceid=0xd681195e Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=true, source=2, resourceid=0xa9fc2db7 2026-09-09T01:15:39.715 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:15:39.715 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:15:39.715 [Cloud] Queued cloud request. 2026-09-09T01:15:39.715 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:15:39.715 [Cloud] Dequeued cloud request. 2026-09-09T01:15:39.730 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T01:15:39.886 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{526F49FD-1DB7-8E2D-8F5E-283D0CFC8389} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 01:15:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T01:15:40.402 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T01:19:06.480 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:19:06.480 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:19:06.480 [Cloud] Queued cloud request. 2026-09-09T01:19:06.480 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:19:06.480 [Cloud] Dequeued cloud request. 2026-09-09T01:19:06.480 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T01:19:06.637 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{417727B5-1A9C-2C00-EA97-C7810BB6EECA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 01:19:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T01:19:07.152 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T01:20:03.137 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T01:22:20.965 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:22:20.965 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:22:20.965 [Cloud] Queued cloud request. 2026-09-09T01:22:20.965 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:22:20.965 [Cloud] Dequeued cloud request. 2026-09-09T01:22:20.980 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T01:22:31.058 [Cloud] End of cloud request. 2026-09-09T01:22:31.558 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T01:26:39.652 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:26:39.652 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:26:39.652 [Cloud] Queued cloud request. 2026-09-09T01:26:39.652 [Cloud] Dequeued cloud request. 2026-09-09T01:26:39.652 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:26:39.652 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T01:26:39.933 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{927456E5-85D3-CD49-403C-C16548C20E2B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 01:26:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T01:26:40.449 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T01:28:02.027 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:28:02.027 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:28:02.027 [Cloud] Queued cloud request. 2026-09-09T01:28:02.027 [Cloud] Dequeued cloud request. 2026-09-09T01:28:02.043 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:28:02.043 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T01:28:02.246 [Cloud] End of cloud request. 2026-09-09T01:28:02.746 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T01:29:21.339 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:29:21.339 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:29:21.339 [Cloud] Queued cloud request. 2026-09-09T01:29:21.339 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:29:21.339 [Cloud] Dequeued cloud request. 2026-09-09T01:29:21.339 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T01:29:21.543 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DAA89724-0EA0-D4D7-68A7-501D3B0F2D45} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 01:29:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T01:29:22.043 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T01:35:08.136 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T01:35:12.543 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:35:12.543 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:35:12.543 [Cloud] Queued cloud request. 2026-09-09T01:35:12.543 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:35:12.543 [Cloud] Dequeued cloud request. 2026-09-09T01:35:12.543 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T01:35:17.214 [Cloud] End of cloud request. 2026-09-09T01:35:17.730 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T01:38:03.261 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:38:03.261 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:38:03.261 [Cloud] Queued cloud request. 2026-09-09T01:38:03.261 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:38:03.261 [Cloud] Dequeued cloud request. 2026-09-09T01:38:03.261 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T01:38:08.183 [Cloud] End of cloud request. 2026-09-09T01:38:08.699 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T01:42:54.574 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:42:54.574 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:42:54.574 [Cloud] Queued cloud request. 2026-09-09T01:42:54.574 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:42:54.589 [Cloud] Dequeued cloud request. 2026-09-09T01:42:54.589 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T01:42:54.730 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{42B13828-14BE-5688-F2AC-79933FBF9EDB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 01:42:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T01:42:55.245 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T01:43:23.027 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:43:23.027 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:43:23.027 [Cloud] Queued cloud request. 2026-09-09T01:43:23.027 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:43:23.027 [Cloud] Dequeued cloud request. 2026-09-09T01:43:23.027 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T01:43:23.105 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{962C7C5F-E287-5193-0905-1B36495E4254} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 01:43:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T01:43:23.605 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T01:43:31.573 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T01:43:31.573 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T01:43:31.573 [Cloud] Queued cloud request. 2026-09-09T01:43:31.573 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T01:43:31.573 [Cloud] Dequeued cloud request. 2026-09-09T01:43:31.573 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{5CC906A3-289A-E461-EA30-71F922AD30FD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 01:43:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T01:43:31.667 [Cloud] End of cloud request. 2026-09-09T01:43:32.167 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T01:50:13.136 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T01:57:08.932 [AutoPurge] Cleanup Routine tasks have started. 2026-09-09T01:57:08.932 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-09T01:57:08.964 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-09T01:57:08.964 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-09T01:57:08.964 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 1, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-09-2026 01:57:08 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-09-2026 01:57:08 2026-09-09T01:57:08.964 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-09T01:57:08.964 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-09T01:57:08.964 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-09T01:57:08.964 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-09T01:57:08.964 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-09T01:57:08.964 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-09T01:57:08.964 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-09T01:57:08.964 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-09T01:57:08.964 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-09T01:57:08.964 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-09T01:57:08.964 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-09T01:57:09.089 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-09T01:57:09.104 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-09T01:57:09.120 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-09T01:57:09.120 [AutoPurge] Removing expired default signature package ... 2026-09-09T01:57:09.370 Job Notification: New process added to job (1076) 2026-09-09T01:57:10.276 Job Notification: Process exited from job (1076) 2026-09-09T01:57:10.339 [AutoPurge] Verification Routine tasks have ended. 2026-09-09T02:05:18.136 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T02:09:12.323 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1042163, Count: 73062, MaxTime: 1906, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasbase.lkg, EstimatedImpact: 2% 2026-09-09T02:09:12.323 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 9454, Count: 689, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T02:09:12.323 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 5032, Count: 412, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\CommandLine.dll, EstimatedImpact: 0% 2026-09-09T02:09:12.323 ProcessImageName: powershell.exe, Pid: 7916, TotalTime: 1390, Count: 96, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-09T02:09:12.323 ProcessImageName: WmiPrvSE.exe, Pid: 1592, TotalTime: 845, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-09T02:09:12.323 ProcessImageName: AgentShellService.exe, Pid: 7092, TotalTime: 480, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 36% 2026-09-09T02:09:12.323 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 426, Count: 31, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-09T02:09:12.323 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 166, Count: 66, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-7867-0.MAI, EstimatedImpact: 0% 2026-09-09T02:09:12.323 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 150, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-09T02:09:12.323 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-09T02:09:12.323 ProcessImageName: taskhostw.exe, Pid: 7812, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 6% 2026-09-09T02:09:12.323 ProcessImageName: taskhostw.exe, Pid: 5916, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-09T02:09:12.323 ProcessImageName: cmd.exe, Pid: 1208, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-09T02:09:12.323 ProcessImageName: powershell.exe, Pid: 7472, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_uqpra3uv.uh0.ps1, EstimatedImpact: 0% 2026-09-09T02:09:12.323 ProcessImageName: DeviceCensus.exe, Pid: 7396, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-09T02:09:12.323 ProcessImageName: mysqldump.exe, Pid: 4736, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 10% 2026-09-09T02:09:12.323 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-09T02:09:47.995 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T02:09:47.995 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T02:09:47.995 [Cloud] Queued cloud request. 2026-09-09T02:09:47.995 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T02:09:47.995 [Cloud] Dequeued cloud request. 2026-09-09T02:09:47.995 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T02:09:48.495 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{65E5C715-7D53-177D-2CD7-E4020BFA49E8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 02:09:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T02:09:49.010 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-09T02:09:49.042 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T02:09:49.042 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-09T02:09:49.042 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-09T02:09:49.042 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-09T02:09:49.042 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-09T02:09:49.042 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-09T02:09:49.042 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-09T02:09:49.042 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-09T02:09:49.042 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-09T02:09:49.042 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-09T02:09:49.042 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-09T02:09:49.042 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-09T02:09:49.042 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-09T02:09:49.042 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-09T02:09:49.042 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-09T02:09:49.042 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-09T02:09:49.042 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-09T02:09:49.042 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-09T02:09:49.042 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-09T02:09:49.042 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T02:09:49.042 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-09T02:09:49.042 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-09T02:09:49.042 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T02:09:49.057 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T02:09:49.057 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T02:09:51.620 [RTP] Duplicating the current plugin configuration object... 2026-09-09T02:09:51.620 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-09T02:09:51.620 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-09T02:09:51.620 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-09T02:09:51.620 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-09T02:09:51.620 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-09T02:17:14.292 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T02:17:14.292 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T02:17:14.292 [Cloud] Queued cloud request. 2026-09-09T02:17:14.292 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T02:17:14.292 [Cloud] Dequeued cloud request. 2026-09-09T02:17:14.292 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T02:17:14.495 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ED80B982-3552-4FF7-971B-454E078EAB53} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 02:17:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T02:17:14.995 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T02:17:59.526 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T02:17:59.526 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T02:17:59.526 [Cloud] Queued cloud request. 2026-09-09T02:17:59.526 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T02:17:59.526 [Cloud] Dequeued cloud request. 2026-09-09T02:17:59.526 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T02:17:59.666 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F7FE2EBF-A384-2A66-E74C-9CAD2ADC4E01} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 02:17:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T02:18:00.182 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T02:20:23.135 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T02:23:11.963 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T02:23:11.963 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T02:23:11.963 [Cloud] Queued cloud request. 2026-09-09T02:23:11.963 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T02:23:11.963 [Cloud] Dequeued cloud request. 2026-09-09T02:23:11.979 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T02:23:12.182 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FE244F44-23D4-20CD-0E9F-97D7B9BB4529} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 02:23:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T02:23:12.697 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T02:26:05.072 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T02:26:05.072 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T02:26:05.072 [Cloud] Queued cloud request. 2026-09-09T02:26:05.072 [Cloud] Dequeued cloud request. 2026-09-09T02:26:05.072 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T02:26:05.072 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T02:26:05.260 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9960ACB7-1A45-C4DB-E34F-4DDD92D172CC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 02:26:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T02:26:05.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T02:35:28.135 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T02:39:59.760 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T02:39:59.760 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T02:39:59.760 [Cloud] Queued cloud request. 2026-09-09T02:39:59.760 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T02:39:59.760 [Cloud] Dequeued cloud request. 2026-09-09T02:39:59.760 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T02:39:59.916 [Cloud] End of cloud request. 2026-09-09T02:39:59.916 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T02:39:59.916 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T02:39:59.916 [Cloud] Queued cloud request. 2026-09-09T02:39:59.916 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T02:39:59.916 [Cloud] Dequeued cloud request. 2026-09-09T02:39:59.916 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{8CE878C6-C583-44F6-7337-91D791601F11} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 02:40:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry BEGIN BM telemetry GUID:{CDDE19F2-6A87-6C48-F784-723860FE1C97} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 02:40:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T02:40:00.015 [Cloud] End of cloud request. 2026-09-09T02:40:00.432 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T02:41:19.572 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T02:41:19.572 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T02:41:19.572 [Cloud] Queued cloud request. 2026-09-09T02:41:19.572 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T02:41:19.572 [Cloud] Dequeued cloud request. 2026-09-09T02:41:19.572 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T02:41:19.713 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DA82CEFF-962E-26A0-6F12-4259DD8095A7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 02:41:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T02:41:20.213 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T02:50:33.134 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T03:04:56.400 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T03:04:56.400 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T03:04:56.416 [Cloud] Queued cloud request. 2026-09-09T03:04:56.416 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T03:04:56.416 [Cloud] Dequeued cloud request. 2026-09-09T03:04:56.416 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T03:04:56.572 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D4585EDB-3D6C-7739-D052-15C1033D2233} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 03:04:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T03:04:57.087 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T03:05:38.134 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T03:12:36.072 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T03:12:36.072 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T03:12:36.072 [Cloud] Queued cloud request. 2026-09-09T03:12:36.072 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T03:12:36.072 [Cloud] Dequeued cloud request. 2026-09-09T03:12:36.087 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T03:12:36.228 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{29767953-CFDC-0436-7EF5-EAE630E940FC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 03:12:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T03:12:36.728 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T03:15:58.837 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T03:15:58.837 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T03:15:58.837 [Cloud] Queued cloud request. 2026-09-09T03:15:58.837 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T03:15:58.837 [Cloud] Dequeued cloud request. 2026-09-09T03:15:58.837 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T03:15:59.025 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9D92BB9E-6050-FB3B-2BED-085CDDC3E686} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 03:15:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T03:15:59.540 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T03:17:14.275 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T03:17:14.275 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T03:17:14.275 [Cloud] Queued cloud request. 2026-09-09T03:17:14.275 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T03:17:14.275 [Cloud] Dequeued cloud request. 2026-09-09T03:17:14.290 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T03:17:14.431 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8A120F5B-056F-4312-83DD-B3F27CB53950} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 03:17:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T03:17:14.931 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T03:20:43.134 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e 2026-09-09T03:30:54.743 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7 2026-09-09T03:30:54.774 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T03:30:54.774 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T03:30:54.774 [Cloud] Queued cloud request. 2026-09-09T03:30:54.774 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T03:30:54.774 [Cloud] Dequeued cloud request. 2026-09-09T03:30:54.774 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T03:30:55.056 [Cloud] End of cloud request. 2026-09-09T03:30:55.056 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-09-09T03:30:55.556 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T03:35:48.134 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{2D4DF8CE-E4AC-69EB-7E15-58844B786437} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-09-2026 03:36:33 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T03:36:33.790 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T03:36:33.790 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T03:36:33.790 [Cloud] Queued cloud request. 2026-09-09T03:36:33.790 [Cloud] Dequeued cloud request. 2026-09-09T03:36:33.790 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T03:36:33.790 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T03:36:33.915 [Cloud] End of cloud request. 2026-09-09T03:36:34.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T03:49:53.680 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T03:49:53.680 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T03:49:53.680 [Cloud] Queued cloud request. 2026-09-09T03:49:53.680 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T03:49:53.680 [Cloud] Dequeued cloud request. 2026-09-09T03:49:53.696 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T03:49:53.852 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2BBBC3E1-E6C2-3D3E-E469-5B64C1B32514} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 03:49:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T03:49:54.368 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T03:50:53.133 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T03:58:33.149 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T03:58:33.149 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T03:58:33.149 [Cloud] Queued cloud request. 2026-09-09T03:58:33.149 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T03:58:33.149 [Cloud] Dequeued cloud request. 2026-09-09T03:58:33.149 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T03:58:43.227 [Cloud] End of cloud request. 2026-09-09T03:58:43.727 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T04:00:59.774 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T04:00:59.774 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T04:00:59.774 [Cloud] Queued cloud request. 2026-09-09T04:00:59.774 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T04:00:59.774 [Cloud] Dequeued cloud request. 2026-09-09T04:00:59.774 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T04:00:59.946 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{81208D65-BDE6-50CC-D68C-1ADDA8C04413} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 04:00:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T04:01:00.461 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T04:05:58.133 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T04:07:42.899 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T04:07:42.899 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T04:07:42.899 [Cloud] Queued cloud request. 2026-09-09T04:07:42.899 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T04:07:42.899 [Cloud] Dequeued cloud request. 2026-09-09T04:07:42.899 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T04:07:43.055 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A17CBABB-BB8F-B4BD-2749-20E0AB6503D4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 04:07:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T04:07:43.555 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T04:09:12.336 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1487393, Count: 104330, MaxTime: 1906, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasbase.lkg, EstimatedImpact: 2% 2026-09-09T04:09:12.336 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 9454, Count: 689, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T04:09:12.336 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 6916, Count: 592, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\CommandLine.dll, EstimatedImpact: 0% 2026-09-09T04:09:12.336 ProcessImageName: powershell.exe, Pid: 7916, TotalTime: 1390, Count: 96, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-09T04:09:12.336 ProcessImageName: WmiPrvSE.exe, Pid: 1592, TotalTime: 845, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-09T04:09:12.336 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 577, Count: 43, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-09T04:09:12.336 ProcessImageName: AgentShellService.exe, Pid: 7092, TotalTime: 480, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 36% 2026-09-09T04:09:12.336 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 423, Count: 85, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\76744530b92778e6f251e389724745d7\DesktopDeployment.cab, EstimatedImpact: 0% 2026-09-09T04:09:12.336 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 241, Count: 76, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-7867-0.MAI, EstimatedImpact: 0% 2026-09-09T04:09:12.336 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 150, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-09T04:09:12.336 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-09T04:09:12.336 ProcessImageName: taskhostw.exe, Pid: 7812, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 6% 2026-09-09T04:09:12.336 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-09T04:09:12.336 ProcessImageName: taskhostw.exe, Pid: 5916, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-09T04:09:12.336 ProcessImageName: cmd.exe, Pid: 1208, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-09T04:09:12.336 ProcessImageName: svchost.exe, Pid: 7572, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\2886173b951f5da9c916eb443a81feec52d9ace4\content.phf, EstimatedImpact: 0% 2026-09-09T04:09:12.336 ProcessImageName: powershell.exe, Pid: 7472, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_uqpra3uv.uh0.ps1, EstimatedImpact: 0% 2026-09-09T04:09:12.336 ProcessImageName: DeviceCensus.exe, Pid: 7396, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-09T04:09:12.336 ProcessImageName: mysqldump.exe, Pid: 4736, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 10% 2026-09-09T04:09:12.336 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-09T04:21:03.132 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T04:22:45.961 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T04:22:45.961 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T04:22:45.961 [Cloud] Queued cloud request. 2026-09-09T04:22:45.961 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T04:22:46.117 [Cloud] Dequeued cloud request. 2026-09-09T04:22:46.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T04:22:46.461 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2D6EDF6D-B295-3976-A325-E7E297B4BE4D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 04:22:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T04:22:46.961 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T04:24:48.851 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T04:24:48.851 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T04:24:48.851 [Cloud] Queued cloud request. 2026-09-09T04:24:48.851 [Cloud] Dequeued cloud request. 2026-09-09T04:24:48.851 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T04:24:48.851 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{719C8C58-729D-A8DB-BE78-73FA89315E96} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 04:24:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T04:24:49.085 [Cloud] End of cloud request. 2026-09-09T04:24:49.648 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T04:26:32.273 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T04:26:32.273 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T04:26:32.273 [Cloud] Queued cloud request. 2026-09-09T04:26:32.273 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T04:26:32.273 [Cloud] Dequeued cloud request. 2026-09-09T04:26:32.273 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T04:26:32.413 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E671E556-3CED-0088-8BD6-03B98F748CBD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 04:26:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T04:26:32.914 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T04:36:08.132 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T04:37:19.116 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T04:37:19.116 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T04:37:19.116 [Cloud] Queued cloud request. 2026-09-09T04:37:19.116 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T04:37:19.116 [Cloud] Dequeued cloud request. 2026-09-09T04:37:19.116 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T04:37:19.553 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{511E1A2E-4F4F-20FA-19AD-B67662408D94} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 04:37:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T04:37:20.069 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T04:46:57.475 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T04:46:57.475 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T04:46:57.475 [Cloud] Queued cloud request. 2026-09-09T04:46:57.475 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T04:46:57.475 [Cloud] Dequeued cloud request. 2026-09-09T04:46:57.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T04:46:57.631 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2BF3CE88-2D4A-A972-FBC6-7DFBE35DB09F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 04:46:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T04:46:58.131 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T04:48:06.006 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T04:48:06.006 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T04:48:06.006 [Cloud] Queued cloud request. 2026-09-09T04:48:06.006 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T04:48:06.006 [Cloud] Dequeued cloud request. 2026-09-09T04:48:06.006 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T04:48:06.209 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{55C9A749-CB0F-7781-8E2C-1E13AE807E46} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 04:48:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T04:48:06.725 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T04:49:36.146 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T04:49:36.146 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T04:49:36.146 [Cloud] Queued cloud request. 2026-09-09T04:49:36.146 [Cloud] Dequeued cloud request. 2026-09-09T04:49:36.146 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T04:49:36.146 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T04:49:36.349 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EB790E3C-3776-92F2-EC25-796D470F589E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 04:49:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T04:49:36.849 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T04:51:13.131 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T04:55:53.787 Bm signature throttled:0x000135b39c9104ce 2026-09-09T04:56:40.568 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T04:56:40.568 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T04:56:40.568 [Cloud] Queued cloud request. 2026-09-09T04:56:40.568 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T04:56:40.568 [Cloud] Dequeued cloud request. 2026-09-09T04:56:40.568 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T04:56:40.771 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8A3904FF-AC0F-6802-5E16-13D3CE1093D0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 04:56:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T04:56:41.271 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T04:58:39.959 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T04:58:39.959 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T04:58:39.959 [Cloud] Queued cloud request. 2026-09-09T04:58:39.959 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T04:58:39.959 [Cloud] Dequeued cloud request. 2026-09-09T04:58:39.959 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T04:58:40.115 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CC25DD1C-01FC-7535-E9AD-392611C0CA6B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 04:58:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T04:58:40.615 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x56d96c17 2026-09-09T04:59:33.396 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T04:59:33.396 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T04:59:33.396 [Cloud] Queued cloud request. 2026-09-09T04:59:33.396 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T04:59:33.396 [Cloud] Dequeued cloud request. 2026-09-09T04:59:33.396 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T04:59:33.880 [Cloud] End of cloud request. 2026-09-09T04:59:33.880 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpMyAdmin\tbl_changer.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x3329faf726b1 2026-09-09T04:59:34.380 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T05:00:28.068 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T05:00:28.068 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T05:00:28.068 [Cloud] Queued cloud request. 2026-09-09T05:00:28.068 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T05:00:28.068 [Cloud] Dequeued cloud request. 2026-09-09T05:00:28.068 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T05:00:28.193 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F927F58B-9589-55BF-A3DF-F8D89933FD26} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 05:00:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T05:00:28.693 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T05:01:10.646 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T05:01:10.646 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T05:01:10.646 [Cloud] Queued cloud request. 2026-09-09T05:01:10.646 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T05:01:10.646 [Cloud] Dequeued cloud request. 2026-09-09T05:01:10.662 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T05:01:10.740 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2411C628-5464-B107-5424-C730FB40272E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 05:01:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T05:01:11.240 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T05:06:18.131 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T05:16:30.912 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-8880-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2811692, FileId: 0x7000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T05:16:30.912 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-8880-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2811691, FileId: 0x200000000a02f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T05:21:23.131 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T05:31:08.834 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-88ba-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2819559, FileId: 0x400000000a37f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T05:31:08.834 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-88ba-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2819558, FileId: 0x1a00000000a405, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T05:32:31.568 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T05:32:31.568 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T05:32:31.568 [Cloud] Queued cloud request. 2026-09-09T05:32:31.568 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T05:32:31.568 [Cloud] Dequeued cloud request. 2026-09-09T05:32:31.584 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{DD6EDC03-00B9-F857-F081-EBBA37919A38} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 05:32:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T05:32:31.740 [Cloud] End of cloud request. 2026-09-09T05:32:32.240 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T05:36:28.131 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T05:37:48.631 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T05:37:48.631 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T05:37:48.631 [Cloud] Queued cloud request. 2026-09-09T05:37:48.631 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T05:37:48.631 [Cloud] Dequeued cloud request. 2026-09-09T05:37:48.631 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{F446D669-78BA-3063-77F4-9F07CB58AAC6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 05:37:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T05:37:48.787 [Cloud] End of cloud request. 2026-09-09T05:37:49.302 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T05:48:43.334 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T05:48:43.334 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T05:48:43.334 [Cloud] Queued cloud request. 2026-09-09T05:48:43.334 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T05:48:43.334 [Cloud] Dequeued cloud request. 2026-09-09T05:48:43.334 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T05:48:43.521 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{00BDAB50-D816-B4F3-19A1-E8D65EB1C0C2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 05:48:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T05:48:44.021 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T05:51:33.130 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T05:51:39.099 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-88d7-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2830397, FileId: 0x500000000a603, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T05:51:39.099 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-88d7-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2830396, FileId: 0x400000000a626, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T06:01:24.427 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T06:01:24.427 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T06:01:24.427 [Cloud] Queued cloud request. 2026-09-09T06:01:24.427 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T06:01:24.427 [Cloud] Dequeued cloud request. 2026-09-09T06:01:24.443 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T06:01:24.833 [Cloud] End of cloud request. 2026-09-09T06:01:25.333 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T06:02:47.833 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T06:02:47.833 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T06:02:47.833 [Cloud] Queued cloud request. 2026-09-09T06:02:47.833 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T06:02:47.833 [Cloud] Dequeued cloud request. 2026-09-09T06:02:47.833 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T06:02:47.990 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B7E800AC-D7FF-4101-518F-678A1DDBE049} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 06:02:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T06:02:48.505 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T06:06:38.130 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T06:09:12.333 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1975709, Count: 138984, MaxTime: 2484, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\{11AAC7BE-9A37-427D-9490-510AB73DFDE2}\mpasbase.vdm, EstimatedImpact: 3% 2026-09-09T06:09:12.333 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 9454, Count: 689, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T06:09:12.333 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 8898, Count: 776, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\CommandLine.dll, EstimatedImpact: 0% 2026-09-09T06:09:12.333 ProcessImageName: powershell.exe, Pid: 7916, TotalTime: 1390, Count: 96, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-09T06:09:12.333 ProcessImageName: WmiPrvSE.exe, Pid: 1592, TotalTime: 845, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-09T06:09:12.333 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 622, Count: 47, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-09T06:09:12.333 ProcessImageName: AgentShellService.exe, Pid: 7092, TotalTime: 480, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 36% 2026-09-09T06:09:12.333 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 423, Count: 85, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\76744530b92778e6f251e389724745d7\DesktopDeployment.cab, EstimatedImpact: 0% 2026-09-09T06:09:12.333 ProcessImageName: WmiPrvSE.exe, Pid: 5928, TotalTime: 330, Count: 35, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 31% 2026-09-09T06:09:12.333 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 317, Count: 86, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-7867-0.MAI, EstimatedImpact: 0% 2026-09-09T06:09:12.333 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-09T06:09:12.333 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-09T06:09:12.333 ProcessImageName: taskhostw.exe, Pid: 7812, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 6% 2026-09-09T06:09:12.333 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-09T06:09:12.333 ProcessImageName: taskhostw.exe, Pid: 5916, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-09T06:09:12.333 ProcessImageName: cmd.exe, Pid: 1208, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-09T06:09:12.333 ProcessImageName: svchost.exe, Pid: 7572, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\2886173b951f5da9c916eb443a81feec52d9ace4\content.phf, EstimatedImpact: 0% 2026-09-09T06:09:12.333 ProcessImageName: powershell.exe, Pid: 7472, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_uqpra3uv.uh0.ps1, EstimatedImpact: 0% 2026-09-09T06:09:12.333 ProcessImageName: mysqldump.exe, Pid: 4736, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 10% 2026-09-09T06:09:12.333 ProcessImageName: DeviceCensus.exe, Pid: 7396, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-09T06:09:12.333 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-09T06:13:40.661 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T06:13:40.661 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T06:13:40.661 [Cloud] Queued cloud request. 2026-09-09T06:13:40.661 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T06:13:40.661 [Cloud] Dequeued cloud request. 2026-09-09T06:13:40.661 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T06:13:40.927 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C89315E6-E77E-B89F-B3CA-573EE74F11B2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 06:13:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T06:13:41.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T06:16:34.365 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T06:16:34.365 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T06:16:34.365 [Cloud] Queued cloud request. 2026-09-09T06:16:34.365 [Cloud] Dequeued cloud request. 2026-09-09T06:16:34.380 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T06:16:34.380 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T06:16:34.568 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{417A56A6-BEAC-EC74-4F9C-4F5A343675DB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 06:16:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T06:16:35.083 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e 2026-09-09T06:19:40.067 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T06:19:40.067 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T06:19:40.067 [Cloud] Queued cloud request. 2026-09-09T06:19:40.067 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T06:19:40.067 [Cloud] Dequeued cloud request. 2026-09-09T06:19:40.067 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T06:19:40.692 [Cloud] End of cloud request. 2026-09-09T06:19:40.692 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7 2026-09-09T06:19:40.708 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T06:19:40.708 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T06:19:40.708 [Cloud] Queued cloud request. 2026-09-09T06:19:40.708 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T06:19:40.724 [Cloud] Dequeued cloud request. 2026-09-09T06:19:40.724 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T06:19:40.974 [Cloud] End of cloud request. 2026-09-09T06:19:40.974 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-09-09T06:19:41.208 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T06:21:43.130 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T06:32:09.302 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T06:32:09.302 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T06:32:09.302 [Cloud] Queued cloud request. 2026-09-09T06:32:09.302 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T06:32:09.302 [Cloud] Dequeued cloud request. 2026-09-09T06:32:09.302 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T06:32:09.474 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E04EB20E-11A7-0090-A353-E19F281A1BDF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 06:32:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T06:32:09.974 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T06:36:48.130 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T06:47:18.239 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T06:47:18.239 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T06:47:18.239 [Cloud] Queued cloud request. 2026-09-09T06:47:18.239 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T06:47:18.239 [Cloud] Dequeued cloud request. 2026-09-09T06:47:18.239 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T06:47:18.504 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{79C830AD-ACEC-A004-DC14-CBF831976763} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 06:47:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T06:47:19.005 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T06:47:35.801 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T06:47:35.801 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T06:47:35.801 [Cloud] Queued cloud request. 2026-09-09T06:47:35.801 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T06:47:35.801 [Cloud] Dequeued cloud request. 2026-09-09T06:47:35.817 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T06:47:37.942 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{31501615-FB1C-E1BA-4CD1-239BF9209305} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 06:47:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T06:47:38.442 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T06:49:32.505 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T06:49:32.505 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T06:49:32.505 [Cloud] Queued cloud request. 2026-09-09T06:49:32.505 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T06:49:32.505 [Cloud] Dequeued cloud request. 2026-09-09T06:49:32.505 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T06:49:32.739 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5E768A8E-6FE1-E3AB-1B42-66229F684304} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 06:49:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T06:49:33.255 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T06:50:42.551 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-97eb-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2858125, FileId: 0x400000000ae79, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T06:50:42.551 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-97eb-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2858126, FileId: 0x400000000ad28, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T06:51:53.130 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T06:55:17.426 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-97f5-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2860588, FileId: 0x500000000ae79, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T06:55:17.426 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-97f5-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2860587, FileId: 0xa00000000ae9c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T06:57:38.707 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T06:57:38.707 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T06:57:38.707 [Cloud] Queued cloud request. 2026-09-09T06:57:38.707 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T06:57:38.723 [Cloud] Dequeued cloud request. 2026-09-09T06:57:38.723 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T06:57:39.051 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AE153C4A-8F3B-69EA-7C7B-355952FB9DD3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 06:57:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T06:57:39.551 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T07:05:43.660 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-980d-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2865615, FileId: 0xf00000000af7b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T07:05:43.660 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-980d-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2865616, FileId: 0xe6000000009b45, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T07:06:58.129 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T07:08:47.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T07:08:47.145 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T07:08:47.145 [Cloud] Queued cloud request. 2026-09-09T07:08:47.145 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T07:08:47.145 [Cloud] Dequeued cloud request. 2026-09-09T07:08:47.160 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T07:08:47.723 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3CE77158-651D-4693-58D5-0A9C4F5E8C41} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 07:08:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T07:08:48.223 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T07:09:28.192 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T07:09:28.192 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T07:09:28.192 [Cloud] Queued cloud request. 2026-09-09T07:09:28.192 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T07:09:28.192 [Cloud] Dequeued cloud request. 2026-09-09T07:09:28.192 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T07:09:37.973 [Cloud] End of cloud request. 2026-09-09T07:09:38.488 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T07:14:20.004 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T07:14:20.004 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T07:14:20.004 [Cloud] Queued cloud request. 2026-09-09T07:14:20.004 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T07:14:20.004 [Cloud] Dequeued cloud request. 2026-09-09T07:14:20.004 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T07:14:20.520 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{37B1D795-E783-CAF4-1F56-4335B6B4DCDE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 07:14:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T07:14:21.020 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T07:16:53.285 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T07:16:53.285 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T07:16:53.285 [Cloud] Queued cloud request. 2026-09-09T07:16:53.285 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T07:16:53.285 [Cloud] Dequeued cloud request. 2026-09-09T07:16:53.285 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T07:16:53.754 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{38DA5AC7-EBC2-89EF-0BEA-DE226CB82D89} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 07:16:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T07:16:54.254 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T07:17:25.270 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-9980-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2871285, FileId: 0x2600000000bd0f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T07:17:25.285 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-9980-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2871286, FileId: 0x500000000bcf4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T07:19:18.910 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T07:19:18.910 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T07:19:18.910 [Cloud] Queued cloud request. 2026-09-09T07:19:18.910 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T07:19:18.910 [Cloud] Dequeued cloud request. 2026-09-09T07:19:18.910 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T07:19:19.457 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DDB89825-EBC7-7628-6BF0-ECEF69F28AE6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 07:19:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T07:19:19.957 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T07:22:03.129 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T07:32:24.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T07:32:24.097 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T07:32:24.097 [Cloud] Queued cloud request. 2026-09-09T07:32:24.097 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T07:32:24.097 [Cloud] Dequeued cloud request. 2026-09-09T07:32:24.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T07:32:24.363 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E7B3A0B1-BC96-ED86-E863-A3F4FB56F732} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 07:32:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T07:32:24.863 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T07:36:35.301 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T07:36:35.301 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T07:36:35.301 [Cloud] Queued cloud request. 2026-09-09T07:36:35.301 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T07:36:35.301 [Cloud] Dequeued cloud request. 2026-09-09T07:36:35.301 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T07:36:35.613 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D89F055C-2DB3-DCA8-82A9-5CC94819F462} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 07:36:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T07:36:36.129 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T07:37:08.129 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0xcb518bdf 2026-09-09T07:37:37.238 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T07:37:37.238 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T07:37:37.238 [Cloud] Queued cloud request. 2026-09-09T07:37:37.238 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T07:37:37.238 [Cloud] Dequeued cloud request. 2026-09-09T07:37:37.238 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T07:37:37.972 [Cloud] End of cloud request. 2026-09-09T07:37:37.972 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$R30CG93\phpMyAdmin\tbl_changer.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x3329faf726b1 2026-09-09T07:37:38.472 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T07:41:32.613 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-b414-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2881311, FileId: 0x700000000befe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T07:41:32.613 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-b414-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2881312, FileId: 0x1900000000bef8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T07:41:33.082 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-b415-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2881316, FileId: 0x800000000befe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T07:41:33.082 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-b415-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2881317, FileId: 0x1a00000000bef8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T07:41:33.550 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-b416-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2881325, FileId: 0x900000000befe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T07:41:33.550 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-b416-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2881326, FileId: 0x1b00000000bef8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T07:50:37.941 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T07:50:37.941 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T07:50:37.941 [Cloud] Queued cloud request. 2026-09-09T07:50:37.941 [Cloud] Dequeued cloud request. 2026-09-09T07:50:37.941 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T07:50:37.941 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{32933FDB-78EC-6B7F-D21F-227B15333DBB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 07:50:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T07:50:38.691 [Cloud] End of cloud request. 2026-09-09T07:50:39.191 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T07:51:00.316 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T07:51:00.316 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T07:51:00.316 [Cloud] Queued cloud request. 2026-09-09T07:51:00.316 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T07:51:00.316 [Cloud] Dequeued cloud request. 2026-09-09T07:51:00.316 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T07:51:01.035 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BA40A170-0685-CD0C-EF08-0E5A1ACC4C40} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 07:51:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T07:51:01.535 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T07:51:36.394 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T07:51:36.394 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T07:51:36.394 [Cloud] Queued cloud request. 2026-09-09T07:51:36.394 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T07:51:36.394 [Cloud] Dequeued cloud request. 2026-09-09T07:51:36.394 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T07:51:36.503 [Cloud] End of cloud request. 2026-09-09T07:51:37.003 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T07:52:13.128 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T07:55:18.222 Cache Resizing**********Cache stats************ No. Of buckets -> 48827 Each Bucket has max capacity of -> 1 entries number of Entries is 46203 Number of invalid entries is 0 Number of inserts issued is 684744 Number of replaces issued is 0 Number of insert failures is 7 Number of inserts with duplicate entries is 3288 Number of lookups is 74524347 Number of lookup misses is 2483729 Number of fast lookup misses is 16947716 Number of false fast lookups is 2483727 Number of invalidations is 390862 Number of maintenance invalidations is 86620 Current File Size is 1200128 Journal ID = 1d864ae105a6246 Trusted image state = 4 USN = 1171c7 Setup boot count = 2 2026-09-09T07:55:18.769 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-09T07:55:18.769 [RTP] Duplicating the current plugin configuration object... 2026-09-09T07:55:18.769 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-09T07:55:18.769 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-09T07:55:18.769 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-09T07:55:18.769 [RTP] No config change detected. Not updating plugin configuration. 2026-09-09T07:55:18.769 [RTP] No config changes found. No configuration switch. 2026-09-09T07:55:18.769 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-09T08:07:18.128 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T08:09:12.347 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2252697, Count: 157785, MaxTime: 2484, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\{11AAC7BE-9A37-427D-9490-510AB73DFDE2}\mpasbase.vdm, EstimatedImpact: 3% 2026-09-09T08:09:12.347 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 10971, Count: 956, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\CommandLine.dll, EstimatedImpact: 0% 2026-09-09T08:09:12.347 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 9454, Count: 689, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T08:09:12.347 ProcessImageName: powershell.exe, Pid: 7916, TotalTime: 1390, Count: 96, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-09T08:09:12.347 ProcessImageName: WmiPrvSE.exe, Pid: 1592, TotalTime: 845, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-09T08:09:12.347 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 773, Count: 57, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-09T08:09:12.347 ProcessImageName: AgentShellService.exe, Pid: 7092, TotalTime: 480, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 36% 2026-09-09T08:09:12.347 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 423, Count: 85, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\76744530b92778e6f251e389724745d7\DesktopDeployment.cab, EstimatedImpact: 0% 2026-09-09T08:09:12.347 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 407, Count: 102, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-7867-0.MAI, EstimatedImpact: 0% 2026-09-09T08:09:12.347 ProcessImageName: WmiPrvSE.exe, Pid: 5928, TotalTime: 330, Count: 35, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 31% 2026-09-09T08:09:12.347 ProcessImageName: powershell.exe, Pid: 7172, TotalTime: 262, Count: 22, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-09T08:09:12.347 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-09T08:09:12.347 ProcessImageName: python.exe, Pid: 7744, TotalTime: 165, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-09T08:09:12.347 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-09T08:09:12.347 ProcessImageName: taskhostw.exe, Pid: 7812, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 6% 2026-09-09T08:09:12.347 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-09T08:09:12.347 ProcessImageName: taskhostw.exe, Pid: 5916, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-09T08:09:12.347 ProcessImageName: cmd.exe, Pid: 1208, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-09T08:09:12.347 ProcessImageName: svchost.exe, Pid: 7572, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\2886173b951f5da9c916eb443a81feec52d9ace4\content.phf, EstimatedImpact: 0% 2026-09-09T08:09:12.347 ProcessImageName: powershell.exe, Pid: 7472, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_uqpra3uv.uh0.ps1, EstimatedImpact: 0% 2026-09-09T08:09:12.347 ProcessImageName: DeviceCensus.exe, Pid: 7396, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-09T08:09:12.347 ProcessImageName: mysqldump.exe, Pid: 4736, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 10% 2026-09-09T08:09:12.347 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-09T08:14:09.893 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T08:14:09.893 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T08:14:09.893 [Cloud] Queued cloud request. 2026-09-09T08:14:09.893 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T08:14:09.893 [Cloud] Dequeued cloud request. 2026-09-09T08:14:09.893 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{CB909C52-AA67-A402-639E-6C19EC7AB08C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 08:14:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T08:14:10.112 [Cloud] End of cloud request. 2026-09-09T08:14:10.643 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T08:22:23.127 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T08:23:12.909 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T08:23:12.909 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T08:23:12.909 [Cloud] Queued cloud request. 2026-09-09T08:23:12.909 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T08:23:12.909 [Cloud] Dequeued cloud request. 2026-09-09T08:23:12.924 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T08:23:13.174 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DB0C3697-8B8C-D57D-8967-4242087C817B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 08:23:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T08:23:13.690 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T08:29:24.315 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T08:29:24.315 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T08:29:24.315 [Cloud] Queued cloud request. 2026-09-09T08:29:24.315 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T08:29:24.315 [Cloud] Dequeued cloud request. 2026-09-09T08:29:24.331 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T08:29:24.487 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B9CDF358-A62D-49E0-DB30-6D42FEA940C1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 08:29:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T08:29:25.002 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T08:31:04.534 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T08:31:04.534 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T08:31:04.534 [Cloud] Queued cloud request. 2026-09-09T08:31:04.534 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T08:31:04.534 [Cloud] Dequeued cloud request. 2026-09-09T08:31:04.534 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T08:31:04.674 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2390D376-6E74-168A-59E7-5ABCF132CFA2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 08:31:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T08:31:05.190 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T08:37:28.127 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T08:42:22.362 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T08:42:22.362 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T08:42:22.362 [Cloud] Queued cloud request. 2026-09-09T08:42:22.362 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T08:42:22.362 [Cloud] Dequeued cloud request. 2026-09-09T08:42:22.362 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T08:42:22.518 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5FE6A235-3E94-CFA0-960D-7B2DF63100CB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 08:42:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T08:42:23.018 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T08:52:33.127 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T09:01:42.158 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bb2b-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2916902, FileId: 0x1f00000000a405, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T09:01:42.158 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bb2b-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2916901, FileId: 0x1500000000c057, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T09:01:42.596 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bb2c-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2916906, FileId: 0x2000000000a405, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T09:01:42.596 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bb2c-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2916907, FileId: 0x1600000000c057, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T09:01:43.064 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bb2e-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2916914, FileId: 0x2100000000a405, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T09:01:43.064 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bb2e-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2916913, FileId: 0x1700000000c057, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T09:04:39.721 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T09:04:39.721 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T09:04:39.721 [Cloud] Queued cloud request. 2026-09-09T09:04:39.721 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T09:04:39.721 [Cloud] Dequeued cloud request. 2026-09-09T09:04:39.721 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T09:04:39.877 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D6C3929F-8E0F-2198-F922-6C11000AB6D7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 09:04:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T09:04:40.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T09:07:38.127 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T09:22:43.126 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T09:25:02.532 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T09:25:02.532 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T09:25:02.532 [Cloud] Queued cloud request. 2026-09-09T09:25:02.532 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T09:25:02.532 [Cloud] Dequeued cloud request. 2026-09-09T09:25:02.548 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T09:25:02.720 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7D936EC3-0365-1EC8-7751-B99D0002FA85} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 09:25:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T09:25:03.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T09:28:03.017 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T09:28:03.017 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T09:28:03.017 [Cloud] Queued cloud request. 2026-09-09T09:28:03.017 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T09:28:03.017 [Cloud] Dequeued cloud request. 2026-09-09T09:28:03.017 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T09:28:03.157 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4E1C0D73-EE96-882D-C135-B6C47E1FE754} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 09:28:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T09:28:03.673 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T09:37:48.126 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T09:39:06.048 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T09:39:06.048 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T09:39:06.048 [Cloud] Queued cloud request. 2026-09-09T09:39:06.048 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T09:39:06.048 [Cloud] Dequeued cloud request. 2026-09-09T09:39:06.048 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T09:39:06.267 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D85DBDB9-4BD7-3CBA-D1F0-9B822F31592C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 09:39:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T09:39:06.767 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T09:41:52.454 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T09:41:52.454 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T09:41:52.454 [Cloud] Queued cloud request. 2026-09-09T09:41:52.454 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T09:41:52.454 [Cloud] Dequeued cloud request. 2026-09-09T09:41:52.454 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T09:41:52.673 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F084BFEC-1173-DBDB-1BCB-6BAF45439B91} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 09:41:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T09:41:53.188 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T09:50:35.313 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T09:50:35.313 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T09:50:35.313 [Cloud] Queued cloud request. 2026-09-09T09:50:35.313 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T09:50:35.313 [Cloud] Dequeued cloud request. 2026-09-09T09:50:35.313 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T09:50:35.485 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5E0FF026-77E4-37D7-DEFC-BCA9424BD7DF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 09:50:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T09:50:35.985 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T09:52:53.126 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T09:56:40.235 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T09:56:40.235 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T09:56:40.235 [Cloud] Queued cloud request. 2026-09-09T09:56:40.235 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T09:56:40.235 [Cloud] Dequeued cloud request. 2026-09-09T09:56:40.235 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T09:56:40.376 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{490AF3F1-F2CB-B560-5D23-6D01D0F66FFB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 09:56:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T09:56:40.876 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T10:02:27.766 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T10:02:27.766 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T10:02:27.766 [Cloud] Queued cloud request. 2026-09-09T10:02:27.766 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T10:02:27.766 [Cloud] Dequeued cloud request. 2026-09-09T10:02:27.766 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T10:02:27.938 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4DEC6176-C269-1C0D-4717-732E096C3F3B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 10:02:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T10:02:28.454 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T10:07:58.125 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T10:09:12.360 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2454346, Count: 171210, MaxTime: 2484, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\{11AAC7BE-9A37-427D-9490-510AB73DFDE2}\mpasbase.vdm, EstimatedImpact: 3% 2026-09-09T10:09:12.360 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 13348, Count: 1123, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\CommandLine.dll, EstimatedImpact: 0% 2026-09-09T10:09:12.360 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 9454, Count: 689, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T10:09:12.360 ProcessImageName: powershell.exe, Pid: 7916, TotalTime: 1390, Count: 96, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-09T10:09:12.360 ProcessImageName: WmiPrvSE.exe, Pid: 1592, TotalTime: 845, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-09T10:09:12.360 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 803, Count: 59, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-09T10:09:12.360 ProcessImageName: AgentShellService.exe, Pid: 7092, TotalTime: 480, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 36% 2026-09-09T10:09:12.360 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 452, Count: 108, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-7867-0.MAI, EstimatedImpact: 0% 2026-09-09T10:09:12.360 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 423, Count: 85, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\76744530b92778e6f251e389724745d7\DesktopDeployment.cab, EstimatedImpact: 0% 2026-09-09T10:09:12.360 ProcessImageName: WmiPrvSE.exe, Pid: 5928, TotalTime: 330, Count: 35, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 31% 2026-09-09T10:09:12.360 ProcessImageName: powershell.exe, Pid: 7172, TotalTime: 262, Count: 22, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-09T10:09:12.360 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 210, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-09T10:09:12.360 ProcessImageName: python.exe, Pid: 7744, TotalTime: 165, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-09T10:09:12.360 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-09T10:09:12.360 ProcessImageName: taskhostw.exe, Pid: 7812, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 6% 2026-09-09T10:09:12.360 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-09T10:09:12.360 ProcessImageName: taskhostw.exe, Pid: 5916, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-09T10:09:12.360 ProcessImageName: cmd.exe, Pid: 1208, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-09T10:09:12.360 ProcessImageName: svchost.exe, Pid: 7572, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\2886173b951f5da9c916eb443a81feec52d9ace4\content.phf, EstimatedImpact: 0% 2026-09-09T10:09:12.360 ProcessImageName: powershell.exe, Pid: 7472, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_uqpra3uv.uh0.ps1, EstimatedImpact: 0% 2026-09-09T10:09:12.360 ProcessImageName: DeviceCensus.exe, Pid: 7396, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-09T10:09:12.360 ProcessImageName: mysqldump.exe, Pid: 4736, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 10% 2026-09-09T10:09:12.360 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-09T10:10:12.344 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T10:10:12.344 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T10:10:12.344 [Cloud] Queued cloud request. 2026-09-09T10:10:12.344 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T10:10:12.344 [Cloud] Dequeued cloud request. 2026-09-09T10:10:12.500 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T10:10:12.657 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C8BD5090-FBCD-A320-8B32-367F12CB7048} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 10:10:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T10:10:13.157 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T10:23:03.125 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T10:38:08.125 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T10:53:13.125 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T10:59:34.484 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T10:59:34.484 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T10:59:34.484 [Cloud] Queued cloud request. 2026-09-09T10:59:34.484 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T10:59:34.484 [Cloud] Dequeued cloud request. 2026-09-09T10:59:34.484 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T10:59:44.640 [Cloud] End of cloud request. 2026-09-09T10:59:45.140 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T11:03:20.437 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T11:03:20.437 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T11:03:20.437 [Cloud] Queued cloud request. 2026-09-09T11:03:20.437 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T11:03:20.437 [Cloud] Dequeued cloud request. 2026-09-09T11:03:20.437 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T11:03:20.781 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A3662E1A-4471-122D-1EAD-F8838E6427C1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 11:03:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T11:03:21.281 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T11:08:18.124 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{02E2A1D0-5094-2C6B-BD02-030CC7390C1C} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-09-2026 11:22:53 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T11:22:54.312 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T11:22:54.312 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T11:22:54.312 [Cloud] Queued cloud request. 2026-09-09T11:22:54.312 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T11:22:54.312 [Cloud] Dequeued cloud request. 2026-09-09T11:22:54.312 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T11:22:54.937 [Cloud] End of cloud request. 2026-09-09T11:22:55.437 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T11:23:23.124 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T11:26:26.312 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T11:26:26.312 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T11:26:26.312 [Cloud] Queued cloud request. 2026-09-09T11:26:26.312 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T11:26:26.312 [Cloud] Dequeued cloud request. 2026-09-09T11:26:26.312 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T11:26:26.530 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E58EA910-8047-656F-1DBE-F2B712C71416} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 11:26:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T11:26:27.030 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T11:28:40.504 [RTP] [Mini-filter] Unsuccessful scan status(#28): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc49-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987524, FileId: 0x400000000962d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:40.655 [RTP] [Mini-filter] Unsuccessful scan status(#27): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc49-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987523, FileId: 0x1400000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:41.561 [RTP] [Mini-filter] Unsuccessful scan status(#29): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc5c-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987547, FileId: 0x1500000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:41.561 [RTP] [Mini-filter] Unsuccessful scan status(#30): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc5c-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987549, FileId: 0x500000000962d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:47.280 [RTP] [Mini-filter] Unsuccessful scan status(#32): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc65-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987610, FileId: 0x1700000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:47.280 [RTP] [Mini-filter] Unsuccessful scan status(#33): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc65-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987611, FileId: 0x700000000962d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:47.280 [RTP] [Mini-filter] Unsuccessful scan status(#34): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc63-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987608, FileId: 0x400000000c718, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:47.280 [RTP] [Mini-filter] Unsuccessful scan status(#31): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc62-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987606, FileId: 0x1600000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:47.280 [RTP] [Mini-filter] Unsuccessful scan status(#36): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc63-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987609, FileId: 0x400000000c716, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:47.280 [RTP] [Mini-filter] Unsuccessful scan status(#35): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc62-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987607, FileId: 0x600000000962d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:47.280 [RTP] [Mini-filter] Unsuccessful scan status(#38): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc64-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987613, FileId: 0x800000000962d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:47.280 [RTP] [Mini-filter] Unsuccessful scan status(#39): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc66-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987621, FileId: 0x1900000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:47.280 [RTP] [Mini-filter] Unsuccessful scan status(#41): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc66-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987622, FileId: 0x900000000962d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:47.280 [RTP] [Mini-filter] Unsuccessful scan status(#42): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc67-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987624, FileId: 0xa00000000962d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:47.280 [RTP] [Mini-filter] Unsuccessful scan status(#37): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc64-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987612, FileId: 0x1800000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T11:28:47.280 [RTP] [Mini-filter] Unsuccessful scan status(#40): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-bc67-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2987623, FileId: 0x1a00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x56d96c17 2026-09-09T11:29:54.749 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T11:29:54.749 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T11:29:54.749 [Cloud] Queued cloud request. 2026-09-09T11:29:54.749 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T11:29:54.749 [Cloud] Dequeued cloud request. 2026-09-09T11:29:54.749 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T11:29:55.155 [Cloud] End of cloud request. 2026-09-09T11:29:55.155 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpMyAdmin\tbl_changer.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x3329faf726b1 2026-09-09T11:29:55.671 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T11:38:28.124 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T11:46:02.655 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T11:46:02.655 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T11:46:02.655 [Cloud] Queued cloud request. 2026-09-09T11:46:02.655 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T11:46:02.655 [Cloud] Dequeued cloud request. 2026-09-09T11:46:02.655 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T11:46:02.858 [Cloud] End of cloud request. 2026-09-09T11:46:03.374 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T11:53:33.124 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T12:08:38.124 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T12:09:12.374 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2671344, Count: 188247, MaxTime: 2484, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\{11AAC7BE-9A37-427D-9490-510AB73DFDE2}\mpasbase.vdm, EstimatedImpact: 3% 2026-09-09T12:09:12.374 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 15679, Count: 1297, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\CommandLine.dll, EstimatedImpact: 0% 2026-09-09T12:09:12.374 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 9454, Count: 689, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T12:09:12.374 ProcessImageName: powershell.exe, Pid: 7916, TotalTime: 1390, Count: 96, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-09T12:09:12.374 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 879, Count: 63, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-09T12:09:12.374 ProcessImageName: WmiPrvSE.exe, Pid: 1592, TotalTime: 845, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-09T12:09:12.374 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 512, Count: 124, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-7867-0.MAI, EstimatedImpact: 0% 2026-09-09T12:09:12.374 ProcessImageName: AgentShellService.exe, Pid: 7092, TotalTime: 480, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 36% 2026-09-09T12:09:12.374 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 423, Count: 85, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\76744530b92778e6f251e389724745d7\DesktopDeployment.cab, EstimatedImpact: 0% 2026-09-09T12:09:12.374 ProcessImageName: WmiPrvSE.exe, Pid: 5928, TotalTime: 330, Count: 35, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 31% 2026-09-09T12:09:12.374 ProcessImageName: powershell.exe, Pid: 7172, TotalTime: 262, Count: 22, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-09T12:09:12.374 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 225, Count: 19, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-09T12:09:12.374 ProcessImageName: python.exe, Pid: 7744, TotalTime: 165, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-09T12:09:12.374 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-09T12:09:12.374 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 75, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-09T12:09:12.374 ProcessImageName: taskhostw.exe, Pid: 7812, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 6% 2026-09-09T12:09:12.374 ProcessImageName: taskhostw.exe, Pid: 5916, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-09T12:09:12.374 ProcessImageName: cmd.exe, Pid: 1208, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-09T12:09:12.374 ProcessImageName: svchost.exe, Pid: 7572, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\2886173b951f5da9c916eb443a81feec52d9ace4\content.phf, EstimatedImpact: 0% 2026-09-09T12:09:12.374 ProcessImageName: powershell.exe, Pid: 7472, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_uqpra3uv.uh0.ps1, EstimatedImpact: 0% 2026-09-09T12:09:12.374 ProcessImageName: DeviceCensus.exe, Pid: 7396, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-09T12:09:12.374 ProcessImageName: mysqldump.exe, Pid: 4736, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 10% 2026-09-09T12:09:12.374 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-09T12:10:40.217 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T12:10:40.217 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T12:10:40.217 [Cloud] Queued cloud request. 2026-09-09T12:10:40.217 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T12:10:40.217 [Cloud] Dequeued cloud request. 2026-09-09T12:10:40.233 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T12:10:40.499 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5FAB4E65-1708-A567-8C08-8E22119097EA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 12:10:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T12:10:41.014 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T12:15:33.436 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T12:15:33.436 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T12:15:33.436 [Cloud] Queued cloud request. 2026-09-09T12:15:33.436 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T12:15:33.436 [Cloud] Dequeued cloud request. 2026-09-09T12:15:33.436 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T12:15:33.623 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6252381C-F499-429B-AF02-04EFF85AAEB4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 12:15:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T12:15:34.123 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T12:18:15.233 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T12:18:15.233 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T12:18:15.233 [Cloud] Queued cloud request. 2026-09-09T12:18:15.233 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T12:18:15.233 [Cloud] Dequeued cloud request. 2026-09-09T12:18:15.233 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T12:18:15.467 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C1BB30FF-1FC1-BBAF-8D5B-2D12312BDC13} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 12:18:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T12:18:15.983 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T12:18:27.530 Bm signature throttled:0x000135b39c9104ce 2026-09-09T12:23:43.123 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T12:35:31.451 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T12:35:31.451 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T12:35:31.451 [Cloud] Queued cloud request. 2026-09-09T12:35:31.451 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T12:35:31.451 [Cloud] Dequeued cloud request. 2026-09-09T12:35:31.451 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{0DF0A347-7B13-E308-E7C8-801856A11A7A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 12:35:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T12:35:31.686 [Cloud] End of cloud request. 2026-09-09T12:35:32.186 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T12:38:48.123 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T12:46:45.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T12:46:45.904 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T12:46:45.904 [Cloud] Queued cloud request. 2026-09-09T12:46:45.904 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T12:46:45.904 [Cloud] Dequeued cloud request. 2026-09-09T12:46:45.904 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T12:46:46.123 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{497A9809-91BE-3028-5E80-880A2EDB4F1F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 12:46:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T12:46:46.639 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T12:47:25.826 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T12:47:25.826 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T12:47:25.826 [Cloud] Queued cloud request. 2026-09-09T12:47:25.826 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T12:47:25.826 [Cloud] Dequeued cloud request. 2026-09-09T12:47:25.826 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T12:47:25.998 [Cloud] End of cloud request. 2026-09-09T12:47:26.514 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T12:53:53.123 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T13:08:58.122 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T13:14:44.169 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T13:14:44.169 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T13:14:44.169 [Cloud] Queued cloud request. 2026-09-09T13:14:44.169 [Cloud] Dequeued cloud request. 2026-09-09T13:14:44.169 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T13:14:44.169 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T13:14:52.919 [Cloud] End of cloud request. 2026-09-09T13:14:53.419 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T13:15:27.638 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T13:15:27.638 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T13:15:27.638 [Cloud] Queued cloud request. 2026-09-09T13:15:27.638 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T13:15:27.638 [Cloud] Dequeued cloud request. 2026-09-09T13:15:27.638 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T13:15:27.747 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{000D0A4F-77B2-0F61-4BE1-6094266BC705} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 13:15:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T13:15:28.247 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T13:17:08.388 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T13:17:08.388 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T13:17:08.388 [Cloud] Queued cloud request. 2026-09-09T13:17:08.388 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T13:17:08.388 [Cloud] Dequeued cloud request. 2026-09-09T13:17:08.388 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T13:17:08.529 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7AC44344-E872-8C28-27F3-6FF6FF3FE75C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 13:17:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T13:17:09.044 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T13:17:52.638 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T13:17:52.638 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T13:17:52.638 [Cloud] Queued cloud request. 2026-09-09T13:17:52.638 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T13:17:52.638 [Cloud] Dequeued cloud request. 2026-09-09T13:17:52.638 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T13:17:52.747 [Cloud] End of cloud request. 2026-09-09T13:17:53.247 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T13:24:03.122 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T13:29:24.372 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T13:29:24.372 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T13:29:24.388 [Cloud] Queued cloud request. 2026-09-09T13:29:24.388 [Cloud] Dequeued cloud request. 2026-09-09T13:29:24.388 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T13:29:24.388 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T13:29:24.591 [Cloud] End of cloud request. 2026-09-09T13:29:25.107 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T13:31:02.747 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T13:31:02.747 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T13:31:02.747 [Cloud] Queued cloud request. 2026-09-09T13:31:02.747 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T13:31:02.747 [Cloud] Dequeued cloud request. 2026-09-09T13:31:02.747 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T13:31:02.966 [Cloud] End of cloud request. 2026-09-09T13:31:03.466 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T13:32:25.716 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T13:32:25.716 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T13:32:25.716 [Cloud] Queued cloud request. 2026-09-09T13:32:25.716 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T13:32:25.716 [Cloud] Dequeued cloud request. 2026-09-09T13:32:25.716 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T13:32:25.919 [Cloud] End of cloud request. 2026-09-09T13:32:26.435 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T13:33:15.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T13:33:15.700 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T13:33:15.700 [Cloud] Queued cloud request. 2026-09-09T13:33:15.700 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T13:33:15.700 [Cloud] Dequeued cloud request. 2026-09-09T13:33:15.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T13:33:17.919 [Cloud] End of cloud request. 2026-09-09T13:33:18.435 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T13:34:21.216 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T13:34:21.216 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T13:34:21.216 [Cloud] Queued cloud request. 2026-09-09T13:34:21.216 [Cloud] Dequeued cloud request. 2026-09-09T13:34:21.216 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T13:34:21.216 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T13:34:21.419 [Cloud] End of cloud request. 2026-09-09T13:34:21.919 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T13:39:08.122 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T13:47:26.763 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T13:47:26.763 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T13:47:26.763 [Cloud] Queued cloud request. 2026-09-09T13:47:26.763 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T13:47:26.763 [Cloud] Dequeued cloud request. 2026-09-09T13:47:26.763 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T13:47:26.919 [Cloud] End of cloud request. 2026-09-09T13:47:27.419 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T13:49:33.841 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T13:49:33.841 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T13:49:33.841 [Cloud] Queued cloud request. 2026-09-09T13:49:33.841 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T13:49:33.841 [Cloud] Dequeued cloud request. 2026-09-09T13:49:33.841 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T13:49:33.981 [Cloud] End of cloud request. 2026-09-09T13:49:34.497 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T13:52:52.731 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T13:52:52.731 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T13:52:52.731 [Cloud] Queued cloud request. 2026-09-09T13:52:52.731 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T13:52:52.888 [Cloud] Dequeued cloud request. 2026-09-09T13:52:52.888 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T13:52:53.044 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{424E301B-DD4D-3F67-ABC4-1B3C4E29208C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 13:52:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T13:52:53.544 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T13:54:13.122 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T14:09:12.372 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2837029, Count: 199804, MaxTime: 2484, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\{11AAC7BE-9A37-427D-9490-510AB73DFDE2}\mpasbase.vdm, EstimatedImpact: 3% 2026-09-09T14:09:12.372 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 18245, Count: 1472, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\CommandLine.dll, EstimatedImpact: 0% 2026-09-09T14:09:12.372 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 9454, Count: 689, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T14:09:12.372 ProcessImageName: powershell.exe, Pid: 7916, TotalTime: 1390, Count: 96, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-09T14:09:12.372 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 956, Count: 67, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-09T14:09:12.372 ProcessImageName: WmiPrvSE.exe, Pid: 1592, TotalTime: 845, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-09T14:09:12.372 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 512, Count: 124, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-7867-0.MAI, EstimatedImpact: 0% 2026-09-09T14:09:12.372 ProcessImageName: AgentShellService.exe, Pid: 7092, TotalTime: 480, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 36% 2026-09-09T14:09:12.372 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 423, Count: 85, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\76744530b92778e6f251e389724745d7\DesktopDeployment.cab, EstimatedImpact: 0% 2026-09-09T14:09:12.372 ProcessImageName: WmiPrvSE.exe, Pid: 5928, TotalTime: 330, Count: 35, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 31% 2026-09-09T14:09:12.372 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 270, Count: 23, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-09T14:09:12.372 ProcessImageName: powershell.exe, Pid: 7172, TotalTime: 262, Count: 22, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-09T14:09:12.372 ProcessImageName: python.exe, Pid: 7744, TotalTime: 165, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-09T14:09:12.372 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-09T14:09:12.372 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 75, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-09T14:09:12.372 ProcessImageName: taskhostw.exe, Pid: 7812, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 6% 2026-09-09T14:09:12.372 ProcessImageName: taskhostw.exe, Pid: 5916, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-09T14:09:12.372 ProcessImageName: cmd.exe, Pid: 1208, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-09T14:09:12.372 ProcessImageName: svchost.exe, Pid: 7572, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\2886173b951f5da9c916eb443a81feec52d9ace4\content.phf, EstimatedImpact: 0% 2026-09-09T14:09:12.372 ProcessImageName: powershell.exe, Pid: 7472, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_uqpra3uv.uh0.ps1, EstimatedImpact: 0% 2026-09-09T14:09:12.372 ProcessImageName: DeviceCensus.exe, Pid: 7396, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-09T14:09:12.372 ProcessImageName: mysqldump.exe, Pid: 4736, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 10% 2026-09-09T14:09:12.372 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-09T14:09:18.122 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T14:11:31.950 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T14:11:31.950 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T14:11:31.950 [Cloud] Queued cloud request. 2026-09-09T14:11:31.950 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T14:11:32.153 [Cloud] Dequeued cloud request. 2026-09-09T14:11:32.153 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T14:11:32.403 [Cloud] End of cloud request. 2026-09-09T14:11:32.903 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T14:15:41.325 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T14:15:41.325 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T14:15:41.325 [Cloud] Queued cloud request. 2026-09-09T14:15:41.325 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T14:15:41.325 [Cloud] Dequeued cloud request. 2026-09-09T14:15:41.325 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T14:15:41.497 [Cloud] End of cloud request. 2026-09-09T14:15:42.012 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T14:20:44.544 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T14:20:44.544 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T14:20:44.544 [Cloud] Queued cloud request. 2026-09-09T14:20:44.544 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T14:20:44.544 [Cloud] Dequeued cloud request. 2026-09-09T14:20:44.544 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T14:20:44.715 [Cloud] End of cloud request. 2026-09-09T14:20:45.215 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T14:24:23.122 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T14:31:15.497 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T14:31:15.497 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T14:31:15.497 [Cloud] Queued cloud request. 2026-09-09T14:31:15.497 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T14:31:15.497 [Cloud] Dequeued cloud request. 2026-09-09T14:31:15.497 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T14:31:25.606 [Cloud] End of cloud request. 2026-09-09T14:31:26.106 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T14:33:29.762 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T14:33:29.762 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T14:33:29.762 [Cloud] Queued cloud request. 2026-09-09T14:33:29.762 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T14:33:29.762 [Cloud] Dequeued cloud request. 2026-09-09T14:33:29.762 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T14:33:29.919 [Cloud] End of cloud request. 2026-09-09T14:33:30.419 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T14:39:28.121 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{0CC4C791-4FCE-B8C4-5F76-4A70582F8A65} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-09-2026 14:40:01 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T14:40:02.121 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T14:40:02.121 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T14:40:02.121 [Cloud] Queued cloud request. 2026-09-09T14:40:02.121 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T14:40:02.121 [Cloud] Dequeued cloud request. 2026-09-09T14:40:02.121 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T14:40:02.262 [Cloud] End of cloud request. 2026-09-09T14:40:02.762 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T14:52:29.637 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T14:52:29.637 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T14:52:29.637 [Cloud] Queued cloud request. 2026-09-09T14:52:29.637 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T14:52:29.637 [Cloud] Dequeued cloud request. 2026-09-09T14:52:29.653 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{059EC223-EC0C-0DFD-3E7A-5F5646C387BA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 14:52:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T14:52:29.825 [Cloud] End of cloud request. 2026-09-09T14:52:30.325 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T14:54:33.121 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T14:57:42.824 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T14:57:42.824 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T14:57:42.824 [Cloud] Queued cloud request. 2026-09-09T14:57:42.824 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T14:57:42.824 [Cloud] Dequeued cloud request. 2026-09-09T14:57:42.824 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T14:57:43.012 [Cloud] End of cloud request. 2026-09-09T14:57:43.528 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T15:08:01.762 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T15:08:01.762 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T15:08:01.762 [Cloud] Queued cloud request. 2026-09-09T15:08:01.762 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T15:08:01.762 [Cloud] Dequeued cloud request. 2026-09-09T15:08:01.777 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T15:08:02.027 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CA3A1AE4-B482-C73B-FFF4-17C186F5011C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 15:08:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T15:08:02.528 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T15:08:11.543 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T15:08:11.543 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T15:08:11.543 [Cloud] Queued cloud request. 2026-09-09T15:08:11.543 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T15:08:11.543 [Cloud] Dequeued cloud request. 2026-09-09T15:08:11.543 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{665E8CCF-55E8-9E80-431F-201727D826A5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 15:08:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T15:08:11.637 [Cloud] End of cloud request. 2026-09-09T15:08:12.137 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T15:09:38.121 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T15:09:45.574 [RTP] [Mini-filter] Unsuccessful scan status(#43): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c255-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089671, FileId: 0x400000000c765, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:45.918 [RTP] [Mini-filter] Unsuccessful scan status(#44): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c255-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089672, FileId: 0x800000000c041, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:45.918 [RTP] [Mini-filter] Unsuccessful scan status(#45): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c260-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089679, FileId: 0x500000000c765, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:45.918 [RTP] [Mini-filter] Unsuccessful scan status(#46): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c260-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089680, FileId: 0x900000000c041, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:50.746 [RTP] [Mini-filter] Unsuccessful scan status(#47): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c271-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089743, FileId: 0x600000000c765, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:50.746 [RTP] [Mini-filter] Unsuccessful scan status(#48): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c271-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089745, FileId: 0xa00000000c041, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:50.746 [RTP] [Mini-filter] Unsuccessful scan status(#49): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c26f-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089747, FileId: 0x400000000c7fd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:50.746 [RTP] [Mini-filter] Unsuccessful scan status(#50): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c26f-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089748, FileId: 0x400000000c7a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:50.746 [RTP] [Mini-filter] Unsuccessful scan status(#51): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c270-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089749, FileId: 0x700000000c765, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:50.746 [RTP] [Mini-filter] Unsuccessful scan status(#52): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c270-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089750, FileId: 0xb00000000c041, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:50.746 [RTP] [Mini-filter] Unsuccessful scan status(#53): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c272-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089753, FileId: 0xc00000000c041, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:50.746 [RTP] [Mini-filter] Unsuccessful scan status(#54): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c272-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089752, FileId: 0x800000000c765, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:50.746 [RTP] [Mini-filter] Unsuccessful scan status(#55): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c273-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089759, FileId: 0xe00000000c041, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:50.746 [RTP] [Mini-filter] Unsuccessful scan status(#57): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c273-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089758, FileId: 0xa00000000c765, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:50.746 [RTP] [Mini-filter] Unsuccessful scan status(#58): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c274-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089756, FileId: 0x900000000c765, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:09:50.746 [RTP] [Mini-filter] Unsuccessful scan status(#56): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-c274-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3089757, FileId: 0xd00000000c041, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-09T15:24:43.121 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T15:29:34.527 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T15:29:34.527 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T15:29:34.527 [Cloud] Queued cloud request. 2026-09-09T15:29:34.527 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T15:29:34.527 [Cloud] Dequeued cloud request. 2026-09-09T15:29:34.527 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T15:29:44.683 [Cloud] End of cloud request. 2026-09-09T15:29:45.183 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T15:39:48.121 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T15:54:53.121 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T16:09:12.386 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2953783, Count: 208530, MaxTime: 2484, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\{11AAC7BE-9A37-427D-9490-510AB73DFDE2}\mpasbase.vdm, EstimatedImpact: 3% 2026-09-09T16:09:12.386 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 20940, Count: 1646, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\CommandLine.dll, EstimatedImpact: 0% 2026-09-09T16:09:12.386 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 9454, Count: 689, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T16:09:12.386 ProcessImageName: powershell.exe, Pid: 7916, TotalTime: 1390, Count: 96, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-09T16:09:12.386 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1064, Count: 73, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-09T16:09:12.386 ProcessImageName: WmiPrvSE.exe, Pid: 1592, TotalTime: 845, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-09T16:09:12.386 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 542, Count: 140, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-7867-0.MAI, EstimatedImpact: 0% 2026-09-09T16:09:12.386 ProcessImageName: AgentShellService.exe, Pid: 7092, TotalTime: 480, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 36% 2026-09-09T16:09:12.386 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 423, Count: 85, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\76744530b92778e6f251e389724745d7\DesktopDeployment.cab, EstimatedImpact: 0% 2026-09-09T16:09:12.386 ProcessImageName: WmiPrvSE.exe, Pid: 5928, TotalTime: 330, Count: 35, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 31% 2026-09-09T16:09:12.386 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 300, Count: 25, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-09T16:09:12.386 ProcessImageName: powershell.exe, Pid: 7172, TotalTime: 262, Count: 22, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-09T16:09:12.386 ProcessImageName: python.exe, Pid: 7744, TotalTime: 165, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-09T16:09:12.386 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-09T16:09:12.386 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 75, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-09T16:09:12.386 ProcessImageName: taskhostw.exe, Pid: 7812, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 6% 2026-09-09T16:09:12.386 ProcessImageName: taskhostw.exe, Pid: 5916, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-09T16:09:12.386 ProcessImageName: cmd.exe, Pid: 1208, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-09T16:09:12.386 ProcessImageName: svchost.exe, Pid: 7572, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\2886173b951f5da9c916eb443a81feec52d9ace4\content.phf, EstimatedImpact: 0% 2026-09-09T16:09:12.386 ProcessImageName: powershell.exe, Pid: 7472, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_uqpra3uv.uh0.ps1, EstimatedImpact: 0% 2026-09-09T16:09:12.386 ProcessImageName: DeviceCensus.exe, Pid: 7396, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-09T16:09:12.386 ProcessImageName: mysqldump.exe, Pid: 4736, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 10% 2026-09-09T16:09:12.386 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-09T16:09:58.121 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T16:13:05.793 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T16:13:05.793 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T16:13:05.793 [Cloud] Queued cloud request. 2026-09-09T16:13:05.793 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T16:13:05.808 [Cloud] Dequeued cloud request. 2026-09-09T16:13:05.808 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{5E572575-F209-BBCA-D4CE-605CE7E6F6DC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 16:13:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T16:13:05.964 [Cloud] End of cloud request. 2026-09-09T16:13:06.464 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T16:25:03.120 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T16:32:18.292 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T16:32:18.292 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T16:32:18.292 [Cloud] Queued cloud request. 2026-09-09T16:32:18.292 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T16:32:18.292 [Cloud] Dequeued cloud request. 2026-09-09T16:32:18.292 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T16:32:18.558 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6E4E6F9C-A2E1-B3AE-8452-DED357FE5794} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 16:32:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T16:32:19.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T16:40:08.120 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{1D2A835E-0C62-940A-7EEE-D83735B43108} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-09-2026 16:50:34 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T16:50:35.089 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T16:50:35.089 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T16:50:35.089 [Cloud] Queued cloud request. 2026-09-09T16:50:35.089 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T16:50:35.089 [Cloud] Dequeued cloud request. 2026-09-09T16:50:35.089 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T16:50:35.261 [Cloud] End of cloud request. 2026-09-09T16:50:35.761 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T16:55:13.120 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T17:10:18.120 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T17:11:03.995 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T17:11:03.995 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T17:11:03.995 [Cloud] Queued cloud request. 2026-09-09T17:11:03.995 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T17:11:03.995 [Cloud] Dequeued cloud request. 2026-09-09T17:11:03.995 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T17:11:04.182 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4223C652-BE90-FBBE-334A-6D9537F502C8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 17:11:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T17:11:04.682 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T17:25:23.120 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T17:26:16.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T17:26:16.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T17:26:16.604 [Cloud] Queued cloud request. 2026-09-09T17:26:16.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T17:26:16.604 [Cloud] Dequeued cloud request. 2026-09-09T17:26:16.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{19CD36EA-FC6D-A1C1-A0D5-0DA75736551C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 17:26:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T17:26:16.979 [Cloud] End of cloud request. 2026-09-09T17:26:17.479 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T17:38:39.729 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T17:38:39.729 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T17:38:39.729 [Cloud] Queued cloud request. 2026-09-09T17:38:39.729 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T17:38:39.729 [Cloud] Dequeued cloud request. 2026-09-09T17:38:39.745 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{BE30B68D-B3CD-9AF3-47C6-39B9FAE873B4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 17:38:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T17:38:39.948 [Cloud] End of cloud request. 2026-09-09T17:38:40.448 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T17:40:28.120 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T17:47:40.932 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T17:47:40.932 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T17:47:40.932 [Cloud] Queued cloud request. 2026-09-09T17:47:40.932 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T17:47:40.932 [Cloud] Dequeued cloud request. 2026-09-09T17:47:40.932 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T17:47:41.135 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5838DFA1-5ADE-8694-6031-11118F928177} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 17:47:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T17:47:41.651 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T17:54:57.713 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T17:54:57.713 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T17:54:57.713 [Cloud] Queued cloud request. 2026-09-09T17:54:57.713 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T17:54:57.713 [Cloud] Dequeued cloud request. 2026-09-09T17:54:57.713 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{DFD6B5C5-8326-557B-75B1-AB735812536E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 17:54:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T17:54:57.932 [Cloud] End of cloud request. 2026-09-09T17:54:58.432 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T17:55:33.119 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T17:59:07.619 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T17:59:07.619 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T17:59:07.619 [Cloud] Queued cloud request. 2026-09-09T17:59:07.619 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T17:59:07.619 [Cloud] Dequeued cloud request. 2026-09-09T17:59:07.619 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{9F4E3B72-24E5-3974-97F6-A291978F5250} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 17:59:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T17:59:07.822 [Cloud] End of cloud request. 2026-09-09T17:59:08.338 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T18:09:12.400 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 3255490, Count: 225605, MaxTime: 2484, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\{11AAC7BE-9A37-427D-9490-510AB73DFDE2}\mpasbase.vdm, EstimatedImpact: 3% 2026-09-09T18:09:12.400 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 23064, Count: 1816, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\CommandLine.dll, EstimatedImpact: 0% 2026-09-09T18:09:12.400 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 9454, Count: 689, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T18:09:12.400 ProcessImageName: powershell.exe, Pid: 7916, TotalTime: 1390, Count: 96, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-09T18:09:12.400 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1094, Count: 76, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-09T18:09:12.400 ProcessImageName: WmiPrvSE.exe, Pid: 1592, TotalTime: 845, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-09T18:09:12.400 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 542, Count: 140, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-7867-0.MAI, EstimatedImpact: 0% 2026-09-09T18:09:12.400 ProcessImageName: AgentShellService.exe, Pid: 7092, TotalTime: 480, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 36% 2026-09-09T18:09:12.400 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 423, Count: 85, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\76744530b92778e6f251e389724745d7\DesktopDeployment.cab, EstimatedImpact: 0% 2026-09-09T18:09:12.400 ProcessImageName: WmiPrvSE.exe, Pid: 5928, TotalTime: 330, Count: 35, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 31% 2026-09-09T18:09:12.400 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 315, Count: 26, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-09T18:09:12.400 ProcessImageName: powershell.exe, Pid: 7172, TotalTime: 262, Count: 22, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-09T18:09:12.400 ProcessImageName: python.exe, Pid: 7744, TotalTime: 165, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-09T18:09:12.400 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-09T18:09:12.400 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 75, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-09T18:09:12.400 ProcessImageName: taskhostw.exe, Pid: 7812, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 6% 2026-09-09T18:09:12.400 ProcessImageName: taskhostw.exe, Pid: 5916, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-09T18:09:12.400 ProcessImageName: cmd.exe, Pid: 1208, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-09T18:09:12.400 ProcessImageName: svchost.exe, Pid: 7572, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\2886173b951f5da9c916eb443a81feec52d9ace4\content.phf, EstimatedImpact: 0% 2026-09-09T18:09:12.400 ProcessImageName: powershell.exe, Pid: 7472, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_uqpra3uv.uh0.ps1, EstimatedImpact: 0% 2026-09-09T18:09:12.400 ProcessImageName: mysqldump.exe, Pid: 4736, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 10% 2026-09-09T18:09:12.400 ProcessImageName: DeviceCensus.exe, Pid: 7396, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-09T18:09:12.400 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-09T18:10:38.119 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T18:13:02.056 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T18:13:02.056 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T18:13:02.056 [Cloud] Queued cloud request. 2026-09-09T18:13:02.056 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T18:13:02.056 [Cloud] Dequeued cloud request. 2026-09-09T18:13:02.056 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T18:13:02.322 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{07F0DA34-239B-AC09-9CEE-72E61F270516} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 18:13:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T18:13:02.838 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T18:14:40.056 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T18:14:40.056 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T18:14:40.056 [Cloud] Queued cloud request. 2026-09-09T18:14:40.056 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T18:14:40.056 [Cloud] Dequeued cloud request. 2026-09-09T18:14:40.228 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T18:14:40.431 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DDD3B5F6-AFDD-66C5-24E1-A200F6893E17} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 18:14:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T18:14:40.947 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T18:16:06.541 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T18:16:06.541 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T18:16:06.541 [Cloud] Queued cloud request. 2026-09-09T18:16:06.541 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T18:16:06.541 [Cloud] Dequeued cloud request. 2026-09-09T18:16:06.541 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{A2B67A07-0F00-C226-F500-78B0D2B5DA94} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 18:16:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T18:16:06.744 [Cloud] End of cloud request. 2026-09-09T18:16:07.244 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T18:23:18.510 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T18:23:18.510 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T18:23:18.510 [Cloud] Queued cloud request. 2026-09-09T18:23:18.510 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T18:23:18.510 [Cloud] Dequeued cloud request. 2026-09-09T18:23:18.510 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{36F6AAEC-B644-43A6-5D2B-EBB36982E720} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 18:23:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T18:23:18.728 [Cloud] End of cloud request. 2026-09-09T18:23:19.260 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T18:25:43.119 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T18:40:48.119 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T18:51:59.447 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T18:51:59.447 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T18:51:59.447 [Cloud] Queued cloud request. 2026-09-09T18:51:59.447 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T18:51:59.603 [Cloud] Dequeued cloud request. 2026-09-09T18:51:59.790 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T18:51:59.993 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DF54E6C8-CC8F-92F9-9271-230C20D82E49} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 18:52:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T18:52:00.493 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T18:55:53.118 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T19:00:24.478 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T19:00:24.478 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T19:00:24.478 [Cloud] Queued cloud request. 2026-09-09T19:00:24.478 [Cloud] Dequeued cloud request. 2026-09-09T19:00:24.478 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T19:00:24.493 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T19:00:33.806 [Cloud] End of cloud request. 2026-09-09T19:00:34.306 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T19:05:07.259 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T19:05:07.259 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T19:05:07.259 [Cloud] Queued cloud request. 2026-09-09T19:05:07.259 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T19:05:07.259 [Cloud] Dequeued cloud request. 2026-09-09T19:05:07.274 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T19:05:07.431 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{37B76080-9C11-D106-E70B-54A81B72E0EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 19:05:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T19:05:07.946 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T19:10:58.118 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T19:18:41.383 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T19:18:41.383 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T19:18:41.383 [Cloud] Queued cloud request. 2026-09-09T19:18:41.383 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T19:18:41.383 [Cloud] Dequeued cloud request. 2026-09-09T19:18:41.383 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T19:18:41.540 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{69A1D987-D6FC-BCA4-90C8-1B1D0936BD27} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 19:18:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T19:18:42.055 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T19:23:22.243 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T19:23:22.243 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T19:23:22.243 [Cloud] Queued cloud request. 2026-09-09T19:23:22.243 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T19:23:22.243 [Cloud] Dequeued cloud request. 2026-09-09T19:23:22.243 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T19:23:22.383 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{88271F48-8E06-D916-899F-EDF2B964E589} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 19:23:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T19:23:22.883 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T19:26:03.118 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T19:28:18.118 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-09T19:28:18.149 Job Notification: New process added to job (1164) 2026-09-09T19:28:18.165 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-09T19:28:18.165 [TaskUpdate] Run lost signature update scheduled job: SignatureUpdate -ScheduleJob -RestrictPrivileges 2026-09-09T19:28:18.165 [TaskUpdate] Run lost signature update scheduled job: SignatureUpdate -ScheduleJob -RestrictPrivileges 2026-09-09T19:28:18.165 Job Notification: New process added to job (7260) 2026-09-09T19:28:18.180 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:1164] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7260]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-09T19:28:18.196 Job Notification: New process added to job (6512) 2026-09-09T19:28:18.211 Job Notification: New process added to job (2040) 2026-09-09T19:28:18.243 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:6512] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:2040]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-09T19:28:18.274 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-09T19:28:18.305 Job Notification: Process exited from job (6512) 2026-09-09T19:28:18.305 Job Notification: Process exited from job (2040) 2026-09-09T19:28:18.321 Job Notification: New process added to job (7540) 2026-09-09T19:28:18.321 [TaskUpdate] MpCmdRun process completed before completion signal is received 2026-09-09T19:28:18.321 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-09T19:28:18.321 Aggressive catchup quick scan threshold: 692444670633 / 25920000000000 2026-09-09T19:28:18.321 Job Notification: New process added to job (7872) 2026-09-09T19:28:18.336 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:7540] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7872]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-09T19:28:18.680 Job Notification: New process added to job (8064) 2026-09-09T19:28:18.758 Task(GetDeviceTicket -AccessKey EFC3E7CB-8434-6576-E3AC-6D99805C4E87 ) launched as network service 2026-09-09T19:28:18.805 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-09T19:28:18.821 [RTP] Duplicating the current plugin configuration object... 2026-09-09T19:28:18.821 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-09T19:28:18.821 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-09T19:28:18.821 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-09T19:28:18.821 [RTP] No config change detected. Not updating plugin configuration. 2026-09-09T19:28:18.821 [RTP] No config changes found. No configuration switch. 2026-09-09T19:28:18.821 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-09T19:28:19.743 Job Notification: Process exited from job (8064) 2026-09-09T19:28:20.352 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-09T19:28:20.352 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T19:28:20.352 [Cloud] Queued cloud request. 2026-09-09T19:28:20.352 [Cloud] Dequeued cloud request. 2026-09-09T19:28:20.368 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T19:28:20.493 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-09T19:28:20.493 [Cloud] End of cloud request. 2026-09-09T19:28:20.868 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T19:28:32.586 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\12248E15-2B48-4634-9222-27FCBBB2395D171c.1dd40916512c17e 2026-09-09T19:28:32.665 Verifying engine and signature files (source: 0) ... 2026-09-09T19:28:32.665 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80DAD12A-AB64-4B50-81C1-0E95DA63E6F7}\mpengine.dll] due to PPL. 2026-09-09T19:28:32.665 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80DAD12A-AB64-4B50-81C1-0E95DA63E6F7}\mpasbase.vdm] (file in cache) 2026-09-09T19:28:32.665 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80DAD12A-AB64-4B50-81C1-0E95DA63E6F7}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-09T19:28:32.680 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80DAD12A-AB64-4B50-81C1-0E95DA63E6F7}\mpasdlta.vdm] 2026-09-09T19:28:32.680 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80DAD12A-AB64-4B50-81C1-0E95DA63E6F7}\mpavbase.vdm] (file in cache) 2026-09-09T19:28:32.680 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80DAD12A-AB64-4B50-81C1-0E95DA63E6F7}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-09T19:28:32.680 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80DAD12A-AB64-4B50-81C1-0E95DA63E6F7}\mpavdlta.vdm] 2026-09-09T19:28:32.899 [Engine] IsHybridMode: 0 2026-09-09T19:28:32.899 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-09T19:28:32.899 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-B16302034A824946E52BC0E5647C998FED3E257D.bin): 0x00000002 2026-09-09T19:28:32.915 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-B16302034A824946E52BC0E5647C998FED3E257D.bin) 2026-09-09T19:28:32.915 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-09T19:28:32.915 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-09T19:28:32.915 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-09T19:28:32.915 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-09T19:28:46.352 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-09T19:28:46.352 [AutoExclusion] Applied roles from cache. 2026-09-09T19:28:46.352 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-09T19:28:46.461 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCE964B020, lRefCount: 6, hr=0 2026-09-09T19:28:46.461 [Engine] New active engine 00007FFCF68AB020 replacing engine 00007FFCE964B020. Number of active engines: 2 2026-09-09T19:28:46.477 EngineInit:Global ASOC is enabled 2026-09-09T19:28:46.477 EngineInit:ASOO is enabled for developer volumes 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.555 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-09T19:28:46.586 MpWriteUupSignatureVersion 1.459.130.0, hr = 0 2026-09-09T19:28:46.586 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-09T19:28:46.618 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-09T19:28:46.618 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-09T19:28:46.618 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-09T19:28:46.618 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-09T19:28:46.633 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-09T19:28:46.633 [Plugin] Initializing RTP plugin state... 2026-09-09T19:28:46.633 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-09T19:28:46.633 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎08‎-‎2026 16:09:12 Last Perf:‎09‎-‎08‎-‎2026 16:09:12 First RTP Scan:‎09‎-‎08‎-‎2026 16:09:13 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:69982 Misses:180241 BM Queue:0,1021,0 Proc:0,144,0 File:0,1021,0 NamedPipe:0,0,0 Plugin Queue:0,2,0 Threat:0,0,0 Susp:0,2,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,1,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:3216617 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:1179893472 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:22922 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:454831 TotalHits:8080893 InstanceCacheInserts:252215 InstanceCacheUpdates:0 InstanceCacheDeletes:27077 InstanceCacheHits:11610 InstanceCacheMisses:538102 InstanceCacheOverflows:205336 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:8ms (19286/2207) Success: 2207, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-09T19:28:46.649 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80DAD12A-AB64-4B50-81C1-0E95DA63E6F7} 2026-09-09T19:28:46.649 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{11AAC7BE-9A37-427D-9490-510AB73DFDE2}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{11AAC7BE-9A37-427D-9490-510AB73DFDE2}\mpasbase.vdm in use, hr=0x80070020 2026-09-09T19:28:46.649 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-09T19:28:46.649 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F9D0F069-EBD2-40F4-B04E-3485CCB4E452} removed 2026-09-09T19:28:46.649 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-09T19:28:46.649 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-09T19:28:46.649 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-09T19:28:46.649 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-09T19:28:46.649 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-09-2026 19:28:46 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-09-2026 19:28:46 2026-09-09T19:28:46.649 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-09T19:28:46.649 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-09T19:28:46.649 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-09T19:28:46.649 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-09T19:28:46.649 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T19:28:46.665 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-09T19:28:46.665 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-09T19:28:46.665 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-09T19:28:46.665 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-09T19:28:46.665 MdCoreSvc is supported in this platform and OS Signature updated on 09-09-2026 19:28:46 Product Version: 4.18.26080.3 Service Version: 4.18.26080.3 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.130.0 AV Signature Version: 1.459.130.0 ************************************************************ 2026-09-09T19:28:46.665 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-09T19:28:46.665 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\12248E15-2B48-4634-9222-27FCBBB2395D171c.1dd40916512c17e 2026-09-09T19:28:46.696 Process scan (postsignatureupdatescan) started. 2026-09-09T19:28:46.727 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-09T19:28:46.727 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-09-2026 19:28:46 ************************************************************ 2026-09-09T19:28:46.883 Job Notification: Process exited from job (7540) 2026-09-09T19:28:46.904 Job Notification: Process exited from job (7872) 2026-09-09T19:28:46.930 Job Notification: Process exited from job (1164) 2026-09-09T19:28:46.930 Job Notification: Process exited from job (7260) 2026-09-09T19:28:47.008 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-09T19:28:47.008 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-09T19:28:47.008 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-09T19:28:47.008 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-09T19:28:47.008 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-09T19:28:47.040 [Engine] Engine 00007FFCE964B020 no longer in use. Number of active engines: 1 2026-09-09T19:28:47.040 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-09T19:28:47.040 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-09T19:28:47.104 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-09T19:28:47.104 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-09T19:28:47.104 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-09T19:28:47.540 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 3395204, Count: 232471, MaxTime: 2484, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Definition Updates\{11AAC7BE-9A37-427D-9490-510AB73DFDE2}\mpasbase.vdm, EstimatedImpact: 3% 2026-09-09T19:28:47.540 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 24758, Count: 1930, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\CommandLine.dll, EstimatedImpact: 0% 2026-09-09T19:28:47.540 ProcessImageName: AgentShell.exe, Pid: 2248, TotalTime: 9454, Count: 689, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T19:28:47.540 ProcessImageName: powershell.exe, Pid: 7916, TotalTime: 1390, Count: 96, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-09T19:28:47.540 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1124, Count: 78, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-09T19:28:47.540 ProcessImageName: WmiPrvSE.exe, Pid: 1592, TotalTime: 845, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-09T19:28:47.540 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 542, Count: 140, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-7867-0.MAI, EstimatedImpact: 0% 2026-09-09T19:28:47.540 ProcessImageName: AgentShellService.exe, Pid: 7092, TotalTime: 480, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 36% 2026-09-09T19:28:47.540 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 423, Count: 85, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SoftwareDistribution\Download\76744530b92778e6f251e389724745d7\DesktopDeployment.cab, EstimatedImpact: 0% 2026-09-09T19:28:47.540 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 346, Count: 27, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-09T19:28:47.540 ProcessImageName: WmiPrvSE.exe, Pid: 5928, TotalTime: 330, Count: 35, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 31% 2026-09-09T19:28:47.540 ProcessImageName: powershell.exe, Pid: 7172, TotalTime: 262, Count: 22, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-09T19:28:47.540 ProcessImageName: python.exe, Pid: 7744, TotalTime: 165, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-09T19:28:47.665 [Engine] RSIG_UNLOADENGINE, 00007FFCE964B020, err=0x0 2026-09-09T19:28:47.711 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{11AAC7BE-9A37-427D-9490-510AB73DFDE2} removed 2026-09-09T19:29:03.071 Process scan (postsignatureupdatescan) completed. 2026-09-09T19:29:15.743 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T19:29:15.743 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T19:29:15.743 [Cloud] Queued cloud request. 2026-09-09T19:29:15.743 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T19:29:15.743 [Cloud] Dequeued cloud request. 2026-09-09T19:29:15.743 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T19:29:15.821 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B53C9C13-0974-096D-E84D-5E9F5D0DE747} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 19:29:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T19:29:16.336 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T19:33:46.540 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-09T19:37:34.539 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T19:37:34.539 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T19:37:34.539 [Cloud] Queued cloud request. 2026-09-09T19:37:34.539 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T19:37:34.539 [Cloud] Dequeued cloud request. 2026-09-09T19:37:34.539 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{D1155CDF-9FCB-C46A-DA34-D35AE0D1AC9D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 19:37:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T19:37:34.743 [Cloud] End of cloud request. 2026-09-09T19:37:35.243 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{9C9BE099-F877-5DB7-BDF8-0134F497FDCA} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-09-2026 19:37:49 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T19:37:49.852 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T19:37:49.852 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T19:37:49.852 [Cloud] Queued cloud request. 2026-09-09T19:37:49.852 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T19:37:49.852 [Cloud] Dequeued cloud request. 2026-09-09T19:37:49.852 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T19:37:49.930 [Cloud] End of cloud request. 2026-09-09T19:37:50.446 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T19:41:08.118 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T19:43:30.289 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T19:43:30.289 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T19:43:30.289 [Cloud] Queued cloud request. 2026-09-09T19:43:30.289 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T19:43:30.289 [Cloud] Dequeued cloud request. 2026-09-09T19:43:30.289 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T19:43:30.493 [Cloud] End of cloud request. 2026-09-09T19:43:31.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T19:46:35.414 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T19:46:35.414 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T19:46:35.414 [Cloud] Queued cloud request. 2026-09-09T19:46:35.414 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T19:46:35.414 [Cloud] Dequeued cloud request. 2026-09-09T19:46:35.430 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{33621682-FC63-F0B6-C7E2-B8805CFCA9F2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 19:46:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T19:46:35.633 [Cloud] End of cloud request. 2026-09-09T19:46:36.133 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T19:56:13.117 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T20:11:18.117 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T20:11:19.273 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T20:11:19.273 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T20:11:19.273 [Cloud] Queued cloud request. 2026-09-09T20:11:19.273 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T20:11:19.273 [Cloud] Dequeued cloud request. 2026-09-09T20:11:19.273 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T20:11:19.476 [Cloud] End of cloud request. 2026-09-09T20:11:19.492 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T20:11:19.492 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T20:11:19.492 [Cloud] Queued cloud request. 2026-09-09T20:11:19.492 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T20:11:19.492 [Cloud] Dequeued cloud request. 2026-09-09T20:11:19.492 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T20:11:19.601 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F82A5F32-2A18-C528-60A6-92C60B8518D5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 20:11:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry BEGIN BM telemetry GUID:{46D2B0F7-2B59-0DD4-41A2-90D5196ED7DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 20:11:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T20:11:19.992 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T20:12:23.398 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T20:12:23.398 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T20:12:23.398 [Cloud] Queued cloud request. 2026-09-09T20:12:23.398 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T20:12:23.398 [Cloud] Dequeued cloud request. 2026-09-09T20:12:23.414 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T20:12:23.601 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3305FBBD-5671-C5F3-F5FB-8200E97431C7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 20:12:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T20:12:24.117 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T20:18:28.851 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T20:18:28.851 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T20:18:28.851 [Cloud] Queued cloud request. 2026-09-09T20:18:28.851 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T20:18:28.851 [Cloud] Dequeued cloud request. 2026-09-09T20:18:28.851 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T20:18:29.086 [Cloud] End of cloud request. 2026-09-09T20:18:29.586 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T20:20:50.695 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T20:20:50.695 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T20:20:50.695 [Cloud] Queued cloud request. 2026-09-09T20:20:50.695 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T20:20:50.866 [Cloud] Dequeued cloud request. 2026-09-09T20:20:50.866 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T20:20:51.054 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{52D2308C-974C-FA1C-D99D-F94658B20E1F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 20:20:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T20:20:51.554 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T20:26:23.116 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T20:27:49.976 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T20:27:49.976 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T20:27:49.976 [Cloud] Queued cloud request. 2026-09-09T20:27:49.976 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T20:27:49.976 [Cloud] Dequeued cloud request. 2026-09-09T20:27:49.976 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T20:27:50.210 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{71D45294-A12C-B265-0CC3-0BC6CB779FD8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 20:27:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T20:27:50.757 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T20:41:28.116 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T20:48:00.678 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T20:48:00.678 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T20:48:00.678 [Cloud] Queued cloud request. 2026-09-09T20:48:00.678 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T20:48:00.694 [Cloud] Dequeued cloud request. 2026-09-09T20:48:00.694 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{59999E28-EC6E-1CDD-86AA-63089718A49B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 20:48:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T20:48:00.897 [Cloud] End of cloud request. 2026-09-09T20:48:01.397 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T20:53:56.444 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T20:53:56.444 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T20:53:56.444 [Cloud] Queued cloud request. 2026-09-09T20:53:56.444 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T20:53:56.444 [Cloud] Dequeued cloud request. 2026-09-09T20:53:56.444 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T20:53:56.647 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F233611F-EC9B-BF3E-5618-3DD6C8E63F84} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 20:53:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T20:53:57.163 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T20:56:33.116 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T20:58:16.537 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T20:58:16.537 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T20:58:16.537 [Cloud] Queued cloud request. 2026-09-09T20:58:16.537 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T20:58:16.537 [Cloud] Dequeued cloud request. 2026-09-09T20:58:16.537 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T20:58:16.741 [Cloud] End of cloud request. 2026-09-09T20:58:17.244 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T20:59:18.366 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T20:59:18.366 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T20:59:18.366 [Cloud] Queued cloud request. 2026-09-09T20:59:18.366 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T20:59:18.366 [Cloud] Dequeued cloud request. 2026-09-09T20:59:18.366 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T20:59:18.537 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0DBBAF9B-6027-E475-0C79-E8A376EFA91F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 20:59:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T20:59:19.053 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0x62fe7fc0 2026-09-09T21:05:59.553 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$R30CG93\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0x1044fcb3 2026-09-09T21:05:59.584 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T21:05:59.584 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T21:05:59.584 [Cloud] Queued cloud request. 2026-09-09T21:05:59.584 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T21:05:59.584 [Cloud] Dequeued cloud request. 2026-09-09T21:05:59.584 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T21:06:00.178 [Cloud] End of cloud request. 2026-09-09T21:06:00.178 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$R30CG93\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-09-09T21:06:00.694 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T21:11:38.115 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T21:23:11.037 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T21:23:11.037 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T21:23:11.037 [Cloud] Queued cloud request. 2026-09-09T21:23:11.037 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T21:23:11.037 [Cloud] Dequeued cloud request. 2026-09-09T21:23:11.037 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T21:23:11.341 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06E465D2-28FB-0FBA-6184-329B41FE083A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 21:23:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T21:23:11.849 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T21:24:04.990 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T21:24:04.990 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T21:24:05.005 [Cloud] Queued cloud request. 2026-09-09T21:24:05.005 [Cloud] Dequeued cloud request. 2026-09-09T21:24:05.005 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T21:24:05.162 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T21:24:05.255 [Cloud] End of cloud request. 2026-09-09T21:24:05.755 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T21:26:43.115 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T21:27:05.880 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T21:27:05.880 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T21:27:05.880 [Cloud] Queued cloud request. 2026-09-09T21:27:05.880 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T21:27:05.880 [Cloud] Dequeued cloud request. 2026-09-09T21:27:05.880 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{FD220DF9-D430-9DFD-76CB-DE2887E773E1} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 21:27:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T21:27:16.021 [Cloud] End of cloud request. 2026-09-09T21:27:16.521 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T21:28:46.458 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 286386, Count: 18964, MaxTime: 1421, MaxTimeFile: \Device\HarddiskVolume2\Program Files\FileZilla FTP Client\fzstorj.exe, EstimatedImpact: 3% 2026-09-09T21:28:46.458 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 2261, Count: 177, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T21:28:46.458 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-09T21:28:46.458 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-09T21:28:46.458 ProcessImageName: taskhostw.exe, Pid: 4900, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-09T21:28:46.458 ProcessImageName: taskhostw.exe, Pid: 1316, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SECURITY, EstimatedImpact: 1% 2026-09-09T21:28:46.458 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 75, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-09T21:28:46.458 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-09T21:28:46.458 ProcessImageName: ngentask.exe, Pid: 2132, TotalTime: 31, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 18% 2026-09-09T21:28:46.458 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-09T21:30:14.036 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T21:30:14.036 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T21:30:14.036 [Cloud] Queued cloud request. 2026-09-09T21:30:14.036 [Cloud] Dequeued cloud request. 2026-09-09T21:30:14.036 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T21:30:14.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T21:30:14.224 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CA898EE9-55A2-8721-B0D4-82694768F191} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 21:30:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T21:30:14.724 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T21:41:48.114 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T21:42:10.770 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T21:42:10.770 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T21:42:10.770 [Cloud] Queued cloud request. 2026-09-09T21:42:10.770 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T21:42:10.770 [Cloud] Dequeued cloud request. 2026-09-09T21:42:10.770 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T21:42:14.786 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T21:42:14.786 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T21:42:14.786 [Cloud] Queued cloud request. 2026-09-09T21:42:14.802 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T21:42:14.802 [Cloud] Dequeued cloud request. 2026-09-09T21:42:14.958 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T21:42:15.224 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8A068DC4-15FA-E4DE-843C-EE0BDC38648F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 21:42:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T21:42:15.739 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T21:42:20.927 [Cloud] End of cloud request. 2026-09-09T21:42:21.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T21:48:59.098 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T21:48:59.098 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T21:48:59.098 [Cloud] Queued cloud request. 2026-09-09T21:48:59.098 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T21:48:59.098 [Cloud] Dequeued cloud request. 2026-09-09T21:48:59.098 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T21:48:59.301 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25DA2F8E-6848-5CD7-D31E-BA7DB2E363BA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 21:48:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T21:48:59.801 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T21:56:23.676 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T21:56:23.676 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T21:56:23.676 [Cloud] Queued cloud request. 2026-09-09T21:56:23.676 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T21:56:23.676 [Cloud] Dequeued cloud request. 2026-09-09T21:56:23.692 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T21:56:31.223 [Cloud] End of cloud request. 2026-09-09T21:56:31.723 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T21:56:53.114 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T22:10:41.066 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T22:10:41.066 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T22:10:41.066 [Cloud] Queued cloud request. 2026-09-09T22:10:41.066 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T22:10:41.066 [Cloud] Dequeued cloud request. 2026-09-09T22:10:41.066 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T22:10:41.269 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{50C852C5-AE27-42A2-864F-84E8BFE28197} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 22:10:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T22:10:41.769 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T22:11:58.113 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T22:27:03.112 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T22:35:58.081 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T22:35:58.081 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T22:35:58.081 [Cloud] Queued cloud request. 2026-09-09T22:35:58.081 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T22:35:58.097 [Cloud] Dequeued cloud request. 2026-09-09T22:35:58.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{A8CAE7D9-4971-EBDD-6546-4038DE3C0E8D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 22:35:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T22:35:58.268 [Cloud] End of cloud request. 2026-09-09T22:35:58.768 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T22:41:37.221 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T22:41:37.221 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T22:41:37.221 [Cloud] Queued cloud request. 2026-09-09T22:41:37.221 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T22:41:37.377 [Cloud] Dequeued cloud request. 2026-09-09T22:41:37.377 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T22:41:37.518 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FBF15ABC-6704-9AC0-1830-8D3EB083F6D6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 22:41:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T22:41:38.034 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T22:42:08.112 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T22:42:26.690 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T22:42:26.690 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T22:42:26.690 [Cloud] Queued cloud request. 2026-09-09T22:42:26.690 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T22:42:26.690 [Cloud] Dequeued cloud request. 2026-09-09T22:42:26.690 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T22:42:36.721 [Cloud] End of cloud request. 2026-09-09T22:42:37.221 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T22:49:10.971 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T22:49:10.971 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T22:49:10.971 [Cloud] Queued cloud request. 2026-09-09T22:49:10.971 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T22:49:11.127 [Cloud] Dequeued cloud request. 2026-09-09T22:49:11.127 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T22:49:11.283 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E2F9EBD5-030D-A550-A197-18C2D5FBB966} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 22:49:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T22:49:11.799 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T22:52:56.908 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T22:52:56.908 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T22:52:56.908 [Cloud] Queued cloud request. 2026-09-09T22:52:56.908 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T22:52:56.908 [Cloud] Dequeued cloud request. 2026-09-09T22:52:56.908 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T22:53:06.987 [Cloud] End of cloud request. 2026-09-09T22:53:07.502 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T22:57:13.111 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T23:00:48.127 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T23:00:48.127 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T23:00:48.127 [Cloud] Queued cloud request. 2026-09-09T23:00:48.127 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T23:00:48.127 [Cloud] Dequeued cloud request. 2026-09-09T23:00:48.127 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T23:00:48.314 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9C524824-D6B2-7FEE-8B85-EB34A5801EA3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 23:00:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T23:00:48.830 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T23:12:18.111 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T23:27:23.110 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T23:28:46.469 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 519689, Count: 34478, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 3% 2026-09-09T23:28:46.469 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 4973, Count: 376, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-09T23:28:46.469 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-09T23:28:46.469 ProcessImageName: WmiPrvSE.exe, Pid: 7860, TotalTime: 892, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 6% 2026-09-09T23:28:46.469 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-09T23:28:46.469 ProcessImageName: python.exe, Pid: 8120, TotalTime: 210, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-09T23:28:46.469 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 181, Count: 12, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-09T23:28:46.469 ProcessImageName: taskhostw.exe, Pid: 4900, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-09T23:28:46.469 ProcessImageName: taskhostw.exe, Pid: 1316, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SECURITY, EstimatedImpact: 1% 2026-09-09T23:28:46.469 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-09T23:28:46.469 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-09T23:28:46.469 ProcessImageName: powershell.exe, Pid: 6000, TotalTime: 31, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDD04.tmp, EstimatedImpact: 0% 2026-09-09T23:28:46.469 ProcessImageName: ngentask.exe, Pid: 2132, TotalTime: 31, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 18% 2026-09-09T23:28:46.469 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e 2026-09-09T23:28:59.032 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7 2026-09-09T23:28:59.047 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T23:28:59.047 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T23:28:59.047 [Cloud] Queued cloud request. 2026-09-09T23:28:59.047 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T23:28:59.063 [Cloud] Dequeued cloud request. 2026-09-09T23:28:59.063 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T23:28:59.563 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-09-09T23:28:59.563 [Cloud] End of cloud request. 2026-09-09T23:29:00.063 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T23:35:25.875 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T23:35:25.875 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T23:35:25.875 [Cloud] Queued cloud request. 2026-09-09T23:35:25.875 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T23:35:25.875 [Cloud] Dequeued cloud request. 2026-09-09T23:35:25.875 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T23:35:26.047 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5C2D7D38-D37F-79B0-940D-708A11D9B740} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 23:35:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T23:35:26.563 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T23:42:28.109 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-09T23:46:40.718 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T23:46:40.718 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T23:46:40.718 [Cloud] Queued cloud request. 2026-09-09T23:46:40.718 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T23:46:40.718 [Cloud] Dequeued cloud request. 2026-09-09T23:46:40.718 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T23:46:40.875 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{764A043C-24F2-2AE3-EEC5-DFE25E76F3AA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-09-2026 23:46:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-09T23:46:41.375 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T23:52:10.093 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T23:52:10.093 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T23:52:10.093 [Cloud] Queued cloud request. 2026-09-09T23:52:10.093 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T23:52:10.093 [Cloud] Dequeued cloud request. 2026-09-09T23:52:10.093 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T23:52:10.234 [Cloud] End of cloud request. 2026-09-09T23:52:10.750 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T23:55:20.734 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-09T23:55:20.734 [Cloud] Start of cloud request. Passive mode: 0 2026-09-09T23:55:20.734 [Cloud] Queued cloud request. 2026-09-09T23:55:20.734 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-09T23:55:20.734 [Cloud] Dequeued cloud request. 2026-09-09T23:55:20.749 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-09T23:55:20.874 [Cloud] End of cloud request. 2026-09-09T23:55:21.390 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-09T23:57:33.108 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T00:01:34.046 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T00:01:34.046 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T00:01:34.046 [Cloud] Queued cloud request. 2026-09-10T00:01:34.046 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T00:01:34.046 [Cloud] Dequeued cloud request. 2026-09-10T00:01:34.062 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T00:01:34.265 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{130D38EC-12E8-4A48-9B5C-FBD2285DFC23} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 00:01:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T00:01:34.765 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T00:03:45.046 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T00:03:45.046 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T00:03:45.046 [Cloud] Queued cloud request. 2026-09-10T00:03:45.046 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T00:03:45.046 [Cloud] Dequeued cloud request. 2026-09-10T00:03:45.046 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T00:03:45.233 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AC668A6B-D71A-A908-FB47-F8296344B0EF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 00:03:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T00:03:45.733 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T00:10:07.077 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T00:10:07.077 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T00:10:07.077 [Cloud] Queued cloud request. 2026-09-10T00:10:07.077 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T00:10:07.077 [Cloud] Dequeued cloud request. 2026-09-10T00:10:07.092 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{E1E38AB1-A2A1-0862-A3AC-6BF15C256D2D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 00:10:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T00:10:07.280 [Cloud] End of cloud request. 2026-09-10T00:10:07.795 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T00:10:48.233 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T00:10:48.233 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T00:10:48.233 [Cloud] Queued cloud request. 2026-09-10T00:10:48.233 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T00:10:48.233 [Cloud] Dequeued cloud request. 2026-09-10T00:10:48.233 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T00:10:48.327 [Cloud] End of cloud request. 2026-09-10T00:10:48.827 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T00:12:38.108 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T00:12:45.748 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T00:12:45.748 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T00:12:45.748 [Cloud] Queued cloud request. 2026-09-10T00:12:45.748 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T00:12:45.748 [Cloud] Dequeued cloud request. 2026-09-10T00:12:45.748 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T00:12:45.952 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C40E0F21-98F0-B0E6-B840-BF036C9B586A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 00:12:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T00:12:46.452 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T00:13:51.639 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T00:13:51.639 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T00:13:51.639 [Cloud] Queued cloud request. 2026-09-10T00:13:51.639 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T00:13:51.639 [Cloud] Dequeued cloud request. 2026-09-10T00:13:51.639 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T00:13:51.827 [Cloud] End of cloud request. 2026-09-10T00:13:52.342 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T00:14:13.873 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:C381C203-471B-40BE-ABE6-59EFDE1AB961, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-10T00:14:13.873 Scheduled scan with Id C381C203-471B-40BE-ABE6-59EFDE1AB961 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-10T00:14:13.873 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-10T00:14:13.873 [SFC] System file cache build is not needed (already completed) 2026-09-10T00:14:40.077 Engine:Triggered AR EMS scan 2026-09-10T00:14:40.077 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.108 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.108 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.123 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.123 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.139 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.139 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.155 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.170 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.170 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.170 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.170 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.186 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.186 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.202 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.217 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.217 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.233 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.248 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.248 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.264 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.264 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.264 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.264 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.280 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.280 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.295 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.311 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.327 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.327 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.327 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.327 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.342 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.358 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.358 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.373 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.373 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.389 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.405 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.420 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.420 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.420 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.436 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.436 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.452 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.467 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.467 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.483 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.498 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.514 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.530 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.545 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.545 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.561 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.577 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.608 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.623 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.639 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.655 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.670 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:14:40.670 Engine:EMS scan for process: svchost pid: 7564, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-10T00:15:27.217 QuickScan:ScanID:C381C203-471B-40BE-ABE6-59EFDE1AB961: Quick scan finished with error 0 2026-09-10T00:15:27.733 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-10T00:15:27.733 [RTP] Duplicating the current plugin configuration object... 2026-09-10T00:15:27.733 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-10T00:15:27.733 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-10T00:15:27.733 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-10T00:15:27.733 [RTP] No config change detected. Not updating plugin configuration. 2026-09-10T00:15:27.733 [RTP] No config changes found. No configuration switch. 2026-09-10T00:15:27.733 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-10T00:27:43.107 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{B5E87396-93E5-318C-5268-909AE0E790A3} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-10-2026 00:35:14 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T00:35:15.372 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T00:35:15.372 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T00:35:15.372 [Cloud] Queued cloud request. 2026-09-10T00:35:15.372 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T00:35:15.372 [Cloud] Dequeued cloud request. 2026-09-10T00:35:15.372 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T00:35:15.560 [Cloud] End of cloud request. 2026-09-10T00:35:16.075 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T00:42:48.107 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T00:53:22.575 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T00:53:22.575 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T00:53:22.575 [Cloud] Queued cloud request. 2026-09-10T00:53:22.575 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T00:53:22.590 [Cloud] Dequeued cloud request. 2026-09-10T00:53:22.590 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T00:53:22.794 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6E5062E5-E53F-B94A-C058-74D4C9A13032} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 00:53:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T00:53:23.309 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T00:54:43.543 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T00:54:43.543 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T00:54:43.543 [Cloud] Queued cloud request. 2026-09-10T00:54:43.543 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T00:54:43.543 [Cloud] Dequeued cloud request. 2026-09-10T00:54:43.543 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T00:54:43.731 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{787D14A6-2F3E-E045-7E0A-A9D493F71938} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 00:54:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T00:54:44.231 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T00:55:07.762 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T00:55:07.762 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T00:55:07.762 [Cloud] Queued cloud request. 2026-09-10T00:55:07.762 [Cloud] Dequeued cloud request. 2026-09-10T00:55:07.762 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T00:55:07.762 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T00:55:07.871 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E2F1899-0B8B-D312-E529-ABCA6AC02CE1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 00:55:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T00:55:08.387 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T00:57:53.105 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T01:00:02.105 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3377977, FileId: 0x600000000d343, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.105 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3377978, FileId: 0x900000000cf64, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.152 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3377984, FileId: 0xb00000000cf64, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.152 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3377983, FileId: 0x800000000d343, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.168 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3377990, FileId: 0xd00000000cf64, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.168 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3377989, FileId: 0xa00000000d343, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.184 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3377996, FileId: 0xf00000000cf64, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.184 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3377995, FileId: 0xc00000000d343, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.184 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378001, FileId: 0xe00000000d343, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.184 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378002, FileId: 0x1100000000cf64, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.199 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378008, FileId: 0x1000000000d343, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.199 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378007, FileId: 0x1300000000cf64, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.230 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378013, FileId: 0x1200000000d343, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.230 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378014, FileId: 0x1500000000cf64, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.262 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378019, FileId: 0x1700000000cf64, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.262 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378020, FileId: 0x1400000000d343, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.262 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378025, FileId: 0x1600000000d343, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.277 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378026, FileId: 0x1900000000cf64, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.277 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378031, FileId: 0x1800000000d343, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.277 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378032, FileId: 0x1b00000000cf64, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.309 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378038, FileId: 0x1d00000000cf64, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.309 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378037, FileId: 0x1a00000000d343, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.340 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378043, FileId: 0x1c00000000d343, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:00:02.340 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df34-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3378044, FileId: 0x1f00000000cf64, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T01:09:51.433 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T01:09:51.433 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T01:09:51.433 [Cloud] Queued cloud request. 2026-09-10T01:09:51.433 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T01:09:51.433 [Cloud] Dequeued cloud request. 2026-09-10T01:09:51.449 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T01:09:51.589 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6425AD75-AC2C-B7A7-D6CA-E795D048EC35} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 01:09:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T01:09:52.105 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T01:10:55.495 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T01:10:55.495 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T01:10:55.495 [Cloud] Queued cloud request. 2026-09-10T01:10:55.495 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T01:10:55.495 [Cloud] Dequeued cloud request. 2026-09-10T01:10:55.495 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T01:10:55.652 [Cloud] End of cloud request. 2026-09-10T01:10:56.152 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T01:12:58.105 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T01:18:53.729 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T01:18:53.729 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T01:18:53.729 [Cloud] Queued cloud request. 2026-09-10T01:18:53.729 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T01:18:53.886 [Cloud] Dequeued cloud request. 2026-09-10T01:18:53.886 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T01:19:03.964 [Cloud] End of cloud request. 2026-09-10T01:19:04.464 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T01:19:37.354 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T01:19:37.354 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T01:19:37.354 [Cloud] Queued cloud request. 2026-09-10T01:19:37.354 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T01:19:37.354 [Cloud] Dequeued cloud request. 2026-09-10T01:19:37.354 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T01:19:37.448 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D6D68511-9570-8247-CF15-6001A88189DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 01:19:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T01:19:37.964 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T01:28:03.104 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T01:28:46.479 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 841113, Count: 55795, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 3% 2026-09-10T01:28:46.479 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 6973, Count: 547, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T01:28:46.479 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-10T01:28:46.479 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 999, Count: 43, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-10T01:28:46.479 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 916, Count: 25, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 53% 2026-09-10T01:28:46.479 ProcessImageName: WmiPrvSE.exe, Pid: 7860, TotalTime: 892, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 6% 2026-09-10T01:28:46.479 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 364, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-10T01:28:46.479 ProcessImageName: WmiPrvSE.exe, Pid: 1536, TotalTime: 339, Count: 11, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\spaceport.sys, EstimatedImpact: 2% 2026-09-10T01:28:46.479 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T01:28:46.479 ProcessImageName: python.exe, Pid: 8120, TotalTime: 210, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-10T01:28:46.479 ProcessImageName: powershell.exe, Pid: 1964, TotalTime: 198, Count: 21, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 1% 2026-09-10T01:28:46.479 ProcessImageName: taskhostw.exe, Pid: 4900, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-10T01:28:46.479 ProcessImageName: taskhostw.exe, Pid: 1316, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SECURITY, EstimatedImpact: 1% 2026-09-10T01:28:46.479 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-10T01:28:46.479 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df21-0.MAD, EstimatedImpact: 0% 2026-09-10T01:28:46.479 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-10T01:28:46.479 ProcessImageName: powershell.exe, Pid: 6000, TotalTime: 31, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDD04.tmp, EstimatedImpact: 0% 2026-09-10T01:28:46.479 ProcessImageName: ngentask.exe, Pid: 2132, TotalTime: 31, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 18% 2026-09-10T01:28:46.479 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-10T01:30:36.588 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T01:30:36.588 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T01:30:36.588 [Cloud] Queued cloud request. 2026-09-10T01:30:36.588 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T01:30:36.588 [Cloud] Dequeued cloud request. 2026-09-10T01:30:36.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T01:30:43.666 [Cloud] End of cloud request. 2026-09-10T01:30:44.182 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T01:41:50.025 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T01:41:50.025 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T01:41:50.025 [Cloud] Queued cloud request. 2026-09-10T01:41:50.025 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T01:41:50.041 [Cloud] Dequeued cloud request. 2026-09-10T01:41:50.041 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T01:41:50.619 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F54E3BDA-8176-72D7-03E1-F066B8FB799C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 01:41:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T01:41:51.150 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T01:43:08.103 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T01:43:31.322 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T01:43:31.322 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T01:43:31.322 [Cloud] Queued cloud request. 2026-09-10T01:43:31.322 [Cloud] Dequeued cloud request. 2026-09-10T01:43:31.322 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T01:43:31.322 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{14BFC2F5-0062-882E-A30B-F39EA262E178} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 01:43:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T01:43:31.509 [Cloud] End of cloud request. 2026-09-10T01:43:32.025 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T01:43:53.119 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T01:43:53.119 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T01:43:53.119 [Cloud] Queued cloud request. 2026-09-10T01:43:53.119 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T01:43:53.119 [Cloud] Dequeued cloud request. 2026-09-10T01:43:53.119 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{F097CF29-975A-6CF0-499C-802AA77244B3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 01:43:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T01:43:53.228 [Cloud] End of cloud request. 2026-09-10T01:43:53.728 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T01:56:01.618 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T01:56:01.618 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T01:56:01.618 [Cloud] Queued cloud request. 2026-09-10T01:56:01.618 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T01:56:01.618 [Cloud] Dequeued cloud request. 2026-09-10T01:56:01.618 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T01:56:02.493 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C9488659-9DFA-1053-6E80-B0783A71CF5F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 01:56:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T01:56:03.009 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T01:56:28.071 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T01:56:28.071 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T01:56:28.071 [Cloud] Queued cloud request. 2026-09-10T01:56:28.071 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T01:56:28.071 [Cloud] Dequeued cloud request. 2026-09-10T01:56:28.071 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T01:56:28.149 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C4C09EB4-0F75-93A8-6D56-76F5DD7D8844} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 01:56:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T01:56:28.649 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T01:58:13.102 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0xedaca0d5 2026-09-10T02:04:36.166 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$R30CG93\phpmyserver\help.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x3329faf726b1 2026-09-10T02:07:51.648 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T02:07:51.648 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T02:07:51.648 [Cloud] Queued cloud request. 2026-09-10T02:07:51.648 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T02:07:51.648 [Cloud] Dequeued cloud request. 2026-09-10T02:07:51.664 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T02:07:51.867 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{49EDF43E-3075-F209-F00D-BFC52D8E01EB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 02:07:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T02:07:52.367 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T02:08:01.617 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T02:08:01.617 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T02:08:01.617 [Cloud] Queued cloud request. 2026-09-10T02:08:01.617 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T02:08:01.617 [Cloud] Dequeued cloud request. 2026-09-10T02:08:01.617 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T02:08:01.695 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E271F5E6-61CB-971B-0054-730FEAEFEB93} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 02:08:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T02:08:02.195 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T02:09:15.664 Bm signature throttled:0x000135b39c9104ce 2026-09-10T02:13:18.101 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T02:13:36.258 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T02:13:36.258 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T02:13:36.258 [Cloud] Queued cloud request. 2026-09-10T02:13:36.258 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T02:13:36.258 [Cloud] Dequeued cloud request. 2026-09-10T02:13:36.258 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T02:13:36.445 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ACE9A529-CF74-5352-9AD0-107FFF5B186A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 02:13:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T02:13:36.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T02:18:47.288 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T02:18:47.288 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T02:18:47.288 [Cloud] Queued cloud request. 2026-09-10T02:18:47.288 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T02:18:47.288 [Cloud] Dequeued cloud request. 2026-09-10T02:18:47.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T02:18:47.445 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{793640A2-C3E8-E16E-E7F8-4218C882CD4A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 02:18:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T02:18:47.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T02:28:23.100 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T02:30:18.585 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T02:30:18.585 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T02:30:18.585 [Cloud] Queued cloud request. 2026-09-10T02:30:18.585 [Cloud] Dequeued cloud request. 2026-09-10T02:30:18.585 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T02:30:18.585 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T02:30:18.788 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{060F2226-A470-CF4F-455A-3BCA0EB49610} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 02:30:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T02:30:19.288 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T02:38:04.881 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T02:38:04.881 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T02:38:04.881 [Cloud] Queued cloud request. 2026-09-10T02:38:04.881 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T02:38:05.069 [Cloud] Dequeued cloud request. 2026-09-10T02:38:05.069 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T02:38:05.256 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F6E9E0E3-DF72-E165-17C8-48A7A73D5572} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 02:38:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T02:38:05.772 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T02:43:28.100 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T02:45:10.959 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T02:45:10.959 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T02:45:10.959 [Cloud] Queued cloud request. 2026-09-10T02:45:10.959 [Cloud] Dequeued cloud request. 2026-09-10T02:45:10.959 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T02:45:10.959 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T02:45:11.162 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2A954789-8E9F-95CD-9BF4-CED101751F37} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 02:45:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T02:45:11.678 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T02:51:09.412 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T02:51:09.412 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T02:51:09.412 [Cloud] Queued cloud request. 2026-09-10T02:51:09.412 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T02:51:09.427 [Cloud] Dequeued cloud request. 2026-09-10T02:51:09.427 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T02:51:09.599 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{930E98A5-AE2A-0F3A-C04D-748EC02EFC54} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 02:51:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T02:51:10.099 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T02:58:33.099 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T03:07:03.067 [AutoPurge] Verification Routine tasks have started. 2026-09-10T03:07:03.067 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-10T03:07:03.067 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-10T03:07:03.067 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-10T03:07:03.067 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-10T03:07:03.067 [AutoPurge] MpSignalMaintenanceMode ...ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-10T03:07:03.161 [AutoPurge] Cleanup Routine tasks have started. 2026-09-10T03:07:03.208 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-10T03:07:03.208 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-10T03:07:03.208 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 3, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-10-2026 03:07:03 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-10-2026 03:07:03 2026-09-10T03:07:03.208 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-10T03:07:03.208 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-10T03:07:03.208 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-10T03:07:03.208 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-10T03:07:03.223 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-10T03:07:03.223 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-10T03:07:03.270 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-10T03:07:03.286 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-10T03:07:03.317 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-10T03:07:03.333 [AutoPurge] Removing expired default signature package ... 2026-09-10T03:07:03.755 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-10T03:07:03.833 Job Notification: New process added to job (5408) 2026-09-10T03:07:03.942 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-10T03:07:03.973 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-10T03:07:03.973 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-10T03:07:03.973 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-10T03:07:03.973 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-10T03:07:03.973 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-10T03:07:03.973 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-10T03:07:03.973 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-10T03:07:03.973 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-10T03:07:03.973 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-10T03:07:03.973 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-10T03:07:03.973 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-10T03:07:03.973 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-10T03:07:03.973 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-10T03:07:03.973 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-10T03:07:03.973 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-10T03:07:03.973 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-10T03:07:03.973 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-10T03:07:03.973 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-10T03:07:03.973 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-10T03:07:03.973 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:07:03.973 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-10T03:07:03.973 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:07:03.973 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:07:03.973 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:07:03.973 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:07:04.052 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-10T03:07:04.661 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:07:05.473 Job Notification: Process exited from job (5408) 2026-09-10T03:07:05.520 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-10T03:07:05.552 [AutoPurge] Verification Routine tasks have ended. 2026-09-10T03:07:05.645 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-10T03:07:06.161 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-10T03:07:06.270 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-10T03:07:06.489 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-10T03:07:06.567 [RTP] Duplicating the current plugin configuration object... 2026-09-10T03:07:06.567 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-10T03:07:06.567 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-10T03:07:06.567 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-10T03:07:06.567 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-10T03:07:06.567 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-10T03:07:08.473 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_mi.dll", hr=0x0 2026-09-10T03:07:08.583 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-10T03:07:09.036 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-10T03:07:09.317 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-10T03:07:09.333 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:09.567 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-10T03:07:10.364 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-10T03:07:10.598 Engine:Setting original file name "AM_Delta_Patch_1.459.111.0.exe" for "c:\windows\softwaredistribution\download\bb8e7e58e8ddf04ab0759914607539c88bc73f66", hr=0x0 2026-09-10T03:07:11.177 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-10T03:07:11.301 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-10T03:07:11.489 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-10T03:07:11.786 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:07:11.848 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psuser_arm64.dll", hr=0x0 2026-09-10T03:07:12.098 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-10T03:07:12.536 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-10T03:07:12.598 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ko.dll", hr=0x0 2026-09-10T03:07:12.692 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-10T03:07:12.895 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:13.051 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:13.130 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-10T03:07:13.145 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-10T03:07:13.364 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:07:13.458 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-10T03:07:13.536 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-10T03:07:13.551 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.695_none_7572f17cd4648630\penimc.dll", hr=0x0 2026-09-10T03:07:13.605 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ro.dll", hr=0x0 2026-09-10T03:07:13.630 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-10T03:07:13.817 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-10T03:07:14.411 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:14.458 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-10T03:07:14.770 Engine:Setting original file name "libVoiceFabric.dll" for "c:\program files (x86)\microsoft\edgecore\optimized\undocked_copilot\voicefabric.dll", hr=0x0 2026-09-10T03:07:14.958 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ga.dll", hr=0x0 2026-09-10T03:07:15.051 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:07:15.223 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-10T03:07:16.051 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-10T03:07:16.676 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:16.880 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:07:17.036 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fil.dll", hr=0x0 2026-09-10T03:07:17.317 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-10T03:07:17.645 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fr.dll", hr=0x0 2026-09-10T03:07:17.958 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-10T03:07:18.130 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-10T03:07:18.770 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-10T03:07:18.942 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:19.630 Engine:Setting original file name "BmModels.dll" for "c:\programdata\microsoft\windows defender\models\model_5e2a8ecd-08ac-4a01-a24d-fe70f03b147c.dll", hr=0x0 2026-09-10T03:07:19.645 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:07:19.864 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-10T03:07:19.880 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-10T03:07:19.942 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psmachine.dll", hr=0x0 2026-09-10T03:07:19.973 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-10T03:07:20.192 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-10T03:07:20.301 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-10T03:07:20.364 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-10T03:07:20.458 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-10T03:07:20.567 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.695_none_daf240e70cab3235\penimc_v0400.dll", hr=0x0 2026-09-10T03:07:20.739 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-10T03:07:21.239 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-10T03:07:21.567 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-10T03:07:22.239 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-10T03:07:22.661 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_zh-tw.dll", hr=0x0 2026-09-10T03:07:23.958 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-10T03:07:24.192 Engine:Setting original file name "BmModels.dll" for "c:\programdata\microsoft\windows defender\models\model_d736908c-85f9-4e40-8415-5cdb6c7a8981.dll", hr=0x0 2026-09-10T03:07:24.583 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-10T03:07:24.629 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-10T03:07:24.661 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-10T03:07:24.676 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-10T03:07:24.708 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-10T03:07:24.879 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-10T03:07:25.145 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-10T03:07:25.176 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:25.254 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-10T03:07:25.801 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-10T03:07:25.879 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-10T03:07:25.895 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-10T03:07:25.958 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-10T03:07:26.114 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_hr.dll", hr=0x0 2026-09-10T03:07:26.551 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-10T03:07:26.770 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:26.817 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-10T03:07:26.864 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-10T03:07:26.895 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-10T03:07:27.426 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-10T03:07:27.880 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-10T03:07:27.895 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:28.489 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_th.dll", hr=0x0 2026-09-10T03:07:28.833 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-10T03:07:28.864 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-10T03:07:29.692 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:07:30.145 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-10T03:07:30.739 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-10T03:07:30.942 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-10T03:07:31.208 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:31.426 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-10T03:07:31.520 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ca-es-valencia.dll", hr=0x0 2026-09-10T03:07:31.708 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-10T03:07:32.083 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-10T03:07:32.161 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-10T03:07:32.661 Engine:Setting original file name "Microsoft Cognitive Services Speech SDK" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\microsoft.cognitiveservices.speech.extension.lu.dll", hr=0x0 2026-09-10T03:07:32.770 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-10T03:07:33.098 Engine:Setting original file name "CoreMessaging.dll" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\coremessagingxp.dll", hr=0x0 2026-09-10T03:07:33.145 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-10T03:07:33.192 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-10T03:07:33.254 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:07:33.661 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:07:33.942 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-10T03:07:33.957 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_gd.dll", hr=0x0 2026-09-10T03:07:34.083 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-10T03:07:34.223 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-10T03:07:34.254 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-10T03:07:34.645 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-10T03:07:35.411 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-10T03:07:35.989 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-10T03:07:36.145 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-10T03:07:36.270 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-10T03:07:36.442 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\microsoftedgeupdatebroker.exe", hr=0x0 2026-09-10T03:07:36.973 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\x86_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.695_none_229f77be21275b3b\penimc_v0400.dll", hr=0x0 2026-09-10T03:07:37.020 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-10T03:07:37.067 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:37.520 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-10T03:07:37.645 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-10T03:07:37.645 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-10T03:07:37.692 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-10T03:07:37.786 Engine:Setting original file name "MSHTML.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-i..tmlrendering-legacy_31bf3856ad364e35_11.0.20348.5386_none_fe665d760dfcbf57\mshtml.dll.mun", hr=0x0 2026-09-10T03:07:37.879 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-10T03:07:37.911 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-10T03:07:37.973 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-10T03:07:38.442 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-10T03:07:38.442 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-10T03:07:38.957 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-10T03:07:39.176 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-10T03:07:39.317 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-10T03:07:39.332 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-10T03:07:39.692 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:07:40.036 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-10T03:07:40.442 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.20348.3451_none_87d480d8b356cff3\apphelp.dll", hr=0x0 2026-09-10T03:07:40.582 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:07:41.036 Engine:Setting original file name "propsys.dll" for "c:\windows\winsxs\amd64_microsoft-windows-propsys_31bf3856ad364e35_7.0.20348.5386_none_cc9e52b39cfe064e\propsys.dll.mun", hr=0x0 2026-09-10T03:07:41.082 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-10T03:07:41.239 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-10T03:07:41.707 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-10T03:07:41.723 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-10T03:07:41.911 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-10T03:07:42.098 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-10T03:07:42.723 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-10T03:07:42.770 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-10T03:07:43.036 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-10T03:07:43.036 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-10T03:07:43.473 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-10T03:07:43.567 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-10T03:07:44.004 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:07:44.082 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.20348.5386_none_ff775c057dcff4c1\edgehtml.dll.mun", hr=0x0 2026-09-10T03:07:44.473 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:07:44.645 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-10T03:07:44.707 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-10T03:07:45.489 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-10T03:07:45.489 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-10T03:07:45.801 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-10T03:07:45.989 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-10T03:07:46.551 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-10T03:07:47.442 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fa.dll", hr=0x0 2026-09-10T03:07:47.457 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:07:47.676 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_de.dll", hr=0x0 2026-09-10T03:07:47.707 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-10T03:07:48.239 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-10T03:07:48.582 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-10T03:07:48.770 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-10T03:07:48.801 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:48.817 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-10T03:07:48.832 Engine:Setting original file name "chakra.dll" for "c:\windows\winsxs\amd64_microsoft-windows-scripting-chakra_31bf3856ad364e35_11.0.20348.5386_none_af92b8d8361dbd13\chakra.dll.mun", hr=0x0 2026-09-10T03:07:48.895 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ca.dll", hr=0x0 2026-09-10T03:07:48.973 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-10T03:07:49.239 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-10T03:07:49.739 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-10T03:07:49.801 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-10T03:07:50.098 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-10T03:07:50.114 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sl.dll", hr=0x0 2026-09-10T03:07:50.489 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-10T03:07:50.551 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-10T03:07:50.911 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:07:51.270 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-10T03:07:51.489 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-10T03:07:51.957 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_da.dll", hr=0x0 2026-09-10T03:07:52.457 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:07:52.551 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-10T03:07:52.661 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-10T03:07:52.723 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-10T03:07:54.067 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-10T03:07:54.161 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-10T03:07:54.270 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-10T03:07:54.504 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-10T03:07:54.770 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-10T03:07:54.957 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-10T03:07:55.832 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-10T03:07:55.879 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-10T03:07:55.911 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-10T03:07:56.004 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-10T03:07:56.114 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-10T03:07:56.536 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-10T03:07:56.707 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-10T03:07:56.739 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-10T03:07:56.770 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-10T03:07:56.879 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:57.020 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-10T03:07:57.067 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-10T03:07:57.473 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-10T03:07:57.520 Engine:Setting original file name "MicrosoftEdgeUpdate.exe" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\microsoftedgeupdatecore.exe", hr=0x0 2026-09-10T03:07:57.661 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-10T03:07:58.223 Engine:Setting original file name "copilotapphost.dll" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\copilotapphost.exe", hr=0x0 2026-09-10T03:07:58.254 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-10T03:07:58.395 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-10T03:07:58.692 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-10T03:07:59.114 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-10T03:07:59.176 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-10T03:07:59.489 Engine:Setting original file name " " for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\dxcompiler.dll", hr=0x0 2026-09-10T03:07:59.692 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-10T03:08:00.067 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-10T03:08:00.145 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-10T03:08:00.270 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:00.442 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:00.707 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-10T03:08:00.817 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-10T03:08:01.036 Engine:Setting original file name "mpasdlta.vdm" for "c:\programdata\microsoft\windows defender\definition updates\backup\mpasdlta.lkg", hr=0x0 2026-09-10T03:08:01.254 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:08:01.457 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-10T03:08:01.551 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:01.911 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:08:01.973 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-10T03:08:02.036 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-10T03:08:02.286 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-10T03:08:02.332 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-10T03:08:02.348 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-10T03:08:02.942 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-10T03:08:03.036 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-10T03:08:03.051 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_cs.dll", hr=0x0 2026-09-10T03:08:03.067 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-10T03:08:03.161 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:03.426 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:08:03.645 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-10T03:08:04.364 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-10T03:08:04.536 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-10T03:08:04.567 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_bn.dll", hr=0x0 2026-09-10T03:08:04.614 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-10T03:08:04.958 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-10T03:08:04.989 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-10T03:08:05.051 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-10T03:08:05.504 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-10T03:08:05.567 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-10T03:08:05.926 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-10T03:08:06.004 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-10T03:08:06.036 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\microsoftedgeupdateondemand.exe", hr=0x0 2026-09-10T03:08:06.082 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-10T03:08:06.098 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:06.129 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-10T03:08:06.161 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:08:06.192 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-10T03:08:06.223 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:06.551 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ja.dll", hr=0x0 2026-09-10T03:08:06.989 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-10T03:08:07.317 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-10T03:08:07.692 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:07.770 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-10T03:08:08.051 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_lv.dll", hr=0x0 2026-09-10T03:08:08.098 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:08.114 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:08:08.239 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sq.dll", hr=0x0 2026-09-10T03:08:08.301 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-10T03:08:08.317 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_eu.dll", hr=0x0 2026-09-10T03:08:08.739 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:08.770 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-10T03:08:09.004 Engine:Setting original file name "mini_installer.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{56eb18f8-b008-4cbd-b6d2-8c97fe7e9062}\152.0.4191.66\microsoftedge_x64_152.0.4191.66_152.0.4191.62.exe", hr=0x0 2026-09-10T03:08:09.161 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-10T03:08:09.192 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-10T03:08:09.364 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-10T03:08:09.489 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-10T03:08:09.489 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-10T03:08:09.754 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-10T03:08:09.785 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-10T03:08:09.801 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-10T03:08:09.973 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_az.dll", hr=0x0 2026-09-10T03:08:10.004 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-10T03:08:10.176 Engine:Setting original file name "dnsapi" for "c:\windows\winsxs\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.20348.5386_none_485c938889b83d9d\dnsapi.dll", hr=0x0 2026-09-10T03:08:10.239 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:10.551 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-10T03:08:11.020 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\winsxs\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.20348.3692_none_ea9c313aecda491b\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-10T03:08:11.176 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-10T03:08:11.317 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-10T03:08:11.582 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-10T03:08:11.786 Engine:Setting original file name "Vulkan Runtime" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\vulkan-1.dll", hr=0x0 2026-09-10T03:08:11.801 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-10T03:08:11.817 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-10T03:08:11.832 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:08:12.114 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-10T03:08:12.145 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-10T03:08:12.410 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:12.582 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-10T03:08:12.582 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-10T03:08:13.161 Engine:Setting original file name "osloader.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5386_none_03a2efa89ed8c204\winload.exe", hr=0x0 2026-09-10T03:08:13.661 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:08:13.661 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-10T03:08:13.801 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-10T03:08:13.973 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:08:14.004 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:08:14.176 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_hi.dll", hr=0x0 2026-09-10T03:08:15.051 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:15.739 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-10T03:08:16.004 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:16.020 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-10T03:08:16.192 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psuser.dll", hr=0x0 2026-09-10T03:08:16.254 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:16.285 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-10T03:08:16.442 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-10T03:08:16.629 Engine:Setting original file name "libcrypto" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\libcrypto-3-x64.dll", hr=0x0 2026-09-10T03:08:16.645 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-10T03:08:16.645 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_el.dll", hr=0x0 2026-09-10T03:08:16.707 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-10T03:08:16.895 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.265.7\microsoftedgeupdatesetup_x86_1.3.265.7.exe", hr=0x0 2026-09-10T03:08:17.051 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-10T03:08:17.082 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:17.395 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:08:17.410 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:17.457 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-10T03:08:18.161 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-10T03:08:18.910 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-10T03:08:18.957 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:19.004 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-10T03:08:19.207 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:19.489 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:19.629 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-10T03:08:19.895 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sr.dll", hr=0x0 2026-09-10T03:08:20.098 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-10T03:08:20.739 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:20.770 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-10T03:08:21.129 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:08:21.317 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-10T03:08:21.582 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-10T03:08:21.598 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:21.942 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-10T03:08:22.473 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-10T03:08:22.520 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:22.645 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:22.832 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-10T03:08:22.879 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-10T03:08:23.332 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-10T03:08:23.457 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:23.676 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-10T03:08:23.692 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-10T03:08:23.707 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:23.770 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:23.989 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-10T03:08:24.082 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:24.098 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ka.dll", hr=0x0 2026-09-10T03:08:24.598 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-10T03:08:24.676 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_en.dll", hr=0x0 2026-09-10T03:08:24.723 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-10T03:08:25.176 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_pt-pt.dll", hr=0x0 2026-09-10T03:08:25.364 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-10T03:08:25.442 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-10T03:08:25.535 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-10T03:08:25.660 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-10T03:08:25.723 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:25.770 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-10T03:08:25.817 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-10T03:08:26.442 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-10T03:08:26.614 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-10T03:08:26.942 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-10T03:08:26.957 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-10T03:08:27.364 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-10T03:08:27.379 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:27.832 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-10T03:08:28.301 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-10T03:08:28.723 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-10T03:08:28.848 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-10T03:08:28.926 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-10T03:08:29.004 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:29.192 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-10T03:08:29.239 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-10T03:08:29.301 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-10T03:08:29.395 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-10T03:08:30.067 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-10T03:08:30.145 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:08:30.207 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:08:31.051 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-10T03:08:31.176 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:08:31.582 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-10T03:08:31.926 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-10T03:08:32.207 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_mk.dll", hr=0x0 2026-09-10T03:08:32.288 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-10T03:08:32.305 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:32.410 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ml.dll", hr=0x0 2026-09-10T03:08:32.801 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-10T03:08:32.817 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-10T03:08:32.910 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-10T03:08:33.129 Engine:Setting original file name "ScreenMagnifier.exe" for "c:\windows\winsxs\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.20348.5256_none_16b1dbf0cadc5989\magnify.exe.mun", hr=0x0 2026-09-10T03:08:33.254 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-10T03:08:33.614 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-10T03:08:33.645 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-10T03:08:34.114 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-10T03:08:34.239 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-10T03:08:34.473 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-10T03:08:34.614 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:34.629 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-10T03:08:34.905 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-10T03:08:35.192 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-10T03:08:35.379 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-10T03:08:35.535 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-10T03:08:35.848 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-10T03:08:36.160 Engine:Setting original file name "DWriteCore" for "c:\program files (x86)\microsoft\edgecore\optimized\undocked_copilot\dwritecore.dll", hr=0x0 2026-09-10T03:08:38.114 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-10T03:08:38.739 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-10T03:08:38.973 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-10T03:08:39.308 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:39.348 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_tr.dll", hr=0x0 2026-09-10T03:08:39.692 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-10T03:08:39.926 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-10T03:08:40.223 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-10T03:08:40.661 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-10T03:08:40.805 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-10T03:08:40.905 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-10T03:08:40.926 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-10T03:08:41.145 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-10T03:08:41.707 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-10T03:08:41.739 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:41.754 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-10T03:08:41.848 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-10T03:08:41.879 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-10T03:08:42.004 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-10T03:08:42.379 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sk.dll", hr=0x0 2026-09-10T03:08:42.567 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-10T03:08:42.692 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-10T03:08:42.926 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-10T03:08:42.926 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:43.114 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-10T03:08:43.129 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-10T03:08:43.411 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-10T03:08:43.473 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:08:43.832 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-10T03:08:44.035 Engine:Setting original file name "AM_Delta_Patch_1.459.111.0.exe" for "c:\windows\softwaredistribution\download\bb3dfe565ff48304f4de3fd6652589adf5fca012", hr=0x0 2026-09-10T03:08:44.051 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_it.dll", hr=0x0 2026-09-10T03:08:44.239 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-10T03:08:44.317 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ms.dll", hr=0x0 2026-09-10T03:08:44.848 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:08:45.457 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-10T03:08:45.567 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-10T03:08:46.145 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-10T03:08:46.598 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:08:46.692 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:47.239 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-10T03:08:47.614 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-10T03:08:47.692 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-10T03:08:47.895 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-10T03:08:48.098 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-10T03:08:48.707 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-10T03:08:49.770 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-10T03:08:49.879 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-10T03:08:50.004 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-10T03:08:50.723 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-10T03:08:50.910 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-10T03:08:51.270 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-10T03:08:51.410 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-10T03:08:51.535 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-10T03:08:51.535 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-10T03:08:52.223 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_lb.dll", hr=0x0 2026-09-10T03:08:52.239 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-10T03:08:52.410 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-10T03:08:52.426 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:52.473 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-10T03:08:52.832 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-10T03:08:52.864 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_quz.dll", hr=0x0 2026-09-10T03:08:52.864 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:08:53.207 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-10T03:08:53.364 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-10T03:08:53.614 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psmachine_arm64.dll", hr=0x0 2026-09-10T03:08:53.645 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psmachine_64.dll", hr=0x0 2026-09-10T03:08:53.676 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fi.dll", hr=0x0 2026-09-10T03:08:53.770 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-10T03:08:54.379 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-10T03:08:54.535 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:08:54.785 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:55.035 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-10T03:08:55.504 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:55.598 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-10T03:08:55.895 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-10T03:08:55.973 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_id.dll", hr=0x0 2026-09-10T03:08:56.160 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-10T03:08:56.332 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:56.520 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-10T03:08:56.676 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_tt.dll", hr=0x0 2026-09-10T03:08:56.879 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-10T03:08:57.410 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-10T03:08:57.473 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-10T03:08:57.520 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-10T03:08:57.707 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:57.754 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-10T03:08:58.223 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sr-cyrl-rs.dll", hr=0x0 2026-09-10T03:08:58.239 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-10T03:08:58.457 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-10T03:08:58.598 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-10T03:08:59.989 Engine:Setting original file name "dwmcorei" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\dwmcorei.dll", hr=0x0 2026-09-10T03:09:00.008 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-10T03:09:00.067 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_et.dll", hr=0x0 2026-09-10T03:09:01.176 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-10T03:09:01.254 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-10T03:09:01.317 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-10T03:09:01.364 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-10T03:09:01.832 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-10T03:09:02.005 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-10T03:09:02.301 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-10T03:09:02.426 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-10T03:09:02.535 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-10T03:09:02.551 Engine:Setting original file name "Microsoft Cognitive Services Speech SDK" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\microsoft.cognitiveservices.speech.extension.codec.dll", hr=0x0 2026-09-10T03:09:02.676 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-10T03:09:02.770 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-10T03:09:03.020 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-10T03:09:03.098 Engine:Setting original file name "mssvp.dll" for "c:\windows\winsxs\amd64_windowssearchengine_31bf3856ad364e35_7.0.20348.5386_none_14595fad9de96e70\mssvp.dll.mun", hr=0x0 2026-09-10T03:09:03.129 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-10T03:09:03.582 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-10T03:09:03.676 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-10T03:09:03.785 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-10T03:09:03.785 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-10T03:09:03.817 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-10T03:09:03.832 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-10T03:09:04.035 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-10T03:09:04.067 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:09:04.098 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-10T03:09:04.176 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-10T03:09:04.723 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-10T03:09:04.754 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-10T03:09:05.207 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:09:05.285 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-10T03:09:05.317 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-10T03:09:05.364 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-10T03:09:06.473 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-10T03:09:06.692 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:09:06.942 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:09:06.957 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-10T03:09:07.192 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-10T03:09:07.489 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-10T03:09:07.661 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-10T03:09:07.754 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_nb.dll", hr=0x0 2026-09-10T03:09:07.770 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-10T03:09:08.770 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-10T03:09:08.801 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-10T03:09:08.989 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-10T03:09:09.020 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-10T03:09:09.035 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:09:09.676 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:09:09.676 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-10T03:09:09.895 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-10T03:09:09.910 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-10T03:09:10.129 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-10T03:09:10.864 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-10T03:09:11.332 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-10T03:09:11.645 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-10T03:09:12.129 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-10T03:09:12.442 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-10T03:09:12.520 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-10T03:09:12.785 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-10T03:09:12.832 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-10T03:09:12.942 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-10T03:09:13.082 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-10T03:09:13.192 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-10T03:09:13.192 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:09:13.504 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-10T03:09:13.629 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-10T03:09:14.020 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-10T03:09:14.176 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-10T03:09:14.364 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-10T03:09:14.395 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-10T03:09:14.520 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_nn.dll", hr=0x0 2026-09-10T03:09:14.582 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\de-de\diagpackage.dll.mui", hr=0x0 2026-09-10T03:09:14.676 OriginalFileName Maintenance::28122 files in Moac, 6 skipped (cached), 579 filename set 2026-09-10T03:09:14.676 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-10T03:13:38.098 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T03:19:58.066 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T03:19:58.066 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T03:19:58.066 [Cloud] Queued cloud request. 2026-09-10T03:19:58.066 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T03:19:58.066 [Cloud] Dequeued cloud request. 2026-09-10T03:19:58.066 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T03:19:58.238 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8D5DB69-0D9F-0404-1F08-CF64D124037A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 03:19:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T03:19:58.738 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e 2026-09-10T03:25:28.082 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7 2026-09-10T03:25:28.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T03:25:28.097 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T03:25:28.097 [Cloud] Queued cloud request. 2026-09-10T03:25:28.097 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T03:25:28.097 [Cloud] Dequeued cloud request. 2026-09-10T03:25:28.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T03:25:29.222 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-09-10T03:25:29.222 [Cloud] End of cloud request. 2026-09-10T03:25:29.738 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:28:43.097 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T03:28:46.472 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1174815, Count: 78453, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 4% 2026-09-10T03:28:46.472 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 6973, Count: 547, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T03:28:46.472 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 3260, Count: 232, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-10T03:28:46.472 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-10T03:28:46.472 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 916, Count: 25, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 53% 2026-09-10T03:28:46.472 ProcessImageName: WmiPrvSE.exe, Pid: 7860, TotalTime: 892, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 6% 2026-09-10T03:28:46.472 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 364, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-10T03:28:46.472 ProcessImageName: WmiPrvSE.exe, Pid: 1536, TotalTime: 339, Count: 11, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\spaceport.sys, EstimatedImpact: 2% 2026-09-10T03:28:46.472 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T03:28:46.472 ProcessImageName: python.exe, Pid: 8120, TotalTime: 210, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-10T03:28:46.472 ProcessImageName: powershell.exe, Pid: 1964, TotalTime: 198, Count: 21, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 1% 2026-09-10T03:28:46.472 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 165, Count: 11, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-10T03:28:46.472 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-10T03:28:46.472 ProcessImageName: taskhostw.exe, Pid: 4900, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-10T03:28:46.472 ProcessImageName: taskhostw.exe, Pid: 1316, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SECURITY, EstimatedImpact: 1% 2026-09-10T03:28:46.472 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df21-0.MAD, EstimatedImpact: 0% 2026-09-10T03:28:46.472 ProcessImageName: powershell.exe, Pid: 6000, TotalTime: 31, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDD04.tmp, EstimatedImpact: 0% 2026-09-10T03:28:46.472 ProcessImageName: ngentask.exe, Pid: 2132, TotalTime: 31, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 18% 2026-09-10T03:28:46.472 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-10T03:28:46.472 ProcessImageName: cmd.exe, Pid: 3160, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-10T03:28:46.472 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-10T03:34:40.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T03:34:40.925 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T03:34:40.925 [Cloud] Queued cloud request. 2026-09-10T03:34:40.925 [Cloud] Dequeued cloud request. 2026-09-10T03:34:40.925 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T03:34:40.925 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{D3B9CF9B-DBA0-C08E-09DB-43F32A83F1D4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 03:34:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T03:34:41.112 [Cloud] End of cloud request. 2026-09-10T03:34:41.628 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:37:20.128 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T03:37:20.128 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T03:37:20.128 [Cloud] Queued cloud request. 2026-09-10T03:37:20.128 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T03:37:20.128 [Cloud] Dequeued cloud request. 2026-09-10T03:37:20.128 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T03:37:20.284 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2290142A-4E8B-7984-E38D-0736127103B5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 03:37:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T03:37:20.784 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:38:58.081 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T03:38:58.081 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T03:38:58.081 [Cloud] Queued cloud request. 2026-09-10T03:38:58.081 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T03:38:58.081 [Cloud] Dequeued cloud request. 2026-09-10T03:38:58.081 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T03:38:58.237 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0B530784-47B6-706B-835E-8B54703DE4D3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 03:38:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T03:38:58.737 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:39:33.127 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T03:39:33.127 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T03:39:33.127 [Cloud] Queued cloud request. 2026-09-10T03:39:33.127 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T03:39:33.127 [Cloud] Dequeued cloud request. 2026-09-10T03:39:33.127 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T03:39:33.206 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D97B0201-6A8E-16E7-CC99-AAF3121556FF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 03:39:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T03:39:33.706 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:41:57.768 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T03:41:57.768 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T03:41:57.768 [Cloud] Queued cloud request. 2026-09-10T03:41:57.768 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T03:41:57.768 [Cloud] Dequeued cloud request. 2026-09-10T03:41:57.768 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T03:41:57.924 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F9AE178-8949-6ED6-173F-F39FB19C1678} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 03:41:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T03:41:58.440 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:43:48.096 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T03:47:19.721 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T03:47:19.721 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T03:47:19.721 [Cloud] Queued cloud request. 2026-09-10T03:47:19.721 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T03:47:19.721 [Cloud] Dequeued cloud request. 2026-09-10T03:47:19.721 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T03:47:19.861 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{226B7C3B-24D5-DE32-28B3-0D6B7AFB3A47} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 03:47:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T03:47:20.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:49:05.549 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T03:49:05.549 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T03:49:05.549 [Cloud] Queued cloud request. 2026-09-10T03:49:05.549 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T03:49:05.549 [Cloud] Dequeued cloud request. 2026-09-10T03:49:05.549 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T03:49:05.705 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{85A5F7AA-2658-5EED-55FF-FDE284CE997F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 03:49:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T03:49:06.205 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T03:58:53.095 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{7C5F02E7-83C3-1CDE-10BA-DD6525F0F35A} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-10-2026 04:00:06 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T04:00:07.848 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T04:00:07.848 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T04:00:07.848 [Cloud] Queued cloud request. 2026-09-10T04:00:07.848 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T04:00:07.861 [Cloud] Dequeued cloud request. 2026-09-10T04:00:07.861 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T04:00:08.001 [Cloud] End of cloud request. 2026-09-10T04:00:08.501 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T04:03:27.345 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T04:03:27.345 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T04:03:27.345 [Cloud] Queued cloud request. 2026-09-10T04:03:27.345 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T04:03:27.345 [Cloud] Dequeued cloud request. 2026-09-10T04:03:27.361 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{0D7C9849-7B55-E2D2-84D0-2555C4B138AD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 04:03:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T04:03:27.501 [Cloud] End of cloud request. 2026-09-10T04:03:28.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T04:06:03.376 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T04:06:03.376 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T04:06:03.376 [Cloud] Queued cloud request. 2026-09-10T04:06:03.376 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T04:06:03.376 [Cloud] Dequeued cloud request. 2026-09-10T04:06:03.392 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{3259109C-5B55-7134-5577-16E432EA010B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 04:06:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T04:06:03.548 [Cloud] End of cloud request. 2026-09-10T04:06:04.048 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T04:13:58.094 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T04:25:18.656 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T04:25:18.656 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T04:25:18.656 [Cloud] Queued cloud request. 2026-09-10T04:25:18.656 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T04:25:18.656 [Cloud] Dequeued cloud request. 2026-09-10T04:25:18.656 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T04:25:18.812 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{46CC965F-6E99-E6C0-31AE-27F228FC1D3B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 04:25:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T04:25:19.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T04:25:39.328 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T04:25:39.328 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T04:25:39.328 [Cloud] Queued cloud request. 2026-09-10T04:25:39.328 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T04:25:39.328 [Cloud] Dequeued cloud request. 2026-09-10T04:25:39.328 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T04:25:39.406 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F81BB589-062D-32FF-0648-94003584DF98} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 04:25:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T04:25:39.922 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T04:29:03.093 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T04:38:53.014 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T04:38:53.014 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T04:38:53.014 [Cloud] Queued cloud request. 2026-09-10T04:38:53.014 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T04:38:53.014 [Cloud] Dequeued cloud request. 2026-09-10T04:38:53.014 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T04:38:53.233 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9883AD47-D83B-2810-47E6-B83F293C286B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 04:38:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T04:38:53.749 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T04:39:13.655 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490077, FileId: 0x500000000d886, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.655 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490076, FileId: 0x500000000d887, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.671 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-3.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490082, FileId: 0x600000000d886, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.671 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-3.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490081, FileId: 0x600000000d887, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.686 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-5.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490086, FileId: 0x700000000d886, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.686 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-5.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490085, FileId: 0x700000000d887, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.702 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-7.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490090, FileId: 0x800000000d886, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.702 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-7.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490089, FileId: 0x800000000d887, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.702 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-9.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490093, FileId: 0x900000000d887, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.702 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-9.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490094, FileId: 0x900000000d886, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.718 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490098, FileId: 0xa00000000d886, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.718 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490097, FileId: 0xa00000000d887, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.718 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490102, FileId: 0xb00000000d886, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.718 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490101, FileId: 0xb00000000d887, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.733 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490106, FileId: 0xc00000000d886, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.733 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490105, FileId: 0xc00000000d887, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.749 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-11.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490109, FileId: 0xd00000000d887, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:39:13.749 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e035-11.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3490110, FileId: 0xd00000000d886, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:41:05.171 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T04:41:05.171 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T04:41:05.171 [Cloud] Queued cloud request. 2026-09-10T04:41:05.171 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T04:41:05.171 [Cloud] Dequeued cloud request. 2026-09-10T04:41:05.171 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T04:41:05.358 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9FAB96FB-84C2-7563-30AF-B9E90AAF7D45} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 04:41:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T04:41:05.874 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T04:44:08.093 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T04:53:51.467 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e041-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3496929, FileId: 0x700000000d885, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:53:51.467 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e041-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3496928, FileId: 0x2200000000d886, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T04:57:52.013 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T04:57:52.013 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T04:57:52.013 [Cloud] Queued cloud request. 2026-09-10T04:57:52.013 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T04:57:52.013 [Cloud] Dequeued cloud request. 2026-09-10T04:57:52.029 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T04:57:52.185 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D9C5EA52-05D8-A041-B40F-2830F0EB8123} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 04:57:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T04:57:52.716 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T04:59:13.091 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T05:14:18.091 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x56d96c17 2026-09-10T05:20:34.278 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpMyAdmin\tbl_changer.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x3329faf726b1 2026-09-10T05:28:46.465 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1592660, Count: 105753, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 4% 2026-09-10T05:28:46.465 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 6973, Count: 547, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T05:28:46.465 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 5537, Count: 420, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-10T05:28:46.465 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-10T05:28:46.465 ProcessImageName: taskhostw.exe, Pid: 6756, TotalTime: 999, Count: 2, MaxTime: 953, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-10T05:28:46.465 ProcessImageName: php.exe, Pid: 2952, TotalTime: 972, Count: 20, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-10T05:28:46.465 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 916, Count: 25, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 53% 2026-09-10T05:28:46.465 ProcessImageName: WmiPrvSE.exe, Pid: 7860, TotalTime: 892, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 6% 2026-09-10T05:28:46.465 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 439, Count: 31, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-10T05:28:46.465 ProcessImageName: WmiPrvSE.exe, Pid: 1536, TotalTime: 339, Count: 11, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\spaceport.sys, EstimatedImpact: 2% 2026-09-10T05:28:46.465 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T05:28:46.465 ProcessImageName: python.exe, Pid: 8120, TotalTime: 210, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-10T05:28:46.465 ProcessImageName: powershell.exe, Pid: 1964, TotalTime: 198, Count: 21, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 1% 2026-09-10T05:28:46.465 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 180, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-10T05:28:46.465 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 135, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-10T05:28:46.465 ProcessImageName: cmd.exe, Pid: 7988, TotalTime: 124, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 53% 2026-09-10T05:28:46.465 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 76, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df21-0.MAD, EstimatedImpact: 0% 2026-09-10T05:28:46.465 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-10T05:28:46.465 ProcessImageName: taskhostw.exe, Pid: 4900, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-10T05:28:46.465 ProcessImageName: taskhostw.exe, Pid: 1316, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SECURITY, EstimatedImpact: 1% 2026-09-10T05:28:46.465 ProcessImageName: powershell.exe, Pid: 6000, TotalTime: 31, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDD04.tmp, EstimatedImpact: 0% 2026-09-10T05:28:46.465 ProcessImageName: ngentask.exe, Pid: 2132, TotalTime: 31, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 18% 2026-09-10T05:28:46.465 ProcessImageName: cmd.exe, Pid: 3160, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-10T05:28:46.465 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-10T05:29:23.090 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=true, source=2, resourceid=0x4652e614 2026-09-10T05:44:28.089 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T05:44:47.542 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T05:44:47.542 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T05:44:47.542 [Cloud] Queued cloud request. 2026-09-10T05:44:47.542 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T05:44:47.542 [Cloud] Dequeued cloud request. 2026-09-10T05:44:47.542 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T05:44:47.714 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{048E1F18-E90A-B7E4-40F5-9207128F4E03} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 05:44:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T05:44:48.214 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T05:58:51.244 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T05:58:51.244 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T05:58:51.244 [Cloud] Queued cloud request. 2026-09-10T05:58:51.244 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T05:58:51.244 [Cloud] Dequeued cloud request. 2026-09-10T05:58:51.244 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T05:58:51.447 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AC9858C2-5C5F-CB3D-809F-FA89FF767C18} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 05:58:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T05:58:51.947 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T05:59:33.088 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T05:59:59.135 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T05:59:59.135 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T05:59:59.135 [Cloud] Queued cloud request. 2026-09-10T05:59:59.135 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T05:59:59.135 [Cloud] Dequeued cloud request. 2026-09-10T05:59:59.135 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T05:59:59.322 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3206837D-0A4C-1290-465D-34D1D6329789} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 05:59:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T05:59:59.838 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T06:00:35.478 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T06:00:35.478 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T06:00:35.478 [Cloud] Queued cloud request. 2026-09-10T06:00:35.478 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T06:00:35.478 [Cloud] Dequeued cloud request. 2026-09-10T06:00:35.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T06:00:35.557 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4E526382-D2D7-2AFE-2E7B-D45D66F88EE0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 06:00:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T06:00:36.057 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T06:14:38.087 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T06:17:26.290 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T06:17:26.290 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T06:17:26.290 [Cloud] Queued cloud request. 2026-09-10T06:17:26.290 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T06:17:26.290 [Cloud] Dequeued cloud request. 2026-09-10T06:17:26.290 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T06:17:26.462 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9B5C0E41-DC8C-8C20-73C1-9B3CA1E3237D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 06:17:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T06:17:26.977 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T06:29:43.086 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T06:32:17.320 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T06:32:17.320 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T06:32:17.320 [Cloud] Queued cloud request. 2026-09-10T06:32:17.320 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T06:32:17.336 [Cloud] Dequeued cloud request. 2026-09-10T06:32:17.336 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T06:32:17.727 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{80397C77-FB73-10ED-B611-2C4CAF369FDF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 06:32:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T06:32:18.242 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T06:44:48.085 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T06:50:40.694 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T06:50:40.694 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T06:50:40.694 [Cloud] Queued cloud request. 2026-09-10T06:50:40.694 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T06:50:40.694 [Cloud] Dequeued cloud request. 2026-09-10T06:50:40.694 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T06:50:40.897 [Cloud] End of cloud request. 2026-09-10T06:50:41.413 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T06:59:11.366 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T06:59:11.366 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T06:59:11.366 [Cloud] Queued cloud request. 2026-09-10T06:59:11.366 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T06:59:11.366 [Cloud] Dequeued cloud request. 2026-09-10T06:59:11.366 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T06:59:11.537 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{55C76D36-A1C5-FCA5-1A7B-7156EED01FDF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 06:59:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T06:59:12.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T06:59:53.084 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T07:05:42.943 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T07:05:42.943 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T07:05:42.943 [Cloud] Queued cloud request. 2026-09-10T07:05:42.943 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T07:05:42.943 [Cloud] Dequeued cloud request. 2026-09-10T07:05:42.943 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T07:05:43.272 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5A10DB9F-D219-BF83-381A-3B66B192C90D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 07:05:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T07:05:43.772 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T07:07:44.365 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T07:07:44.365 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T07:07:44.365 [Cloud] Queued cloud request. 2026-09-10T07:07:44.365 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T07:07:44.365 [Cloud] Dequeued cloud request. 2026-09-10T07:07:44.365 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T07:07:44.631 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{80DD3C55-0C83-E4AC-AAE2-38B8764D2A4F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 07:07:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T07:07:45.146 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T07:11:08.193 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T07:11:08.193 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T07:11:08.193 [Cloud] Queued cloud request. 2026-09-10T07:11:08.193 [Cloud] Dequeued cloud request. 2026-09-10T07:11:08.209 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T07:11:08.209 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T07:11:08.537 [Cloud] End of cloud request. 2026-09-10T07:11:09.053 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T07:14:58.084 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T07:28:46.473 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1901306, Count: 126619, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 4% 2026-09-10T07:28:46.473 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 8082, Count: 602, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-10T07:28:46.473 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 6973, Count: 547, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T07:28:46.473 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-10T07:28:46.473 ProcessImageName: taskhostw.exe, Pid: 6756, TotalTime: 999, Count: 2, MaxTime: 953, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-10T07:28:46.473 ProcessImageName: php.exe, Pid: 2952, TotalTime: 972, Count: 20, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-10T07:28:46.473 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 916, Count: 25, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 53% 2026-09-10T07:28:46.473 ProcessImageName: WmiPrvSE.exe, Pid: 7860, TotalTime: 892, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 6% 2026-09-10T07:28:46.473 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 530, Count: 37, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-10T07:28:46.473 ProcessImageName: WmiPrvSE.exe, Pid: 1536, TotalTime: 339, Count: 11, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\spaceport.sys, EstimatedImpact: 2% 2026-09-10T07:28:46.473 ProcessImageName: WmiPrvSE.exe, Pid: 7704, TotalTime: 316, Count: 32, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 24% 2026-09-10T07:28:46.473 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T07:28:46.473 ProcessImageName: python.exe, Pid: 8120, TotalTime: 210, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-10T07:28:46.473 ProcessImageName: powershell.exe, Pid: 1964, TotalTime: 198, Count: 21, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 1% 2026-09-10T07:28:46.473 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 180, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-10T07:28:46.473 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 135, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-10T07:28:46.473 ProcessImageName: cmd.exe, Pid: 7988, TotalTime: 124, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 53% 2026-09-10T07:28:46.473 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 76, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df21-0.MAD, EstimatedImpact: 0% 2026-09-10T07:28:46.473 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-10T07:28:46.473 ProcessImageName: taskhostw.exe, Pid: 4900, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-10T07:28:46.473 ProcessImageName: taskhostw.exe, Pid: 1316, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SECURITY, EstimatedImpact: 1% 2026-09-10T07:28:46.473 ProcessImageName: powershell.exe, Pid: 6000, TotalTime: 31, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDD04.tmp, EstimatedImpact: 0% 2026-09-10T07:28:46.473 ProcessImageName: ngentask.exe, Pid: 2132, TotalTime: 31, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 18% 2026-09-10T07:28:46.473 ProcessImageName: cmd.exe, Pid: 3160, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-10T07:28:46.473 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-10T07:30:03.083 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T07:39:00.254 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T07:39:00.254 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T07:39:00.254 [Cloud] Queued cloud request. 2026-09-10T07:39:00.254 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T07:39:00.254 [Cloud] Dequeued cloud request. 2026-09-10T07:39:00.254 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T07:39:01.441 [Cloud] End of cloud request. 2026-09-10T07:39:01.941 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T07:42:17.644 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T07:42:17.644 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T07:42:17.644 [Cloud] Queued cloud request. 2026-09-10T07:42:17.644 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T07:42:17.644 [Cloud] Dequeued cloud request. 2026-09-10T07:42:17.644 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T07:42:17.910 [Cloud] End of cloud request. 2026-09-10T07:42:18.410 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T07:45:08.082 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T07:51:48.159 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T07:51:48.159 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T07:51:48.159 [Cloud] Queued cloud request. 2026-09-10T07:51:48.159 [Cloud] Dequeued cloud request. 2026-09-10T07:51:48.159 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T07:51:48.175 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T07:51:48.769 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4D0DE13B-46DF-AE5B-EF7B-85A5FCF99665} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 07:51:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T07:51:49.269 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T07:55:13.238 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T07:55:13.238 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T07:55:13.238 [Cloud] Queued cloud request. 2026-09-10T07:55:13.238 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T07:55:13.238 [Cloud] Dequeued cloud request. 2026-09-10T07:55:13.238 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T07:55:13.441 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CF115206-E32B-53C9-7CD8-AB7E6A7CD3D5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 07:55:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T07:55:13.941 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T07:55:46.050 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T07:55:46.050 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T07:55:46.050 [Cloud] Queued cloud request. 2026-09-10T07:55:46.050 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T07:55:46.050 [Cloud] Dequeued cloud request. 2026-09-10T07:55:46.050 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T07:55:46.206 [Cloud] End of cloud request. 2026-09-10T07:55:46.722 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{CF6C26E8-5606-6A2F-08F1-EDEA74CF837A} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-10-2026 07:56:47 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T07:56:47.722 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T07:56:47.722 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T07:56:47.722 [Cloud] Queued cloud request. 2026-09-10T07:56:47.722 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T07:56:47.722 [Cloud] Dequeued cloud request. 2026-09-10T07:56:47.722 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T07:56:47.894 [Cloud] End of cloud request. 2026-09-10T07:56:48.394 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T07:57:46.753 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T07:57:46.753 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T07:57:46.753 [Cloud] Queued cloud request. 2026-09-10T07:57:46.753 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T07:57:46.753 [Cloud] Dequeued cloud request. 2026-09-10T07:57:46.753 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T07:57:47.034 [Cloud] End of cloud request. 2026-09-10T07:57:47.534 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T07:59:43.034 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T07:59:43.034 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T07:59:43.034 [Cloud] Queued cloud request. 2026-09-10T07:59:43.034 [Cloud] Dequeued cloud request. 2026-09-10T07:59:43.034 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T07:59:43.034 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T07:59:43.237 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B906A478-F83A-5059-A0BF-DA6E74FDCFD1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 07:59:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T07:59:43.753 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T08:00:13.081 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T08:00:24.065 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T08:00:24.065 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T08:00:24.065 [Cloud] Queued cloud request. 2026-09-10T08:00:24.065 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T08:00:24.081 [Cloud] Dequeued cloud request. 2026-09-10T08:00:24.081 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T08:00:24.175 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{606E963D-2D2A-272E-BD3F-C90280E22A6C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 08:00:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T08:00:24.690 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T08:15:18.080 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T08:30:23.079 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T08:40:22.391 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T08:40:22.391 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T08:40:22.391 [Cloud] Queued cloud request. 2026-09-10T08:40:22.391 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T08:40:22.548 [Cloud] Dequeued cloud request. 2026-09-10T08:40:22.720 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T08:40:22.891 [Cloud] End of cloud request. 2026-09-10T08:40:23.391 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T08:45:28.079 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T08:55:06.469 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T08:55:06.469 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T08:55:06.469 [Cloud] Queued cloud request. 2026-09-10T08:55:06.469 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T08:55:06.641 [Cloud] Dequeued cloud request. 2026-09-10T08:55:06.797 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T08:55:07.172 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CB87E413-2A90-7B7D-4A81-11029770847B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 08:55:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T08:55:07.688 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T09:00:33.078 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T09:01:51.078 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T09:01:51.078 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T09:01:51.078 [Cloud] Queued cloud request. 2026-09-10T09:01:51.078 [Cloud] Dequeued cloud request. 2026-09-10T09:01:51.078 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T09:01:51.078 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{1AE80502-6F52-48AF-DC80-1244B3828723} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 09:01:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T09:01:51.516 [Cloud] End of cloud request. 2026-09-10T09:01:52.016 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T09:03:37.484 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T09:03:37.484 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T09:03:37.484 [Cloud] Queued cloud request. 2026-09-10T09:03:37.484 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T09:03:37.484 [Cloud] Dequeued cloud request. 2026-09-10T09:03:37.484 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{2432A63F-1914-1C99-5C41-F0BE2600BC50} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 09:03:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T09:03:37.719 [Cloud] End of cloud request. 2026-09-10T09:03:38.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T09:06:35.687 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T09:06:35.687 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T09:06:35.687 [Cloud] Queued cloud request. 2026-09-10T09:06:35.687 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T09:06:35.859 [Cloud] Dequeued cloud request. 2026-09-10T09:06:35.859 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T09:06:36.078 [Cloud] End of cloud request. 2026-09-10T09:06:36.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T09:15:38.078 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T09:23:50.811 Bm signature throttled:0x000135b39c9104ce 2026-09-10T09:28:46.483 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2232591, Count: 150541, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 4% 2026-09-10T09:28:46.483 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 10567, Count: 780, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-10T09:28:46.483 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 6973, Count: 547, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T09:28:46.483 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-10T09:28:46.483 ProcessImageName: taskhostw.exe, Pid: 6756, TotalTime: 999, Count: 2, MaxTime: 953, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-10T09:28:46.483 ProcessImageName: php.exe, Pid: 2952, TotalTime: 972, Count: 20, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-10T09:28:46.483 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 916, Count: 25, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 53% 2026-09-10T09:28:46.483 ProcessImageName: WmiPrvSE.exe, Pid: 7860, TotalTime: 892, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 6% 2026-09-10T09:28:46.483 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 590, Count: 41, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-10T09:28:46.483 ProcessImageName: WmiPrvSE.exe, Pid: 1536, TotalTime: 339, Count: 11, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\spaceport.sys, EstimatedImpact: 2% 2026-09-10T09:28:46.483 ProcessImageName: WmiPrvSE.exe, Pid: 7704, TotalTime: 316, Count: 32, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 24% 2026-09-10T09:28:46.483 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T09:28:46.483 ProcessImageName: python.exe, Pid: 8120, TotalTime: 210, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-10T09:28:46.483 ProcessImageName: powershell.exe, Pid: 1964, TotalTime: 198, Count: 21, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 1% 2026-09-10T09:28:46.483 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-10T09:28:46.483 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 135, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-10T09:28:46.483 ProcessImageName: cmd.exe, Pid: 7988, TotalTime: 124, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 53% 2026-09-10T09:28:46.483 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 76, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df21-0.MAD, EstimatedImpact: 0% 2026-09-10T09:28:46.483 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-10T09:28:46.483 ProcessImageName: taskhostw.exe, Pid: 4900, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-10T09:28:46.483 ProcessImageName: taskhostw.exe, Pid: 1316, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SECURITY, EstimatedImpact: 1% 2026-09-10T09:28:46.483 ProcessImageName: powershell.exe, Pid: 6000, TotalTime: 31, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDD04.tmp, EstimatedImpact: 0% 2026-09-10T09:28:46.483 ProcessImageName: ngentask.exe, Pid: 2132, TotalTime: 31, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 18% 2026-09-10T09:28:46.483 ProcessImageName: cmd.exe, Pid: 3160, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-10T09:28:46.483 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-10T09:30:43.077 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T09:32:27.280 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T09:32:27.280 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T09:32:27.280 [Cloud] Queued cloud request. 2026-09-10T09:32:27.280 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T09:32:27.483 [Cloud] Dequeued cloud request. 2026-09-10T09:32:27.483 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T09:32:27.702 [Cloud] End of cloud request. 2026-09-10T09:32:28.233 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T09:37:14.404 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T09:37:14.404 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T09:37:14.404 [Cloud] Queued cloud request. 2026-09-10T09:37:14.404 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T09:37:14.404 [Cloud] Dequeued cloud request. 2026-09-10T09:37:14.404 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T09:37:14.608 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E1D13322-D5DA-0F62-09A9-D80A98FF8E93} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 09:37:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T09:37:15.108 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T09:39:39.373 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T09:39:39.373 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T09:39:39.389 [Cloud] Queued cloud request. 2026-09-10T09:39:39.389 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T09:39:39.389 [Cloud] Dequeued cloud request. 2026-09-10T09:39:39.389 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{D25F8C86-C301-1C35-F6C4-C384752A9B11} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 09:39:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T09:39:39.576 [Cloud] End of cloud request. 2026-09-10T09:39:40.123 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T09:45:48.076 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T10:00:53.075 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T10:03:24.279 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T10:03:24.279 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T10:03:24.279 [Cloud] Queued cloud request. 2026-09-10T10:03:24.279 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T10:03:24.279 [Cloud] Dequeued cloud request. 2026-09-10T10:03:24.279 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T10:03:24.435 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DDE8DBA3-335B-E978-8A68-6A72712F0DE9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 10:03:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T10:03:24.950 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T10:07:07.919 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T10:07:07.919 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T10:07:07.919 [Cloud] Queued cloud request. 2026-09-10T10:07:07.919 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T10:07:07.919 [Cloud] Dequeued cloud request. 2026-09-10T10:07:07.919 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T10:07:08.106 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D60F90A1-6E27-77A0-D808-3A49896F3F1D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 10:07:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T10:07:08.622 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T10:15:58.075 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T10:21:00.825 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T10:21:00.825 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T10:21:00.825 [Cloud] Queued cloud request. 2026-09-10T10:21:00.825 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T10:21:00.825 [Cloud] Dequeued cloud request. 2026-09-10T10:21:00.825 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T10:21:00.981 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9777C8D3-31C2-62BC-4E59-328BFF78ADEF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 10:21:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T10:21:01.496 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T10:23:58.184 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T10:23:58.184 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T10:23:58.184 [Cloud] Queued cloud request. 2026-09-10T10:23:58.184 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T10:23:58.184 [Cloud] Dequeued cloud request. 2026-09-10T10:23:58.184 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T10:23:58.340 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BA8B260C-B065-FED6-0CA4-761C1978102C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 10:23:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T10:23:58.856 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T10:25:49.465 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T10:25:49.465 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T10:25:49.465 [Cloud] Queued cloud request. 2026-09-10T10:25:49.465 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T10:25:49.465 [Cloud] Dequeued cloud request. 2026-09-10T10:25:49.465 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T10:25:49.871 [Cloud] End of cloud request. 2026-09-10T10:25:50.387 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T10:31:03.074 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T10:46:08.073 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T10:49:18.683 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T10:49:18.683 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T10:49:18.683 [Cloud] Queued cloud request. 2026-09-10T10:49:18.683 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T10:49:18.854 [Cloud] Dequeued cloud request. 2026-09-10T10:49:18.854 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T10:49:19.042 [Cloud] End of cloud request. 2026-09-10T10:49:19.542 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T10:54:21.495 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T10:54:21.495 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T10:54:21.495 [Cloud] Queued cloud request. 2026-09-10T10:54:21.495 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T10:54:21.495 [Cloud] Dequeued cloud request. 2026-09-10T10:54:21.495 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T10:54:21.698 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{953E6E45-0448-D12C-A30A-F99EE0431BB7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 10:54:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T10:54:22.214 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T10:56:05.839 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e1ca-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3666104, FileId: 0x600000000dc87, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T10:56:05.839 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-e1ca-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3666103, FileId: 0x400000000dd10, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T11:00:33.026 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T11:00:33.026 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T11:00:33.026 [Cloud] Queued cloud request. 2026-09-10T11:00:33.026 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T11:00:33.042 [Cloud] Dequeued cloud request. 2026-09-10T11:00:33.042 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T11:00:33.370 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3BE072FB-A7AE-A00A-CDC5-A34D2B3E639C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 11:00:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T11:00:33.885 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T11:01:13.073 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T11:03:09.620 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T11:03:09.620 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T11:03:09.620 [Cloud] Queued cloud request. 2026-09-10T11:03:09.620 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T11:03:09.620 [Cloud] Dequeued cloud request. 2026-09-10T11:03:09.620 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T11:03:09.823 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{91E4FE3C-804F-A2E9-C2C2-316A8EDCA8F1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 11:03:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T11:03:10.323 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T11:16:18.072 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T11:20:42.806 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T11:20:42.822 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T11:20:42.822 [Cloud] Queued cloud request. 2026-09-10T11:20:42.822 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T11:20:42.822 [Cloud] Dequeued cloud request. 2026-09-10T11:20:42.822 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T11:20:43.025 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8812E556-39DF-C7FA-F1D9-EF65FE4F48B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 11:20:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T11:20:43.525 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T11:23:07.353 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T11:23:07.353 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T11:23:07.353 [Cloud] Queued cloud request. 2026-09-10T11:23:07.353 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T11:23:07.353 [Cloud] Dequeued cloud request. 2026-09-10T11:23:07.353 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T11:23:07.558 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FE745307-E95D-E2AD-11B1-E22B87BAF923} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 11:23:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T11:23:08.072 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T11:28:46.478 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2528189, Count: 172980, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 4% 2026-09-10T11:28:46.478 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 12800, Count: 960, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-10T11:28:46.478 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 6973, Count: 547, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T11:28:46.478 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-10T11:28:46.478 ProcessImageName: taskhostw.exe, Pid: 6756, TotalTime: 999, Count: 2, MaxTime: 953, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-10T11:28:46.478 ProcessImageName: php.exe, Pid: 2952, TotalTime: 972, Count: 20, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-10T11:28:46.478 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 916, Count: 25, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 53% 2026-09-10T11:28:46.478 ProcessImageName: WmiPrvSE.exe, Pid: 7860, TotalTime: 892, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 6% 2026-09-10T11:28:46.478 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 605, Count: 43, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-10T11:28:46.478 ProcessImageName: WmiPrvSE.exe, Pid: 1536, TotalTime: 339, Count: 11, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\spaceport.sys, EstimatedImpact: 2% 2026-09-10T11:28:46.478 ProcessImageName: WmiPrvSE.exe, Pid: 7704, TotalTime: 316, Count: 32, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 24% 2026-09-10T11:28:46.478 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T11:28:46.478 ProcessImageName: powershell.exe, Pid: 6260, TotalTime: 232, Count: 20, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 19% 2026-09-10T11:28:46.478 ProcessImageName: python.exe, Pid: 1116, TotalTime: 228, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 3% 2026-09-10T11:28:46.478 ProcessImageName: python.exe, Pid: 8120, TotalTime: 210, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-10T11:28:46.478 ProcessImageName: powershell.exe, Pid: 1964, TotalTime: 198, Count: 21, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 1% 2026-09-10T11:28:46.478 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-10T11:28:46.478 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 165, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-10T11:28:46.478 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 139, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-10T11:28:46.478 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 78, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df21-0.MAD, EstimatedImpact: 0% 2026-09-10T11:28:46.478 ProcessImageName: cmd.exe, Pid: 7988, TotalTime: 124, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 53% 2026-09-10T11:28:46.478 ProcessImageName: taskhostw.exe, Pid: 4900, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-10T11:28:46.478 ProcessImageName: taskhostw.exe, Pid: 1316, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SECURITY, EstimatedImpact: 1% 2026-09-10T11:28:46.478 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 60, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\72420E9ADB46416B9EF304660C42BEB5.MAI, EstimatedImpact: 0% 2026-09-10T11:28:46.478 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\3A28BFA8E34D45199DFDBEB3624EFA02.MAI, EstimatedImpact: 32% 2026-09-10T11:28:46.478 ProcessImageName: powershell.exe, Pid: 6000, TotalTime: 31, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDD04.tmp, EstimatedImpact: 0% 2026-09-10T11:28:46.478 ProcessImageName: ngentask.exe, Pid: 2132, TotalTime: 31, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 18% 2026-09-10T11:28:46.478 ProcessImageName: cmd.exe, Pid: 3160, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-10T11:28:46.478 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-10T11:29:23.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T11:29:23.337 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T11:29:23.337 [Cloud] Queued cloud request. 2026-09-10T11:29:23.337 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T11:29:23.337 [Cloud] Dequeued cloud request. 2026-09-10T11:29:23.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T11:29:33.478 [Cloud] End of cloud request. 2026-09-10T11:29:33.978 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T11:31:21.947 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T11:31:21.947 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T11:31:21.947 [Cloud] Queued cloud request. 2026-09-10T11:31:21.947 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T11:31:21.947 [Cloud] Dequeued cloud request. 2026-09-10T11:31:21.947 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T11:31:22.134 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3F658744-4539-BD59-70FF-7B6373AE062F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 11:31:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T11:31:22.634 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T11:31:23.072 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T11:46:28.071 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T11:46:30.665 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T11:46:30.665 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T11:46:30.665 [Cloud] Queued cloud request. 2026-09-10T11:46:30.665 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T11:46:30.665 [Cloud] Dequeued cloud request. 2026-09-10T11:46:30.665 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T11:46:30.868 [Cloud] End of cloud request. 2026-09-10T11:46:31.368 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{D82A6E22-ADD9-780C-177C-FE67453DB6A1} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-10-2026 11:48:49 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T11:48:50.477 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T11:48:50.477 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T11:48:50.477 [Cloud] Queued cloud request. 2026-09-10T11:48:50.477 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T11:48:50.477 [Cloud] Dequeued cloud request. 2026-09-10T11:48:50.477 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T11:48:50.821 [Cloud] End of cloud request. 2026-09-10T11:48:51.336 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T11:52:54.696 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T11:52:54.696 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T11:52:54.696 [Cloud] Queued cloud request. 2026-09-10T11:52:54.696 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T11:52:54.696 [Cloud] Dequeued cloud request. 2026-09-10T11:52:54.696 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T11:52:54.899 [Cloud] End of cloud request. 2026-09-10T11:52:55.399 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T11:56:18.305 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T11:56:18.305 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T11:56:18.305 [Cloud] Queued cloud request. 2026-09-10T11:56:18.305 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T11:56:18.305 [Cloud] Dequeued cloud request. 2026-09-10T11:56:18.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T11:56:18.508 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DB477726-0734-4F09-7FEB-63181EA9D543} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 11:56:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T11:56:19.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T11:57:28.867 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T11:57:28.867 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T11:57:28.867 [Cloud] Queued cloud request. 2026-09-10T11:57:28.867 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T11:57:28.867 [Cloud] Dequeued cloud request. 2026-09-10T11:57:28.867 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T11:57:29.071 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FA5F9588-9987-DC7D-A3F3-39A01810C754} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 11:57:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T11:57:29.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T12:01:33.071 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T12:04:01.899 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T12:04:01.899 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T12:04:01.899 [Cloud] Queued cloud request. 2026-09-10T12:04:01.899 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T12:04:01.899 [Cloud] Dequeued cloud request. 2026-09-10T12:04:01.899 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T12:04:02.086 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{932029AE-6E5B-1362-6D71-BF2068FAB1A4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 12:04:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T12:04:02.602 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T12:16:32.398 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T12:16:32.398 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T12:16:32.398 [Cloud] Queued cloud request. 2026-09-10T12:16:32.398 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T12:16:32.398 [Cloud] Dequeued cloud request. 2026-09-10T12:16:32.414 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T12:16:32.570 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AB3EF847-785E-32A9-CDB0-F8145F919F2D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 12:16:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T12:16:33.070 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T12:16:38.070 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x4652e614 2026-09-10T12:17:35.210 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpmyserver\help.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x3329faf726b1 2026-09-10T12:25:55.429 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T12:25:55.429 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T12:25:55.429 [Cloud] Queued cloud request. 2026-09-10T12:25:55.429 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T12:25:55.445 [Cloud] Dequeued cloud request. 2026-09-10T12:25:55.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{0428C0A4-0940-0D89-4063-0F7F723490F6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 12:25:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T12:25:55.585 [Cloud] End of cloud request. 2026-09-10T12:25:56.085 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T12:30:41.475 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T12:30:41.475 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T12:30:41.475 [Cloud] Queued cloud request. 2026-09-10T12:30:41.475 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T12:30:41.475 [Cloud] Dequeued cloud request. 2026-09-10T12:30:41.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T12:30:41.710 [Cloud] End of cloud request. 2026-09-10T12:30:42.210 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T12:31:43.069 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T12:33:41.804 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T12:33:41.804 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T12:33:41.804 [Cloud] Queued cloud request. 2026-09-10T12:33:41.804 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T12:33:41.804 [Cloud] Dequeued cloud request. 2026-09-10T12:33:41.804 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T12:33:42.007 [Cloud] End of cloud request. 2026-09-10T12:33:42.522 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T12:46:48.069 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T12:48:42.397 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T12:48:42.397 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T12:48:42.397 [Cloud] Queued cloud request. 2026-09-10T12:48:42.397 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T12:48:42.397 [Cloud] Dequeued cloud request. 2026-09-10T12:48:42.397 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T12:48:42.678 [Cloud] End of cloud request. 2026-09-10T12:48:43.178 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T12:56:56.881 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T12:56:56.881 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T12:56:56.881 [Cloud] Queued cloud request. 2026-09-10T12:56:56.881 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T12:56:56.881 [Cloud] Dequeued cloud request. 2026-09-10T12:56:56.881 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T12:56:57.131 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7096D4D3-B70A-F865-EE84-A34A55DC7244} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 12:56:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T12:56:57.647 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T12:59:06.615 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T12:59:06.615 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T12:59:06.615 [Cloud] Queued cloud request. 2026-09-10T12:59:06.615 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T12:59:06.615 [Cloud] Dequeued cloud request. 2026-09-10T12:59:06.615 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T12:59:06.834 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{47024C5B-3897-4AE0-8938-6749EC7D5731} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 12:59:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T12:59:07.350 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:01:53.068 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T13:02:32.084 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:02:32.084 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:02:32.084 [Cloud] Queued cloud request. 2026-09-10T13:02:32.084 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:02:32.084 [Cloud] Dequeued cloud request. 2026-09-10T13:02:32.099 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:02:34.178 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D4D7BF78-010D-9D34-5BDF-389E152BBF71} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:02:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:02:34.693 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:07:18.709 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:07:18.709 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:07:18.709 [Cloud] Queued cloud request. 2026-09-10T13:07:18.709 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:07:18.709 [Cloud] Dequeued cloud request. 2026-09-10T13:07:18.709 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:07:18.943 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{736CD145-7ADE-0570-4242-1C395015DA93} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:07:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:07:19.443 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:08:16.146 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:08:16.146 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:08:16.146 [Cloud] Queued cloud request. 2026-09-10T13:08:16.146 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:08:16.146 [Cloud] Dequeued cloud request. 2026-09-10T13:08:16.146 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:08:17.037 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CE5E4B23-2E7C-6063-86C4-A4DEC0ED2533} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:08:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:08:17.552 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:12:18.646 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:12:18.646 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:12:18.646 [Cloud] Queued cloud request. 2026-09-10T13:12:18.646 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:12:18.646 [Cloud] Dequeued cloud request. 2026-09-10T13:12:18.646 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:12:18.849 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C3377095-56F5-02E6-F699-E8D93B9B091F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:12:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:12:19.349 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:16:58.065 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T13:17:12.534 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:17:12.534 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:17:12.534 [Cloud] Queued cloud request. 2026-09-10T13:17:12.534 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:17:12.534 [Cloud] Dequeued cloud request. 2026-09-10T13:17:12.534 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:17:12.690 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{879116D9-C328-F6BC-815F-5A7B8BE729F2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:17:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:17:13.206 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:20:41.956 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:20:41.956 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:20:41.956 [Cloud] Queued cloud request. 2026-09-10T13:20:41.956 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:20:41.956 [Cloud] Dequeued cloud request. 2026-09-10T13:20:41.956 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:20:42.315 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6995F96D-30A5-382A-D9F6-37AA85CD9B47} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:20:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:20:42.815 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:20:45.096 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:20:45.096 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:20:45.096 [Cloud] Queued cloud request. 2026-09-10T13:20:45.096 [Cloud] Dequeued cloud request. 2026-09-10T13:20:45.096 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:20:45.096 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:20:45.175 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{640F21B6-CF2F-CB02-529E-3C5CBEA71539} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:20:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:20:45.675 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:23:20.143 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:23:20.143 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:23:20.143 [Cloud] Queued cloud request. 2026-09-10T13:23:20.143 [Cloud] Dequeued cloud request. 2026-09-10T13:23:20.143 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:23:20.143 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:23:20.378 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{377497BA-2EB9-31DE-FEF2-FF383867D33F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:23:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:23:20.893 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:28:46.487 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2640852, Count: 182475, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 4% 2026-09-10T13:28:46.487 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 15441, Count: 1128, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-10T13:28:46.487 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 6973, Count: 547, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T13:28:46.487 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-10T13:28:46.487 ProcessImageName: taskhostw.exe, Pid: 6756, TotalTime: 999, Count: 2, MaxTime: 953, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-10T13:28:46.487 ProcessImageName: php.exe, Pid: 2952, TotalTime: 972, Count: 20, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-10T13:28:46.487 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 916, Count: 25, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 53% 2026-09-10T13:28:46.487 ProcessImageName: WmiPrvSE.exe, Pid: 7860, TotalTime: 892, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 6% 2026-09-10T13:28:46.487 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 665, Count: 47, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-10T13:28:46.487 ProcessImageName: WmiPrvSE.exe, Pid: 1536, TotalTime: 339, Count: 11, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\spaceport.sys, EstimatedImpact: 2% 2026-09-10T13:28:46.487 ProcessImageName: WmiPrvSE.exe, Pid: 7704, TotalTime: 316, Count: 32, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 24% 2026-09-10T13:28:46.487 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T13:28:46.487 ProcessImageName: powershell.exe, Pid: 6260, TotalTime: 232, Count: 20, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 19% 2026-09-10T13:28:46.487 ProcessImageName: python.exe, Pid: 1116, TotalTime: 228, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 3% 2026-09-10T13:28:46.487 ProcessImageName: python.exe, Pid: 8120, TotalTime: 210, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-10T13:28:46.487 ProcessImageName: powershell.exe, Pid: 1964, TotalTime: 198, Count: 21, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 1% 2026-09-10T13:28:46.487 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-10T13:28:46.487 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 165, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-10T13:28:46.487 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 139, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-10T13:28:46.487 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 78, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df21-0.MAD, EstimatedImpact: 0% 2026-09-10T13:28:46.487 ProcessImageName: cmd.exe, Pid: 7988, TotalTime: 124, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 53% 2026-09-10T13:28:46.487 ProcessImageName: upfc.exe, Pid: 7792, TotalTime: 107, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\20bbcadaff3e0543ef358ba4dd8b74bfe8e747c8.xml->(UTF-16LE), EstimatedImpact: 76% 2026-09-10T13:28:46.487 ProcessImageName: taskhostw.exe, Pid: 4900, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-10T13:28:46.487 ProcessImageName: taskhostw.exe, Pid: 1316, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SECURITY, EstimatedImpact: 1% 2026-09-10T13:28:46.487 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 60, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\72420E9ADB46416B9EF304660C42BEB5.MAI, EstimatedImpact: 0% 2026-09-10T13:28:46.487 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\3A28BFA8E34D45199DFDBEB3624EFA02.MAI, EstimatedImpact: 32% 2026-09-10T13:28:46.487 ProcessImageName: powershell.exe, Pid: 6000, TotalTime: 31, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDD04.tmp, EstimatedImpact: 0% 2026-09-10T13:28:46.487 ProcessImageName: ngentask.exe, Pid: 2132, TotalTime: 31, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 18% 2026-09-10T13:28:46.487 ProcessImageName: cmd.exe, Pid: 3160, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-10T13:28:46.487 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-10T13:30:34.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:30:34.643 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:30:34.643 [Cloud] Queued cloud request. 2026-09-10T13:30:34.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:30:34.643 [Cloud] Dequeued cloud request. 2026-09-10T13:30:34.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:30:34.815 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4DC2709C-1633-FC76-1607-1B21DFD178C9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:30:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:30:35.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:32:03.065 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T13:33:35.940 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:33:35.940 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:33:35.940 [Cloud] Queued cloud request. 2026-09-10T13:33:35.940 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:33:35.940 [Cloud] Dequeued cloud request. 2026-09-10T13:33:35.940 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:33:36.096 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{224EC137-070C-96A4-7FD0-858CD9D11C87} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:33:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:33:36.628 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:36:58.674 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:36:58.674 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:36:58.674 [Cloud] Queued cloud request. 2026-09-10T13:36:58.674 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:36:58.690 [Cloud] Dequeued cloud request. 2026-09-10T13:36:58.690 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:37:08.502 [Cloud] End of cloud request. 2026-09-10T13:37:09.018 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:37:47.439 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:37:47.439 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:37:47.439 [Cloud] Queued cloud request. 2026-09-10T13:37:47.439 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:37:47.439 [Cloud] Dequeued cloud request. 2026-09-10T13:37:47.439 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:37:47.533 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F90C0B9-4984-F175-9CE7-8229D4CBEDBC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:37:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:37:48.033 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:42:20.689 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:42:20.689 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:42:20.689 [Cloud] Queued cloud request. 2026-09-10T13:42:20.689 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:42:20.689 [Cloud] Dequeued cloud request. 2026-09-10T13:42:20.689 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:42:20.861 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F8EFA6F4-C6DD-0DC8-5C5C-8F67C1F0D8CE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:42:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:42:21.361 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:47:08.064 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T13:49:23.564 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:49:23.564 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:49:23.564 [Cloud] Queued cloud request. 2026-09-10T13:49:23.564 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:49:23.564 [Cloud] Dequeued cloud request. 2026-09-10T13:49:23.564 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:49:23.720 [Cloud] End of cloud request. 2026-09-10T13:49:23.720 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:49:23.720 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:49:23.720 [Cloud] Queued cloud request. 2026-09-10T13:49:23.720 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:49:23.720 [Cloud] Dequeued cloud request. 2026-09-10T13:49:23.720 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:49:23.892 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D51A35ED-D219-2149-6FC3-6B374A8D3459} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:49:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry BEGIN BM telemetry GUID:{3ED77A7A-63F3-622B-6262-552677EFAB64} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:49:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:49:24.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:54:47.439 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:54:47.439 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:54:47.439 [Cloud] Queued cloud request. 2026-09-10T13:54:47.439 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:54:47.439 [Cloud] Dequeued cloud request. 2026-09-10T13:54:47.439 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:54:47.642 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{28CB4556-178F-EA8A-42CC-D1CE2819316B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:54:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:54:48.142 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:56:02.970 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:56:02.970 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:56:02.970 [Cloud] Queued cloud request. 2026-09-10T13:56:02.970 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:56:02.970 [Cloud] Dequeued cloud request. 2026-09-10T13:56:02.970 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:56:03.173 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{36D6BF0A-A922-01B6-A65D-7844AEF19C42} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 13:56:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T13:56:03.673 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T13:59:31.189 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T13:59:31.189 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T13:59:31.189 [Cloud] Queued cloud request. 2026-09-10T13:59:31.189 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T13:59:31.189 [Cloud] Dequeued cloud request. 2026-09-10T13:59:31.189 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T13:59:31.392 [Cloud] End of cloud request. 2026-09-10T13:59:31.908 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:01:31.595 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:01:31.595 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:01:31.595 [Cloud] Queued cloud request. 2026-09-10T14:01:31.595 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:01:31.595 [Cloud] Dequeued cloud request. 2026-09-10T14:01:31.595 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:01:31.892 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{620107DE-55AC-7C65-0432-AE212EC6404A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 14:01:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T14:01:32.408 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:02:13.064 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T14:03:32.486 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:03:32.486 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:03:32.486 [Cloud] Queued cloud request. 2026-09-10T14:03:32.486 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:03:32.486 [Cloud] Dequeued cloud request. 2026-09-10T14:03:32.501 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:03:32.720 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1991441A-1AB9-27C3-185F-6E2FEDDD842A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 14:03:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T14:03:33.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:03:34.783 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:03:34.783 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:03:34.783 [Cloud] Queued cloud request. 2026-09-10T14:03:34.783 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:03:34.783 [Cloud] Dequeued cloud request. 2026-09-10T14:03:34.783 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:03:34.892 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{99202824-57EA-3B46-9D96-653AC57D0AAE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 14:03:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T14:03:35.392 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:03:53.954 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:03:53.954 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:03:53.954 [Cloud] Queued cloud request. 2026-09-10T14:03:53.954 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:03:53.970 [Cloud] Dequeued cloud request. 2026-09-10T14:03:53.970 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:03:54.048 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0B1CEF58-BF83-A320-15C3-262BDB0EAA36} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 14:03:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T14:03:54.548 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:09:44.985 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:09:44.985 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:09:44.985 [Cloud] Queued cloud request. 2026-09-10T14:09:44.985 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:09:44.985 [Cloud] Dequeued cloud request. 2026-09-10T14:09:44.985 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:09:45.173 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{53CB365C-114A-6766-BF70-3700120CFB24} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 14:09:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T14:09:45.689 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:17:18.063 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T14:23:58.860 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:23:58.860 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:23:58.860 [Cloud] Queued cloud request. 2026-09-10T14:23:58.860 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:23:59.016 [Cloud] Dequeued cloud request. 2026-09-10T14:23:59.016 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:23:59.235 [Cloud] End of cloud request. 2026-09-10T14:23:59.751 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:24:54.454 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:24:54.454 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:24:54.454 [Cloud] Queued cloud request. 2026-09-10T14:24:54.454 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:24:54.454 [Cloud] Dequeued cloud request. 2026-09-10T14:24:54.454 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:24:54.547 [Cloud] End of cloud request. 2026-09-10T14:24:55.047 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:25:09.719 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:25:09.719 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:25:09.719 [Cloud] Queued cloud request. 2026-09-10T14:25:09.719 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:25:09.735 [Cloud] Dequeued cloud request. 2026-09-10T14:25:09.735 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:25:09.844 [Cloud] End of cloud request. 2026-09-10T14:25:10.344 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:26:59.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:26:59.672 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:26:59.672 [Cloud] Queued cloud request. 2026-09-10T14:26:59.672 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:26:59.672 [Cloud] Dequeued cloud request. 2026-09-10T14:26:59.672 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:26:59.876 [Cloud] End of cloud request. 2026-09-10T14:27:00.391 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:27:37.329 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:27:37.329 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:27:37.329 [Cloud] Queued cloud request. 2026-09-10T14:27:37.329 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:27:37.329 [Cloud] Dequeued cloud request. 2026-09-10T14:27:37.329 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:27:37.407 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C13E5B2A-F82E-C96F-946B-38FA428E9E84} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 14:27:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T14:27:37.907 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:32:23.063 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T14:37:09.188 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:37:09.188 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:37:09.188 [Cloud] Queued cloud request. 2026-09-10T14:37:09.188 [Cloud] Dequeued cloud request. 2026-09-10T14:37:09.188 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:37:09.360 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:37:09.500 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DA8624C2-5C3F-6E3B-13FA-B828E7790B04} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 14:37:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T14:37:10.000 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:40:48.453 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:40:48.453 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:40:48.453 [Cloud] Queued cloud request. 2026-09-10T14:40:48.453 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:40:48.453 [Cloud] Dequeued cloud request. 2026-09-10T14:40:48.453 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:40:48.703 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ED431605-10BE-F720-93F0-561438314A57} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 14:40:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T14:40:49.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:42:24.641 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T14:42:24.641 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T14:42:24.641 [Cloud] Queued cloud request. 2026-09-10T14:42:24.641 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T14:42:24.641 [Cloud] Dequeued cloud request. 2026-09-10T14:42:24.641 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T14:42:24.797 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{44622988-A1AA-5EF3-BD7B-8C2F850D0FBB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 14:42:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T14:42:25.313 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T14:47:28.062 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T15:02:33.062 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T15:02:47.062 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T15:02:47.062 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T15:02:47.062 [Cloud] Queued cloud request. 2026-09-10T15:02:47.062 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T15:02:47.078 [Cloud] Dequeued cloud request. 2026-09-10T15:02:47.078 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T15:02:47.484 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AC6BA960-5EE0-5C33-2C62-064AE7E72EFD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 15:02:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T15:02:47.984 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T15:13:29.499 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T15:13:29.499 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T15:13:29.499 [Cloud] Queued cloud request. 2026-09-10T15:13:29.499 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T15:13:29.499 [Cloud] Dequeued cloud request. 2026-09-10T15:13:29.499 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T15:13:29.655 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{526B2D01-BD93-24E6-92DA-7CB146C39204} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 15:13:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T15:13:30.155 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T15:17:38.061 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T15:28:46.483 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2713814, Count: 188975, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 3% 2026-09-10T15:28:46.483 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 18353, Count: 1294, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-10T15:28:46.483 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 6973, Count: 547, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T15:28:46.483 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-10T15:28:46.483 ProcessImageName: taskhostw.exe, Pid: 6756, TotalTime: 999, Count: 2, MaxTime: 953, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-10T15:28:46.483 ProcessImageName: php.exe, Pid: 2952, TotalTime: 972, Count: 20, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-10T15:28:46.483 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 916, Count: 25, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 53% 2026-09-10T15:28:46.483 ProcessImageName: WmiPrvSE.exe, Pid: 7860, TotalTime: 892, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 6% 2026-09-10T15:28:46.483 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 696, Count: 49, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-10T15:28:46.483 ProcessImageName: WmiPrvSE.exe, Pid: 1536, TotalTime: 339, Count: 11, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\spaceport.sys, EstimatedImpact: 2% 2026-09-10T15:28:46.483 ProcessImageName: WmiPrvSE.exe, Pid: 7704, TotalTime: 316, Count: 32, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 24% 2026-09-10T15:28:46.483 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T15:28:46.483 ProcessImageName: powershell.exe, Pid: 6260, TotalTime: 232, Count: 20, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 19% 2026-09-10T15:28:46.483 ProcessImageName: python.exe, Pid: 1116, TotalTime: 228, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 3% 2026-09-10T15:28:46.483 ProcessImageName: python.exe, Pid: 8120, TotalTime: 210, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-10T15:28:46.483 ProcessImageName: powershell.exe, Pid: 1964, TotalTime: 198, Count: 21, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 1% 2026-09-10T15:28:46.483 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-10T15:28:46.483 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 165, Count: 80, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df21-0.MAD, EstimatedImpact: 0% 2026-09-10T15:28:46.483 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 165, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-10T15:28:46.483 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 139, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-10T15:28:46.483 ProcessImageName: cmd.exe, Pid: 7988, TotalTime: 124, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 53% 2026-09-10T15:28:46.483 ProcessImageName: upfc.exe, Pid: 7792, TotalTime: 107, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\20bbcadaff3e0543ef358ba4dd8b74bfe8e747c8.xml->(UTF-16LE), EstimatedImpact: 76% 2026-09-10T15:28:46.483 ProcessImageName: taskhostw.exe, Pid: 4900, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-10T15:28:46.483 ProcessImageName: taskhostw.exe, Pid: 1316, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SECURITY, EstimatedImpact: 1% 2026-09-10T15:28:46.483 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 60, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\72420E9ADB46416B9EF304660C42BEB5.MAI, EstimatedImpact: 0% 2026-09-10T15:28:46.483 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\3A28BFA8E34D45199DFDBEB3624EFA02.MAI, EstimatedImpact: 32% 2026-09-10T15:28:46.483 ProcessImageName: powershell.exe, Pid: 6000, TotalTime: 31, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDD04.tmp, EstimatedImpact: 0% 2026-09-10T15:28:46.483 ProcessImageName: ngentask.exe, Pid: 2132, TotalTime: 31, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 18% 2026-09-10T15:28:46.483 ProcessImageName: cmd.exe, Pid: 3160, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-10T15:28:46.483 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-10T15:32:43.061 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T15:47:48.060 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T15:50:26.889 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T15:50:26.889 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T15:50:26.889 [Cloud] Queued cloud request. 2026-09-10T15:50:26.889 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T15:50:26.889 [Cloud] Dequeued cloud request. 2026-09-10T15:50:26.889 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{ECFF423E-FF7F-5B78-1FC6-6AF8FFA15AFB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 15:50:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T15:50:27.060 [Cloud] End of cloud request. 2026-09-10T15:50:27.576 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T16:02:53.060 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T16:08:51.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T16:08:51.904 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T16:08:51.904 [Cloud] Queued cloud request. 2026-09-10T16:08:51.904 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T16:08:51.904 [Cloud] Dequeued cloud request. 2026-09-10T16:08:51.904 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T16:08:52.075 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06B58EC9-BD14-DA98-0660-A5D64FE7EF8D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 16:08:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T16:08:52.591 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T16:17:58.059 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T16:25:11.356 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T16:25:11.356 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T16:25:11.356 [Cloud] Queued cloud request. 2026-09-10T16:25:11.356 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T16:25:11.356 [Cloud] Dequeued cloud request. 2026-09-10T16:25:11.356 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{90421DC3-A1A6-5943-6E38-BCDF3DE6A87B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 16:25:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T16:25:11.591 [Cloud] End of cloud request. 2026-09-10T16:25:12.091 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T16:33:03.059 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T16:48:08.058 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T17:00:10.777 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:00:10.777 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:00:10.777 [Cloud] Queued cloud request. 2026-09-10T17:00:10.777 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:00:10.933 [Cloud] Dequeued cloud request. 2026-09-10T17:00:11.105 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:00:11.589 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E44FD293-CDB9-034B-B450-1A94C30D4971} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 17:00:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T17:00:12.089 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:03:13.058 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T17:04:51.761 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:04:51.761 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:04:51.761 [Cloud] Queued cloud request. 2026-09-10T17:04:51.761 [Cloud] Dequeued cloud request. 2026-09-10T17:04:51.761 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:04:51.761 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:04:51.917 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E2CA605C-7C15-7C97-195C-5E1D6681F3B3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 17:04:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T17:04:52.433 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:18:18.057 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T17:28:46.494 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2794391, Count: 194648, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 3% 2026-09-10T17:28:46.494 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 21308, Count: 1464, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-10T17:28:46.494 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 6973, Count: 547, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T17:28:46.494 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-10T17:28:46.494 ProcessImageName: taskhostw.exe, Pid: 6756, TotalTime: 999, Count: 2, MaxTime: 953, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-10T17:28:46.494 ProcessImageName: php.exe, Pid: 2952, TotalTime: 972, Count: 20, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-10T17:28:46.494 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 916, Count: 25, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 53% 2026-09-10T17:28:46.494 ProcessImageName: WmiPrvSE.exe, Pid: 7860, TotalTime: 892, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 6% 2026-09-10T17:28:46.494 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 819, Count: 55, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-10T17:28:46.494 ProcessImageName: WmiPrvSE.exe, Pid: 1536, TotalTime: 339, Count: 11, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\spaceport.sys, EstimatedImpact: 2% 2026-09-10T17:28:46.494 ProcessImageName: WmiPrvSE.exe, Pid: 7704, TotalTime: 316, Count: 32, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 24% 2026-09-10T17:28:46.494 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T17:28:46.494 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 241, Count: 16, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-10T17:28:46.494 ProcessImageName: powershell.exe, Pid: 6260, TotalTime: 232, Count: 20, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 19% 2026-09-10T17:28:46.494 ProcessImageName: python.exe, Pid: 1116, TotalTime: 228, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 3% 2026-09-10T17:28:46.494 ProcessImageName: powershell.exe, Pid: 1936, TotalTime: 216, Count: 19, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\2d474a1be13667a9e2446c934803d095\Microsoft.Management.Infrastructure.ni.dll, EstimatedImpact: 31% 2026-09-10T17:28:46.494 ProcessImageName: python.exe, Pid: 8120, TotalTime: 210, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-10T17:28:46.494 ProcessImageName: powershell.exe, Pid: 1964, TotalTime: 198, Count: 21, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 1% 2026-09-10T17:28:46.494 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 170, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-10T17:28:46.494 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 165, Count: 80, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df21-0.MAD, EstimatedImpact: 0% 2026-09-10T17:28:46.494 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 165, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-10T17:28:46.494 ProcessImageName: cmd.exe, Pid: 7988, TotalTime: 124, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 53% 2026-09-10T17:28:46.494 ProcessImageName: upfc.exe, Pid: 7792, TotalTime: 107, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\20bbcadaff3e0543ef358ba4dd8b74bfe8e747c8.xml->(UTF-16LE), EstimatedImpact: 76% 2026-09-10T17:28:46.494 ProcessImageName: taskhostw.exe, Pid: 4900, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-10T17:28:46.494 ProcessImageName: taskhostw.exe, Pid: 1316, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SECURITY, EstimatedImpact: 1% 2026-09-10T17:28:46.494 ProcessImageName: python.exe, Pid: 4008, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-10T17:28:46.494 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 60, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\72420E9ADB46416B9EF304660C42BEB5.MAI, EstimatedImpact: 0% 2026-09-10T17:28:46.494 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\3A28BFA8E34D45199DFDBEB3624EFA02.MAI, EstimatedImpact: 32% 2026-09-10T17:28:46.494 ProcessImageName: powershell.exe, Pid: 6000, TotalTime: 31, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDD04.tmp, EstimatedImpact: 0% 2026-09-10T17:28:46.494 ProcessImageName: ngentask.exe, Pid: 2132, TotalTime: 31, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 18% 2026-09-10T17:28:46.494 ProcessImageName: cmd.exe, Pid: 3160, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-10T17:28:46.494 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-10T17:30:02.229 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:30:02.229 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:30:02.229 [Cloud] Queued cloud request. 2026-09-10T17:30:02.229 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:30:02.229 [Cloud] Dequeued cloud request. 2026-09-10T17:30:02.229 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:30:10.744 [Cloud] End of cloud request. 2026-09-10T17:30:11.244 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:33:23.057 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T17:34:02.916 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:34:02.916 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:34:02.916 [Cloud] Queued cloud request. 2026-09-10T17:34:02.916 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:34:02.916 [Cloud] Dequeued cloud request. 2026-09-10T17:34:02.916 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:34:03.088 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CF634B04-D8FF-AC1E-E07A-47AD02897A77} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 17:34:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T17:34:03.604 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:37:23.010 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:37:23.010 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:37:23.010 [Cloud] Queued cloud request. 2026-09-10T17:37:23.010 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:37:23.010 [Cloud] Dequeued cloud request. 2026-09-10T17:37:23.010 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:37:23.197 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8567C6EB-D8AA-8730-6873-9DAF6660DE0F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 17:37:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T17:37:23.713 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:38:33.135 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:38:33.135 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:38:33.135 [Cloud] Queued cloud request. 2026-09-10T17:38:33.135 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:38:33.135 [Cloud] Dequeued cloud request. 2026-09-10T17:38:33.135 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:38:33.275 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2891DD0D-813B-AB07-3227-23724BCD6846} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 17:38:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T17:38:33.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:38:59.150 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:38:59.150 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:38:59.150 [Cloud] Queued cloud request. 2026-09-10T17:38:59.150 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:38:59.150 [Cloud] Dequeued cloud request. 2026-09-10T17:38:59.150 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:38:59.260 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F60379DE-47F4-B72B-FBDB-A452330408F0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 17:38:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T17:38:59.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:40:00.697 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:40:00.697 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:40:00.697 [Cloud] Queued cloud request. 2026-09-10T17:40:00.697 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:40:00.697 [Cloud] Dequeued cloud request. 2026-09-10T17:40:00.697 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:40:10.775 [Cloud] End of cloud request. 2026-09-10T17:40:11.291 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:43:08.728 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:43:08.728 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:43:08.728 [Cloud] Queued cloud request. 2026-09-10T17:43:08.728 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:43:08.728 [Cloud] Dequeued cloud request. 2026-09-10T17:43:08.728 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:43:08.947 [Cloud] End of cloud request. 2026-09-10T17:43:09.447 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:43:23.041 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:43:23.041 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:43:23.041 [Cloud] Queued cloud request. 2026-09-10T17:43:23.041 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:43:23.041 [Cloud] Dequeued cloud request. 2026-09-10T17:43:23.041 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:43:23.119 [Cloud] End of cloud request. 2026-09-10T17:43:23.619 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:46:54.478 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:46:54.478 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:46:54.478 [Cloud] Queued cloud request. 2026-09-10T17:46:54.478 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:46:54.478 [Cloud] Dequeued cloud request. 2026-09-10T17:46:54.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:46:54.635 [Cloud] End of cloud request. 2026-09-10T17:46:55.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:48:28.056 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T17:53:24.259 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:53:24.259 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:53:24.259 [Cloud] Queued cloud request. 2026-09-10T17:53:24.259 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:53:24.478 [Cloud] Dequeued cloud request. 2026-09-10T17:53:24.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:53:34.556 [Cloud] End of cloud request. 2026-09-10T17:53:35.072 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:57:14.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:57:14.337 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:57:14.337 [Cloud] Queued cloud request. 2026-09-10T17:57:14.337 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:57:14.337 [Cloud] Dequeued cloud request. 2026-09-10T17:57:14.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:57:14.556 [Cloud] End of cloud request. 2026-09-10T17:57:15.056 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T17:58:51.899 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T17:58:51.899 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T17:58:51.899 [Cloud] Queued cloud request. 2026-09-10T17:58:51.899 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T17:58:51.899 [Cloud] Dequeued cloud request. 2026-09-10T17:58:51.899 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T17:58:52.212 [Cloud] End of cloud request. 2026-09-10T17:58:52.712 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:01:58.149 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:01:58.149 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:01:58.149 [Cloud] Queued cloud request. 2026-09-10T18:01:58.149 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:01:58.149 [Cloud] Dequeued cloud request. 2026-09-10T18:01:58.149 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:01:58.618 [Cloud] End of cloud request. 2026-09-10T18:01:59.134 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:03:33.056 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T18:05:52.915 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:05:52.915 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:05:52.915 [Cloud] Queued cloud request. 2026-09-10T18:05:52.915 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:05:52.915 [Cloud] Dequeued cloud request. 2026-09-10T18:05:52.915 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:05:53.103 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E2340A1F-E9BA-F363-5C4F-BBF8FAF115CA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 18:05:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T18:05:53.618 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:06:32.696 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:06:32.696 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:06:32.696 [Cloud] Queued cloud request. 2026-09-10T18:06:32.696 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:06:32.696 [Cloud] Dequeued cloud request. 2026-09-10T18:06:32.696 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:06:33.102 [Cloud] End of cloud request. 2026-09-10T18:06:33.602 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:09:34.399 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:09:34.399 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:09:34.399 [Cloud] Queued cloud request. 2026-09-10T18:09:34.399 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:09:34.399 [Cloud] Dequeued cloud request. 2026-09-10T18:09:34.399 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:09:34.540 [Cloud] End of cloud request. 2026-09-10T18:09:35.055 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:10:06.758 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:10:06.758 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:10:06.758 [Cloud] Queued cloud request. 2026-09-10T18:10:06.758 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:10:06.758 [Cloud] Dequeued cloud request. 2026-09-10T18:10:06.758 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:10:06.868 [Cloud] End of cloud request. 2026-09-10T18:10:07.383 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:11:14.196 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:11:14.196 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:11:14.196 [Cloud] Queued cloud request. 2026-09-10T18:11:14.196 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:11:14.196 [Cloud] Dequeued cloud request. 2026-09-10T18:11:14.212 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:11:14.352 [Cloud] End of cloud request. 2026-09-10T18:11:14.852 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:12:29.977 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:12:29.977 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:12:29.977 [Cloud] Queued cloud request. 2026-09-10T18:12:29.977 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:12:29.977 [Cloud] Dequeued cloud request. 2026-09-10T18:12:29.977 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:12:30.196 [Cloud] End of cloud request. 2026-09-10T18:12:30.696 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:14:26.946 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:14:26.946 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:14:26.946 [Cloud] Queued cloud request. 2026-09-10T18:14:26.946 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:14:26.946 [Cloud] Dequeued cloud request. 2026-09-10T18:14:26.946 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:14:27.102 [Cloud] End of cloud request. 2026-09-10T18:14:27.618 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:14:55.446 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:14:55.446 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:14:55.446 [Cloud] Queued cloud request. 2026-09-10T18:14:55.446 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:14:55.446 [Cloud] Dequeued cloud request. 2026-09-10T18:14:55.446 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:14:55.540 [Cloud] End of cloud request. 2026-09-10T18:14:56.040 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:14:58.790 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:14:58.790 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:14:58.790 [Cloud] Queued cloud request. 2026-09-10T18:14:58.790 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:14:58.790 [Cloud] Dequeued cloud request. 2026-09-10T18:14:58.790 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:14:58.868 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1F8CE53B-49EE-3C5D-9229-EC5D8B084DEC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 18:14:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T18:14:59.368 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:18:38.055 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T18:21:17.992 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:21:17.992 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:21:17.992 [Cloud] Queued cloud request. 2026-09-10T18:21:17.992 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:21:17.992 [Cloud] Dequeued cloud request. 2026-09-10T18:21:18.008 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:21:18.211 [Cloud] End of cloud request. 2026-09-10T18:21:18.711 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:26:24.898 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:26:24.898 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:26:24.898 [Cloud] Queued cloud request. 2026-09-10T18:26:24.898 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:26:24.898 [Cloud] Dequeued cloud request. 2026-09-10T18:26:24.898 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:26:31.148 [Cloud] End of cloud request. 2026-09-10T18:26:31.648 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:27:37.180 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:27:37.180 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:27:37.180 [Cloud] Queued cloud request. 2026-09-10T18:27:37.180 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:27:37.180 [Cloud] Dequeued cloud request. 2026-09-10T18:27:37.180 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:27:37.384 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2FBF1F39-016D-A4D7-91AC-0C50EB0BA860} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 18:27:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T18:27:37.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:27:41.023 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:27:41.023 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:27:41.023 [Cloud] Queued cloud request. 2026-09-10T18:27:41.023 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:27:41.023 [Cloud] Dequeued cloud request. 2026-09-10T18:27:41.023 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:27:41.101 [Cloud] End of cloud request. 2026-09-10T18:27:41.617 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:30:09.570 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:30:09.570 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:30:09.570 [Cloud] Queued cloud request. 2026-09-10T18:30:09.570 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:30:09.570 [Cloud] Dequeued cloud request. 2026-09-10T18:30:09.570 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:30:09.758 [Cloud] End of cloud request. 2026-09-10T18:30:10.258 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:30:36.289 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:30:36.289 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:30:36.289 [Cloud] Queued cloud request. 2026-09-10T18:30:36.289 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:30:36.289 [Cloud] Dequeued cloud request. 2026-09-10T18:30:36.289 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:30:36.398 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F20282F3-B483-5CD9-0F15-CE0CB2D1EC5F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 18:30:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T18:30:36.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{00AF2D35-439E-55FE-E08B-E85A85536BF1} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-10-2026 18:32:50 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T18:32:50.883 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:32:50.883 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:32:50.883 [Cloud] Queued cloud request. 2026-09-10T18:32:50.883 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:32:50.883 [Cloud] Dequeued cloud request. 2026-09-10T18:32:50.883 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:32:51.070 [Cloud] End of cloud request. 2026-09-10T18:32:51.570 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:32:59.789 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:32:59.789 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:32:59.789 [Cloud] Queued cloud request. 2026-09-10T18:32:59.789 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:32:59.789 [Cloud] Dequeued cloud request. 2026-09-10T18:32:59.789 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:33:09.836 [Cloud] End of cloud request. 2026-09-10T18:33:10.336 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:33:30.351 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:33:30.351 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:33:30.351 [Cloud] Queued cloud request. 2026-09-10T18:33:30.351 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:33:30.351 [Cloud] Dequeued cloud request. 2026-09-10T18:33:30.351 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:33:30.430 [Cloud] End of cloud request. 2026-09-10T18:33:30.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:33:43.055 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T18:34:23.648 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:34:23.648 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:34:23.648 [Cloud] Queued cloud request. 2026-09-10T18:34:23.648 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:34:23.648 [Cloud] Dequeued cloud request. 2026-09-10T18:34:23.648 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:34:23.726 [Cloud] End of cloud request. 2026-09-10T18:34:24.226 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:34:39.336 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:34:39.336 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:34:39.336 [Cloud] Queued cloud request. 2026-09-10T18:34:39.336 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:34:39.336 [Cloud] Dequeued cloud request. 2026-09-10T18:34:39.336 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:34:39.414 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{16B4287F-5006-F7DB-4D27-62C4460F199D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 18:34:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T18:34:39.929 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:37:46.476 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:37:46.476 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:37:46.476 [Cloud] Queued cloud request. 2026-09-10T18:37:46.476 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:37:46.476 [Cloud] Dequeued cloud request. 2026-09-10T18:37:46.476 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:37:46.679 [Cloud] End of cloud request. 2026-09-10T18:37:47.179 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:41:45.492 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:41:45.492 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:41:45.492 [Cloud] Queued cloud request. 2026-09-10T18:41:45.492 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:41:45.492 [Cloud] Dequeued cloud request. 2026-09-10T18:41:45.492 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:41:45.679 [Cloud] End of cloud request. 2026-09-10T18:41:46.195 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:42:04.507 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:42:04.507 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:42:04.507 [Cloud] Queued cloud request. 2026-09-10T18:42:04.507 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:42:04.507 [Cloud] Dequeued cloud request. 2026-09-10T18:42:04.507 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:42:05.648 [Cloud] End of cloud request. 2026-09-10T18:42:06.164 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:46:18.023 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:46:18.023 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:46:18.023 [Cloud] Queued cloud request. 2026-09-10T18:46:18.023 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:46:18.023 [Cloud] Dequeued cloud request. 2026-09-10T18:46:18.023 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:46:18.460 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B3668124-A4E3-3299-645F-53E61124A5CD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 18:46:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T18:46:18.960 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:48:48.054 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T18:49:09.116 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:49:09.116 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:49:09.116 [Cloud] Queued cloud request. 2026-09-10T18:49:09.116 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:49:09.116 [Cloud] Dequeued cloud request. 2026-09-10T18:49:09.116 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:49:09.319 [Cloud] End of cloud request. 2026-09-10T18:49:09.819 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T18:57:45.913 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T18:57:45.913 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T18:57:45.913 [Cloud] Queued cloud request. 2026-09-10T18:57:45.913 [Cloud] Dequeued cloud request. 2026-09-10T18:57:45.913 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T18:57:45.928 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T18:57:46.116 [Cloud] End of cloud request. 2026-09-10T18:57:46.631 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:00:33.819 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:00:33.819 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:00:33.819 [Cloud] Queued cloud request. 2026-09-10T19:00:33.819 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:00:33.819 [Cloud] Dequeued cloud request. 2026-09-10T19:00:33.819 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:00:34.022 [Cloud] End of cloud request. 2026-09-10T19:00:34.522 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:03:53.053 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T19:05:17.538 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:05:17.538 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:05:17.538 [Cloud] Queued cloud request. 2026-09-10T19:05:17.538 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:05:17.538 [Cloud] Dequeued cloud request. 2026-09-10T19:05:17.538 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:05:17.725 [Cloud] End of cloud request. 2026-09-10T19:05:18.241 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:06:03.069 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:06:03.069 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:06:03.069 [Cloud] Queued cloud request. 2026-09-10T19:06:03.069 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:06:03.069 [Cloud] Dequeued cloud request. 2026-09-10T19:06:03.069 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:06:03.147 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{77665116-0981-6047-AD17-43513F03085C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 19:06:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T19:06:03.663 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:13:29.834 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:13:29.834 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:13:29.834 [Cloud] Queued cloud request. 2026-09-10T19:13:29.834 [Cloud] Dequeued cloud request. 2026-09-10T19:13:29.834 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:13:29.834 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:13:30.037 [Cloud] End of cloud request. 2026-09-10T19:13:30.537 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:18:58.053 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T19:19:18.521 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:19:18.521 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:19:18.521 [Cloud] Queued cloud request. 2026-09-10T19:19:18.521 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:19:18.584 [Cloud] Dequeued cloud request. 2026-09-10T19:19:18.584 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:19:18.756 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{370AFF06-7D7B-3CFF-CE0D-3ED3207BEE6B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 19:19:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T19:19:19.256 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:28:18.052 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-10T19:28:18.099 Job Notification: New process added to job (6468) 2026-09-10T19:28:18.115 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-10T19:28:18.115 Job Notification: New process added to job (6664) 2026-09-10T19:28:18.146 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:6468] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:6664]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-10T19:28:18.146 Aggressive catchup quick scan threshold: 692442803275 / 25920000000000 2026-09-10T19:28:18.302 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-10T19:28:18.302 Job Notification: New process added to job (7884) 2026-09-10T19:28:18.302 Job Notification: New process added to job (7476) 2026-09-10T19:28:18.401 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:7884] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7476]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-10T19:28:18.474 Job Notification: New process added to job (1392) 2026-09-10T19:28:18.505 Task(GetDeviceTicket -AccessKey 6B3904AF-AEC8-56D5-E1A7-2FE097028824 ) launched as network service 2026-09-10T19:28:18.662 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-10T19:28:18.701 [RTP] Duplicating the current plugin configuration object... 2026-09-10T19:28:18.701 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-10T19:28:18.701 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-10T19:28:18.701 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-10T19:28:18.701 [RTP] No config change detected. Not updating plugin configuration. 2026-09-10T19:28:18.701 [RTP] No config changes found. No configuration switch. 2026-09-10T19:28:18.701 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-10T19:28:19.380 Job Notification: Process exited from job (1392) 2026-09-10T19:28:19.630 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-10T19:28:19.630 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:28:19.630 [Cloud] Queued cloud request. 2026-09-10T19:28:19.630 [Cloud] Dequeued cloud request. 2026-09-10T19:28:19.646 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:28:19.833 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-10T19:28:19.833 [Cloud] End of cloud request. 2026-09-10T19:28:20.146 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:28:46.505 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2839238, Count: 197816, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 3% 2026-09-10T19:28:46.505 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 24843, Count: 1638, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-10T19:28:46.505 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 6973, Count: 547, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T19:28:46.505 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-10T19:28:46.505 ProcessImageName: taskhostw.exe, Pid: 6756, TotalTime: 999, Count: 2, MaxTime: 953, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-10T19:28:46.505 ProcessImageName: php.exe, Pid: 2952, TotalTime: 972, Count: 20, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-10T19:28:46.505 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 941, Count: 63, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-10T19:28:46.505 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 916, Count: 25, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 53% 2026-09-10T19:28:46.505 ProcessImageName: WmiPrvSE.exe, Pid: 7860, TotalTime: 892, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 6% 2026-09-10T19:28:46.505 ProcessImageName: WmiPrvSE.exe, Pid: 1536, TotalTime: 339, Count: 11, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\spaceport.sys, EstimatedImpact: 2% 2026-09-10T19:28:46.505 ProcessImageName: WmiPrvSE.exe, Pid: 7704, TotalTime: 316, Count: 32, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 24% 2026-09-10T19:28:46.505 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T19:28:46.505 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 272, Count: 17, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-10T19:28:46.505 ProcessImageName: powershell.exe, Pid: 6260, TotalTime: 232, Count: 20, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 19% 2026-09-10T19:28:46.505 ProcessImageName: python.exe, Pid: 1116, TotalTime: 228, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 3% 2026-09-10T19:28:46.505 ProcessImageName: powershell.exe, Pid: 1936, TotalTime: 216, Count: 19, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\2d474a1be13667a9e2446c934803d095\Microsoft.Management.Infrastructure.ni.dll, EstimatedImpact: 31% 2026-09-10T19:28:46.505 ProcessImageName: python.exe, Pid: 8120, TotalTime: 210, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-10T19:28:46.505 ProcessImageName: powershell.exe, Pid: 1964, TotalTime: 198, Count: 21, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache, EstimatedImpact: 1% 2026-09-10T19:28:46.505 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 170, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-10T19:28:46.505 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 165, Count: 80, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-df21-0.MAD, EstimatedImpact: 0% 2026-09-10T19:28:46.505 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 165, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-10T19:28:46.505 ProcessImageName: cmd.exe, Pid: 7988, TotalTime: 124, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 53% 2026-09-10T19:28:46.505 ProcessImageName: upfc.exe, Pid: 7792, TotalTime: 107, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\20bbcadaff3e0543ef358ba4dd8b74bfe8e747c8.xml->(UTF-16LE), EstimatedImpact: 76% 2026-09-10T19:28:46.505 ProcessImageName: taskhostw.exe, Pid: 4900, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-10T19:28:46.505 ProcessImageName: taskhostw.exe, Pid: 1316, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\RegBack\SECURITY, EstimatedImpact: 1% 2026-09-10T19:28:46.505 ProcessImageName: python.exe, Pid: 4008, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-10T19:28:46.505 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 60, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\72420E9ADB46416B9EF304660C42BEB5.MAI, EstimatedImpact: 0% 2026-09-10T19:28:46.505 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\3A28BFA8E34D45199DFDBEB3624EFA02.MAI, EstimatedImpact: 32% 2026-09-10T19:28:46.505 ProcessImageName: powershell.exe, Pid: 6000, TotalTime: 31, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDD04.tmp, EstimatedImpact: 0% 2026-09-10T19:28:46.505 ProcessImageName: ngentask.exe, Pid: 2132, TotalTime: 31, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 18% 2026-09-10T19:28:46.505 ProcessImageName: cmd.exe, Pid: 3160, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-10T19:28:46.505 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0% 2026-09-10T19:28:46.505 ProcessImageName: svchost.exe, Pid: 2544, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0% 2026-09-10T19:28:46.505 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-10T19:28:57.755 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\E2FB3312-EC8E-4220-9380-73532EC4BA951f00.1dd415a9e712094 2026-09-10T19:28:57.818 Verifying engine and signature files (source: 0) ... 2026-09-10T19:28:57.818 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D}\mpengine.dll] due to PPL. 2026-09-10T19:28:57.818 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D}\mpasbase.vdm]. File not in cache (0x1) 2026-09-10T19:28:58.927 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D}\mpasbase.vdm] 2026-09-10T19:28:58.927 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-10T19:28:58.943 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D}\mpasdlta.vdm] 2026-09-10T19:28:58.943 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D}\mpavbase.vdm]. File not in cache (0x1) 2026-09-10T19:28:59.412 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D}\mpavbase.vdm] 2026-09-10T19:28:59.412 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-10T19:28:59.427 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D}\mpavdlta.vdm] 2026-09-10T19:28:59.677 [Engine] IsHybridMode: 0 2026-09-10T19:28:59.693 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-10T19:28:59.708 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-76088F51A8039885B35F3E1520CF4550A9FB8BD3.bin): 0x00000002 2026-09-10T19:28:59.724 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-76088F51A8039885B35F3E1520CF4550A9FB8BD3.bin) 2026-09-10T19:28:59.724 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-10T19:28:59.724 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-10T19:28:59.724 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-10T19:28:59.724 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-10T19:29:13.130 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-10T19:29:13.130 [AutoExclusion] Applied roles from cache. 2026-09-10T19:29:13.130 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-10T19:29:13.240 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF68AB020, lRefCount: 6, hr=0 2026-09-10T19:29:13.240 [Engine] New active engine 00007FFCF4ABB020 replacing engine 00007FFCF68AB020. Number of active engines: 2 2026-09-10T19:29:13.255 EngineInit:Global ASOC is enabled 2026-09-10T19:29:13.255 EngineInit:ASOO is enabled for developer volumes 2026-09-10T19:29:13.401 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.412 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.427 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.427 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.427 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-10T19:29:13.443 MpWriteUupSignatureVersion 1.459.148.0, hr = 0 2026-09-10T19:29:13.458 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-10T19:29:13.505 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-10T19:29:13.505 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-10T19:29:13.505 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-10T19:29:13.505 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-10T19:29:13.521 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-10T19:29:13.521 [Plugin] Initializing RTP plugin state... 2026-09-10T19:29:13.521 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-10T19:29:13.521 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎09‎-‎2026 21:28:47 Last Perf:‎09‎-‎09‎-‎2026 21:28:46 First RTP Scan:‎09‎-‎09‎-‎2026 21:28:47 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:46423 Misses:142824 BM Queue:0,2340,0 Proc:0,54,0 File:0,2332,0 NamedPipe:0,0,0 Plugin Queue:0,2,0 Threat:0,0,0 Susp:0,2,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:3875720 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:-1679840522 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:22909 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:652080 TotalHits:15925943 InstanceCacheInserts:399313 InstanceCacheUpdates:0 InstanceCacheDeletes:43461 InstanceCacheHits:15654 InstanceCacheMisses:718481 InstanceCacheOverflows:332006 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:8ms (13435/1677) Success: 1677, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-10T19:29:13.521 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D} 2026-09-10T19:29:13.521 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-10T19:29:13.537 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{53DD6009-966C-4D87-B894-61B778D6F3E8} removed 2026-09-10T19:29:13.537 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80DAD12A-AB64-4B50-81C1-0E95DA63E6F7}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80DAD12A-AB64-4B50-81C1-0E95DA63E6F7}\mpasbase.vdm in use, hr=0x80070020 2026-09-10T19:29:13.537 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-10T19:29:13.537 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-10T19:29:13.537 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-10T19:29:13.537 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-10T19:29:13.537 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-10-2026 19:29:13 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-10-2026 19:29:13 2026-09-10T19:29:13.537 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-10T19:29:13.537 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-10T19:29:13.537 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-10T19:29:13.537 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-10T19:29:13.537 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:29:13.537 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-10T19:29:13.537 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-10T19:29:13.537 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-10T19:29:13.537 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-10T19:29:13.537 MdCoreSvc is supported in this platform and OS Signature updated on 09-10-2026 19:29:13 Product Version: 4.18.26080.3 Service Version: 4.18.26080.3 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.148.0 AV Signature Version: 1.459.148.0 ************************************************************ 2026-09-10T19:29:13.552 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-10T19:29:13.552 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\E2FB3312-EC8E-4220-9380-73532EC4BA951f00.1dd415a9e712094 2026-09-10T19:29:13.601 Process scan (postsignatureupdatescan) started. 2026-09-10T19:29:13.630 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-10T19:29:13.630 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-10-2026 19:29:13 ************************************************************ 2026-09-10T19:29:13.849 Job Notification: Process exited from job (7884) 2026-09-10T19:29:13.865 Job Notification: Process exited from job (7476) 2026-09-10T19:29:13.901 Job Notification: Process exited from job (6468) 2026-09-10T19:29:13.901 Job Notification: Process exited from job (6664) 2026-09-10T19:29:13.943 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-10T19:29:13.943 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-10T19:29:13.943 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-10T19:29:13.943 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-10T19:29:13.943 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-10T19:29:13.958 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-10T19:29:13.958 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-10T19:29:13.958 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-10T19:29:13.974 [Engine] Engine 00007FFCF68AB020 no longer in use. Number of active engines: 1 2026-09-10T19:29:13.974 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-10T19:29:13.974 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-10T19:29:14.458 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2839238, Count: 197816, MaxTime: 2843, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 3% 2026-09-10T19:29:14.458 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 24874, Count: 1639, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-10T19:29:14.458 ProcessImageName: AgentShell.exe, Pid: 7736, TotalTime: 6973, Count: 547, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T19:29:14.458 ProcessImageName: powershell.exe, Pid: 2888, TotalTime: 1802, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 30% 2026-09-10T19:29:14.458 ProcessImageName: taskhostw.exe, Pid: 6756, TotalTime: 999, Count: 2, MaxTime: 953, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-10T19:29:14.458 ProcessImageName: php.exe, Pid: 2952, TotalTime: 972, Count: 20, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-10T19:29:14.458 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 941, Count: 63, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-10T19:29:14.458 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 916, Count: 25, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 53% 2026-09-10T19:29:14.458 ProcessImageName: WmiPrvSE.exe, Pid: 7860, TotalTime: 892, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 6% 2026-09-10T19:29:14.458 ProcessImageName: WmiPrvSE.exe, Pid: 1536, TotalTime: 339, Count: 11, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\spaceport.sys, EstimatedImpact: 2% 2026-09-10T19:29:14.458 ProcessImageName: WmiPrvSE.exe, Pid: 7704, TotalTime: 316, Count: 32, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 24% 2026-09-10T19:29:14.458 ProcessImageName: WmiPrvSE.exe, Pid: 7596, TotalTime: 309, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T19:29:14.458 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 272, Count: 17, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-10T19:29:14.458 ProcessImageName: powershell.exe, Pid: 6260, TotalTime: 232, Count: 20, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 19% 2026-09-10T19:29:14.458 ProcessImageName: python.exe, Pid: 1116, TotalTime: 228, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 3% 2026-09-10T19:29:14.568 [Engine] RSIG_UNLOADENGINE, 00007FFCF68AB020, err=0x0 2026-09-10T19:29:14.615 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80DAD12A-AB64-4B50-81C1-0E95DA63E6F7} removed 2026-09-10T19:29:29.943 Process scan (postsignatureupdatescan) completed. 2026-09-10T19:30:38.693 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:30:38.693 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:30:38.693 [Cloud] Queued cloud request. 2026-09-10T19:30:38.693 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:30:38.693 [Cloud] Dequeued cloud request. 2026-09-10T19:30:38.693 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:30:38.912 [Cloud] End of cloud request. 2026-09-10T19:30:39.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:31:16.208 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:31:16.208 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:31:16.208 [Cloud] Queued cloud request. 2026-09-10T19:31:16.208 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:31:16.208 [Cloud] Dequeued cloud request. 2026-09-10T19:31:16.208 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:31:16.287 [Cloud] End of cloud request. 2026-09-10T19:31:16.802 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:34:03.052 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T19:34:13.302 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-10T19:34:29.021 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:34:29.021 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:34:29.021 [Cloud] Queued cloud request. 2026-09-10T19:34:29.021 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:34:29.021 [Cloud] Dequeued cloud request. 2026-09-10T19:34:29.021 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:34:29.208 [Cloud] End of cloud request. 2026-09-10T19:34:29.724 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:35:04.583 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:35:04.583 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:35:04.583 [Cloud] Queued cloud request. 2026-09-10T19:35:04.583 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:35:04.583 [Cloud] Dequeued cloud request. 2026-09-10T19:35:04.583 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:35:04.693 [Cloud] End of cloud request. 2026-09-10T19:35:05.193 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0x62fe7fc0 2026-09-10T19:36:26.005 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$R30CG93\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0x1044fcb3 2026-09-10T19:36:26.037 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:36:26.037 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:36:26.037 [Cloud] Queued cloud request. 2026-09-10T19:36:26.037 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:36:26.037 [Cloud] Dequeued cloud request. 2026-09-10T19:36:26.037 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:36:26.411 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$R30CG93\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-09-10T19:36:26.411 [Cloud] End of cloud request. 2026-09-10T19:36:26.927 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:36:27.911 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:36:27.911 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:36:27.911 [Cloud] Queued cloud request. 2026-09-10T19:36:27.911 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:36:27.911 [Cloud] Dequeued cloud request. 2026-09-10T19:36:27.911 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:36:28.005 [Cloud] End of cloud request. 2026-09-10T19:36:28.505 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:36:58.692 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:36:58.692 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:36:58.692 [Cloud] Queued cloud request. 2026-09-10T19:36:58.692 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:36:58.692 [Cloud] Dequeued cloud request. 2026-09-10T19:36:58.692 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:36:58.786 [Cloud] End of cloud request. 2026-09-10T19:36:59.302 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:38:17.474 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:38:17.474 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:38:17.474 [Cloud] Queued cloud request. 2026-09-10T19:38:17.474 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:38:17.474 [Cloud] Dequeued cloud request. 2026-09-10T19:38:17.474 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:38:17.661 [Cloud] End of cloud request. 2026-09-10T19:38:18.177 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:42:58.567 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:42:58.567 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:42:58.567 [Cloud] Queued cloud request. 2026-09-10T19:42:58.567 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:42:58.567 [Cloud] Dequeued cloud request. 2026-09-10T19:42:58.567 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:42:58.755 [Cloud] End of cloud request. 2026-09-10T19:42:59.255 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:45:02.677 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:45:02.677 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:45:02.677 [Cloud] Queued cloud request. 2026-09-10T19:45:02.677 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:45:02.849 [Cloud] Dequeued cloud request. 2026-09-10T19:45:03.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{9CEFC98C-CB55-761C-193A-68F1C227E2A1} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 19:45:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T19:45:13.098 [Cloud] End of cloud request. 2026-09-10T19:45:13.598 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:49:08.054 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T19:51:19.507 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:51:19.507 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:51:19.507 [Cloud] Queued cloud request. 2026-09-10T19:51:19.507 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:51:19.507 [Cloud] Dequeued cloud request. 2026-09-10T19:51:19.507 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:51:19.663 [Cloud] End of cloud request. 2026-09-10T19:51:20.163 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:53:36.288 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:53:36.288 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:53:36.288 [Cloud] Queued cloud request. 2026-09-10T19:53:36.288 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:53:36.288 [Cloud] Dequeued cloud request. 2026-09-10T19:53:36.288 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:53:36.554 [Cloud] End of cloud request. 2026-09-10T19:53:37.069 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T19:59:07.084 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T19:59:07.084 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T19:59:07.084 [Cloud] Queued cloud request. 2026-09-10T19:59:07.084 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T19:59:07.084 [Cloud] Dequeued cloud request. 2026-09-10T19:59:07.084 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T19:59:07.272 [Cloud] End of cloud request. 2026-09-10T19:59:07.787 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:00:33.022 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:00:33.022 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:00:33.022 [Cloud] Queued cloud request. 2026-09-10T20:00:33.022 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:00:33.022 [Cloud] Dequeued cloud request. 2026-09-10T20:00:33.022 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:00:33.225 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A81FD648-5B4F-6A9E-5347-00508862CC2A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 20:00:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T20:00:33.725 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:01:59.506 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:01:59.506 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:01:59.506 [Cloud] Queued cloud request. 2026-09-10T20:01:59.506 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:01:59.506 [Cloud] Dequeued cloud request. 2026-09-10T20:01:59.506 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:02:09.647 [Cloud] End of cloud request. 2026-09-10T20:02:10.162 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:04:13.053 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T20:04:33.990 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:04:33.990 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:04:33.990 [Cloud] Queued cloud request. 2026-09-10T20:04:33.990 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:04:33.990 [Cloud] Dequeued cloud request. 2026-09-10T20:04:33.990 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:04:34.162 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{590278DE-D692-C95B-79E1-D97222B57E0E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 20:04:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T20:04:34.678 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:07:03.084 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:07:03.084 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:07:03.084 [Cloud] Queued cloud request. 2026-09-10T20:07:03.084 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:07:03.084 [Cloud] Dequeued cloud request. 2026-09-10T20:07:03.100 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:07:03.256 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7C97E166-8306-6A0D-B049-874314942CDB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 20:07:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T20:07:03.756 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:11:44.459 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:11:44.459 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:11:44.459 [Cloud] Queued cloud request. 2026-09-10T20:11:44.459 [Cloud] Dequeued cloud request. 2026-09-10T20:11:44.459 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:11:44.459 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:11:44.615 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{456E7FE4-F51B-A7C5-52E0-50A2EB7A426F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 20:11:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T20:11:45.115 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:14:25.427 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:14:25.427 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:14:25.427 [Cloud] Queued cloud request. 2026-09-10T20:14:25.427 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:14:25.631 [Cloud] Dequeued cloud request. 2026-09-10T20:14:25.631 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:14:25.771 [Cloud] End of cloud request. 2026-09-10T20:14:26.271 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:18:02.208 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:18:02.208 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:18:02.208 [Cloud] Queued cloud request. 2026-09-10T20:18:02.208 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:18:02.208 [Cloud] Dequeued cloud request. 2026-09-10T20:18:02.208 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:18:02.396 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0CD803BD-6DA7-80E5-8EA2-991AA1FC64A2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 20:18:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T20:18:02.896 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:18:49.896 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:18:49.896 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:18:49.896 [Cloud] Queued cloud request. 2026-09-10T20:18:49.896 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:18:49.896 [Cloud] Dequeued cloud request. 2026-09-10T20:18:49.896 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:18:49.974 [Cloud] End of cloud request. 2026-09-10T20:18:50.474 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:19:18.052 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T20:19:42.896 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:19:42.896 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:19:42.896 [Cloud] Queued cloud request. 2026-09-10T20:19:42.896 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:19:42.896 [Cloud] Dequeued cloud request. 2026-09-10T20:19:42.896 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:19:42.990 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2A8C606B-576E-6E59-F810-DA4D47AECB25} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 20:19:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T20:19:43.521 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:26:46.646 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:26:46.646 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:26:46.646 [Cloud] Queued cloud request. 2026-09-10T20:26:46.646 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:26:46.646 [Cloud] Dequeued cloud request. 2026-09-10T20:26:46.646 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:26:46.833 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4513A023-E68E-0598-C743-334AAF34D0B4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 20:26:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T20:26:47.349 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:30:49.770 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:30:49.770 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:30:49.770 [Cloud] Queued cloud request. 2026-09-10T20:30:49.770 [Cloud] Dequeued cloud request. 2026-09-10T20:30:49.770 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:30:49.770 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:30:49.927 [Cloud] End of cloud request. 2026-09-10T20:30:50.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:34:23.052 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T20:38:34.473 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:38:34.473 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:38:34.473 [Cloud] Queued cloud request. 2026-09-10T20:38:34.473 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:38:34.473 [Cloud] Dequeued cloud request. 2026-09-10T20:38:34.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:38:40.051 [Cloud] End of cloud request. 2026-09-10T20:38:40.551 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:42:10.801 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:42:10.801 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:42:10.801 [Cloud] Queued cloud request. 2026-09-10T20:42:10.801 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:42:10.801 [Cloud] Dequeued cloud request. 2026-09-10T20:42:10.801 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:42:10.989 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{64397E68-88B9-8F66-6D42-7E8E59C6FC0F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 20:42:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T20:42:11.489 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:47:17.660 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:47:17.660 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:47:17.660 [Cloud] Queued cloud request. 2026-09-10T20:47:17.660 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:47:17.660 [Cloud] Dequeued cloud request. 2026-09-10T20:47:17.660 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:47:17.848 [Cloud] End of cloud request. 2026-09-10T20:47:18.348 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:47:36.004 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:47:36.004 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:47:36.004 [Cloud] Queued cloud request. 2026-09-10T20:47:36.004 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:47:36.004 [Cloud] Dequeued cloud request. 2026-09-10T20:47:36.004 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:47:36.082 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4B0C3B55-91CB-7A48-CFBC-5CA45D21AA3D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 20:47:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T20:47:36.582 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:49:28.051 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T20:51:16.597 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:51:16.613 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:51:16.613 [Cloud] Queued cloud request. 2026-09-10T20:51:16.613 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:51:16.863 [Cloud] Dequeued cloud request. 2026-09-10T20:51:16.863 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:51:17.113 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{16C6ECB1-908F-2616-78D0-504F21E838B1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 20:51:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T20:51:17.613 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T20:54:13.535 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T20:54:13.535 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T20:54:13.535 [Cloud] Queued cloud request. 2026-09-10T20:54:13.535 [Cloud] Dequeued cloud request. 2026-09-10T20:54:13.535 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T20:54:13.535 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T20:54:13.722 [Cloud] End of cloud request. 2026-09-10T20:54:14.222 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T21:04:33.050 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T21:08:39.487 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\IDR_XML_DEFAULT_TRANSFORM[1]. Process: \Device\HarddiskVolume2\Windows\System32\taskhostw.exe, Status: 0xc0000001, State: 0, ScanRequest #3913347, FileId: 0xf00000000d895, Reason: OnClose, IoStatusBlockForNewFile: 0x3, DesiredAccess:0x0, FileAttributes:0x2020, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-10T21:19:38.049 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T21:20:28.455 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T21:20:28.455 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T21:20:28.455 [Cloud] Queued cloud request. 2026-09-10T21:20:28.455 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T21:20:28.612 [Cloud] Dequeued cloud request. 2026-09-10T21:20:28.768 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T21:20:28.955 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{26EFA1AF-2995-F742-E49F-B3B1714DFE3A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 21:20:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T21:20:29.455 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T21:24:17.987 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T21:24:17.987 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T21:24:17.987 [Cloud] Queued cloud request. 2026-09-10T21:24:17.987 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T21:24:17.987 [Cloud] Dequeued cloud request. 2026-09-10T21:24:17.987 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T21:24:18.174 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{83C84AD4-B2EE-0965-0F0E-35E9D356D781} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 21:24:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T21:24:18.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T21:29:13.236 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 80679, Count: 5783, MaxTime: 2046, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 1% 2026-09-10T21:29:13.236 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 3141, Count: 177, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T21:29:13.236 ProcessImageName: powershell.exe, Pid: 2732, TotalTime: 1679, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-10T21:29:13.236 ProcessImageName: WmiPrvSE.exe, Pid: 4064, TotalTime: 279, Count: 5, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T21:29:13.236 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 123, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-10T21:29:13.236 ProcessImageName: taskhostw.exe, Pid: 5608, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-10T21:29:13.236 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-10T21:29:13.236 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-10T21:29:13.236 ProcessImageName: taskhostw.exe, Pid: 4184, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-10T21:29:15.955 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T21:29:15.955 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T21:29:15.955 [Cloud] Queued cloud request. 2026-09-10T21:29:15.955 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T21:29:15.955 [Cloud] Dequeued cloud request. 2026-09-10T21:29:15.955 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T21:29:16.158 [Cloud] End of cloud request. 2026-09-10T21:29:16.658 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T21:34:43.049 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T21:37:37.517 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T21:37:37.517 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T21:37:37.517 [Cloud] Queued cloud request. 2026-09-10T21:37:37.517 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T21:37:37.517 [Cloud] Dequeued cloud request. 2026-09-10T21:37:37.517 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T21:37:37.705 [Cloud] End of cloud request. 2026-09-10T21:37:38.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T21:49:48.048 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T21:53:14.298 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T21:53:14.298 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T21:53:14.298 [Cloud] Queued cloud request. 2026-09-10T21:53:14.298 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T21:53:14.298 [Cloud] Dequeued cloud request. 2026-09-10T21:53:14.298 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T21:53:14.454 [Cloud] End of cloud request. 2026-09-10T21:53:14.970 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T21:54:04.797 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T21:54:04.797 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T21:54:04.797 [Cloud] Queued cloud request. 2026-09-10T21:54:04.797 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T21:54:04.797 [Cloud] Dequeued cloud request. 2026-09-10T21:54:04.797 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T21:54:04.891 [Cloud] End of cloud request. 2026-09-10T21:54:05.407 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T21:58:05.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T21:58:05.672 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T21:58:05.672 [Cloud] Queued cloud request. 2026-09-10T21:58:05.672 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T21:58:05.672 [Cloud] Dequeued cloud request. 2026-09-10T21:58:05.672 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T21:58:05.813 [Cloud] End of cloud request. 2026-09-10T21:58:06.328 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:00:39.922 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:00:39.922 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:00:39.922 [Cloud] Queued cloud request. 2026-09-10T22:00:39.922 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:00:39.922 [Cloud] Dequeued cloud request. 2026-09-10T22:00:39.922 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{48C462FD-C150-D21A-1DD6-53DBAC5633C2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 22:00:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T22:00:40.078 [Cloud] End of cloud request. 2026-09-10T22:00:40.594 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:02:36.860 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:02:36.860 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:02:36.860 [Cloud] Queued cloud request. 2026-09-10T22:02:36.860 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:02:36.860 [Cloud] Dequeued cloud request. 2026-09-10T22:02:36.860 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:02:37.016 [Cloud] End of cloud request. 2026-09-10T22:02:37.516 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:04:53.047 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T22:07:33.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:07:33.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:07:33.297 [Cloud] Queued cloud request. 2026-09-10T22:07:33.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:07:33.297 [Cloud] Dequeued cloud request. 2026-09-10T22:07:33.312 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:07:33.500 [Cloud] End of cloud request. 2026-09-10T22:07:34.000 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:11:43.203 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:11:43.203 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:11:43.203 [Cloud] Queued cloud request. 2026-09-10T22:11:43.203 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:11:43.203 [Cloud] Dequeued cloud request. 2026-09-10T22:11:43.203 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:11:43.390 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{75FC1C19-8A1B-3D8F-BB1A-04ED3DF17739} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 22:11:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T22:11:43.906 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:17:33.109 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:17:33.109 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:17:33.109 [Cloud] Queued cloud request. 2026-09-10T22:17:33.109 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:17:33.109 [Cloud] Dequeued cloud request. 2026-09-10T22:17:33.109 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:17:33.296 [Cloud] End of cloud request. 2026-09-10T22:17:33.812 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:19:58.046 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T22:22:47.827 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:22:47.827 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:22:47.827 [Cloud] Queued cloud request. 2026-09-10T22:22:47.827 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:22:47.827 [Cloud] Dequeued cloud request. 2026-09-10T22:22:47.827 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:22:48.046 [Cloud] End of cloud request. 2026-09-10T22:22:48.546 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:25:11.139 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:25:11.139 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:25:11.139 [Cloud] Queued cloud request. 2026-09-10T22:25:11.139 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:25:11.139 [Cloud] Dequeued cloud request. 2026-09-10T22:25:11.139 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:25:11.327 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F153B7BB-7487-D730-E954-B42C52FF969B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 22:25:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T22:25:11.827 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:27:24.389 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:27:24.389 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:27:24.389 [Cloud] Queued cloud request. 2026-09-10T22:27:24.389 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:27:24.389 [Cloud] Dequeued cloud request. 2026-09-10T22:27:24.389 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:27:24.577 [Cloud] End of cloud request. 2026-09-10T22:27:25.077 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:28:48.280 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:28:48.280 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:28:48.280 [Cloud] Queued cloud request. 2026-09-10T22:28:48.280 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:28:48.280 [Cloud] Dequeued cloud request. 2026-09-10T22:28:48.280 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:28:48.467 [Cloud] End of cloud request. 2026-09-10T22:28:48.983 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:30:05.170 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:30:05.170 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:30:05.170 [Cloud] Queued cloud request. 2026-09-10T22:30:05.170 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:30:05.170 [Cloud] Dequeued cloud request. 2026-09-10T22:30:05.186 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:30:05.358 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{38256CC1-448E-4FFD-5A4C-49E4A88539C0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 22:30:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T22:30:05.873 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:35:03.045 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T22:46:39.811 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:46:39.811 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:46:39.811 [Cloud] Queued cloud request. 2026-09-10T22:46:39.811 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:46:39.811 [Cloud] Dequeued cloud request. 2026-09-10T22:46:39.811 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:46:40.013 [Cloud] End of cloud request. 2026-09-10T22:46:40.513 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:50:08.044 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T22:51:03.357 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:51:03.357 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:51:03.357 [Cloud] Queued cloud request. 2026-09-10T22:51:03.357 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:51:03.357 [Cloud] Dequeued cloud request. 2026-09-10T22:51:03.357 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:51:03.544 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0FC52371-E83D-CFE0-AB35-C635B2A3D51B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 22:51:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T22:51:04.044 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:54:35.982 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:54:35.982 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:54:35.982 [Cloud] Queued cloud request. 2026-09-10T22:54:35.982 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:54:35.982 [Cloud] Dequeued cloud request. 2026-09-10T22:54:35.982 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:54:36.169 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{68790AEC-AB21-E2BF-748A-6A71EB6FAB81} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 22:54:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T22:54:36.669 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T22:59:29.903 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T22:59:29.903 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T22:59:29.903 [Cloud] Queued cloud request. 2026-09-10T22:59:29.903 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T22:59:29.903 [Cloud] Dequeued cloud request. 2026-09-10T22:59:29.903 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T22:59:30.044 [Cloud] End of cloud request. 2026-09-10T22:59:30.559 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{3ABC2C5F-9827-5E82-F4AB-6FAEBF22388A} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-10-2026 23:00:02 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T23:00:02.763 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T23:00:02.763 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T23:00:02.763 [Cloud] Queued cloud request. 2026-09-10T23:00:02.763 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T23:00:02.763 [Cloud] Dequeued cloud request. 2026-09-10T23:00:02.763 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T23:00:12.856 [Cloud] End of cloud request. 2026-09-10T23:00:13.356 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T23:01:26.059 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T23:01:26.059 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T23:01:26.059 [Cloud] Queued cloud request. 2026-09-10T23:01:26.059 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T23:01:26.059 [Cloud] Dequeued cloud request. 2026-09-10T23:01:26.059 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T23:01:26.216 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F1BF84CD-A9DE-A82E-01B9-5774A89087D1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 23:01:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T23:01:26.716 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T23:05:13.044 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T23:08:09.871 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T23:08:09.871 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T23:08:09.871 [Cloud] Queued cloud request. 2026-09-10T23:08:09.871 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T23:08:09.871 [Cloud] Dequeued cloud request. 2026-09-10T23:08:09.871 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T23:08:10.027 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{02F4C9E4-F1C1-B830-21B3-ED2CEF669A47} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 23:08:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T23:08:10.543 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T23:13:19.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T23:13:19.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T23:13:19.387 [Cloud] Queued cloud request. 2026-09-10T23:13:19.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T23:13:19.387 [Cloud] Dequeued cloud request. 2026-09-10T23:13:19.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T23:13:19.590 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{08DE89F4-3A14-662F-5D76-0A5626FFA285} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 23:13:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T23:13:20.105 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T23:19:48.480 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T23:19:48.480 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T23:19:48.480 [Cloud] Queued cloud request. 2026-09-10T23:19:48.480 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T23:19:48.480 [Cloud] Dequeued cloud request. 2026-09-10T23:19:48.480 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T23:19:48.699 [Cloud] End of cloud request. 2026-09-10T23:19:49.214 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T23:20:18.042 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T23:28:38.589 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T23:28:38.589 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T23:28:38.589 [Cloud] Queued cloud request. 2026-09-10T23:28:38.589 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T23:28:38.589 [Cloud] Dequeued cloud request. 2026-09-10T23:28:38.589 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T23:28:38.745 [Cloud] End of cloud request. 2026-09-10T23:28:39.245 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T23:29:13.245 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 188561, Count: 12474, MaxTime: 2046, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 1% 2026-09-10T23:29:13.245 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 6100, Count: 358, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-10T23:29:13.245 ProcessImageName: powershell.exe, Pid: 2732, TotalTime: 1679, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-10T23:29:13.245 ProcessImageName: WmiPrvSE.exe, Pid: 4064, TotalTime: 279, Count: 5, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-10T23:29:13.245 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 153, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-10T23:29:13.245 ProcessImageName: taskhostw.exe, Pid: 5608, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-10T23:29:13.245 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-10T23:29:13.245 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-10T23:29:13.245 ProcessImageName: taskhostw.exe, Pid: 4184, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-10T23:29:42.932 Bm signature throttled:0x000135b39c9104ce 2026-09-10T23:30:24.292 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T23:30:24.292 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T23:30:24.292 [Cloud] Queued cloud request. 2026-09-10T23:30:24.292 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T23:30:24.292 [Cloud] Dequeued cloud request. 2026-09-10T23:30:24.292 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T23:30:24.433 [Cloud] End of cloud request. 2026-09-10T23:30:24.933 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T23:34:05.011 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T23:34:05.011 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T23:34:05.011 [Cloud] Queued cloud request. 2026-09-10T23:34:05.011 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T23:34:05.011 [Cloud] Dequeued cloud request. 2026-09-10T23:34:05.011 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T23:34:05.151 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{74B51873-B960-1D53-483B-E9DAC1639DFB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 23:34:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T23:34:05.651 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T23:35:23.042 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T23:39:05.760 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T23:39:05.760 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T23:39:05.760 [Cloud] Queued cloud request. 2026-09-10T23:39:05.760 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T23:39:05.760 [Cloud] Dequeued cloud request. 2026-09-10T23:39:05.760 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T23:39:12.369 [Cloud] End of cloud request. 2026-09-10T23:39:12.885 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T23:39:19.698 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T23:39:19.698 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T23:39:19.698 [Cloud] Queued cloud request. 2026-09-10T23:39:19.698 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T23:39:19.698 [Cloud] Dequeued cloud request. 2026-09-10T23:39:19.698 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T23:39:19.776 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ACF469CD-BCAE-3BC7-69F7-EBD6C4F5E416} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 23:39:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T23:39:20.276 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T23:43:09.698 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T23:43:09.698 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T23:43:09.698 [Cloud] Queued cloud request. 2026-09-10T23:43:09.698 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T23:43:09.698 [Cloud] Dequeued cloud request. 2026-09-10T23:43:09.698 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T23:43:09.901 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{933F0C19-15BE-4F58-CC64-B1F0D954D3F7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-10-2026 23:43:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-10T23:43:10.416 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-10T23:50:28.041 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-10T23:51:28.181 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-10T23:51:28.181 [Cloud] Start of cloud request. Passive mode: 0 2026-09-10T23:51:28.181 [Cloud] Queued cloud request. 2026-09-10T23:51:28.181 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-10T23:51:28.181 [Cloud] Dequeued cloud request. 2026-09-10T23:51:28.338 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-10T23:51:28.525 [Cloud] End of cloud request. 2026-09-10T23:51:29.025 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T00:02:56.790 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T00:02:56.790 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T00:02:56.790 [Cloud] Queued cloud request. 2026-09-11T00:02:56.790 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T00:02:56.790 [Cloud] Dequeued cloud request. 2026-09-11T00:02:56.790 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T00:02:56.946 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AF74FB12-29F5-4983-3493-5A48E81C80C2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 00:02:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T00:02:57.462 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T00:05:33.040 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T00:11:40.149 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T00:11:40.149 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T00:11:40.149 [Cloud] Queued cloud request. 2026-09-11T00:11:40.149 [Cloud] Dequeued cloud request. 2026-09-11T00:11:40.149 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T00:11:40.149 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T00:11:40.305 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7800CE93-BE08-9847-453B-DCC7DD6752AB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 00:11:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T00:11:40.805 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T00:14:13.727 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:57FBA0A3-0BD2-432E-8832-707C417AE960, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-11T00:14:13.727 Scheduled scan with Id 57FBA0A3-0BD2-432E-8832-707C417AE960 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-11T00:14:13.727 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-11T00:14:13.727 [SFC] System file cache build is not needed (already completed) 2026-09-11T00:14:40.227 Engine:Triggered AR EMS scan 2026-09-11T00:14:40.242 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.273 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.289 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.289 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.289 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.305 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.320 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.320 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.336 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.336 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.336 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.336 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.352 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.352 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.367 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.367 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.383 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.398 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.398 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.414 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.414 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.430 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.430 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.430 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.430 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.445 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.461 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.461 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.477 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.477 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.477 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.477 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.492 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.508 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.523 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.523 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.539 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.539 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.539 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.539 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.555 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.555 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.570 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.570 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.586 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.586 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.586 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.602 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.617 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.617 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.633 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.648 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.648 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.648 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.664 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.680 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.695 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.711 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.727 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.742 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:14:40.758 Engine:EMS scan for process: svchost pid: 1424, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-11T00:15:26.320 QuickScan:ScanID:57FBA0A3-0BD2-432E-8832-707C417AE960: Quick scan finished with error 0 2026-09-11T00:15:26.836 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-11T00:15:26.836 [RTP] Duplicating the current plugin configuration object... 2026-09-11T00:15:26.836 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-11T00:15:26.836 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-11T00:15:26.836 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-11T00:15:26.836 [RTP] No config change detected. Not updating plugin configuration. 2026-09-11T00:15:26.836 [RTP] No config changes found. No configuration switch. 2026-09-11T00:15:26.836 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-11T00:20:38.038 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T00:21:07.976 Engine:Setting original file name "powershell_ise.exe" for "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.p0e11b656#\7b7d4a8b364042c15d650a7d8cb041d4\microsoft.powershell.gpowershell.ni.dll", hr=0x0 Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0xedaca0d5 2026-09-11T00:26:31.944 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-3967099092-2644009230-141905953-500\$R30CG93\phpmyserver\help.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x3329faf726b1 2026-09-11T00:31:03.241 Bm signature throttled:0x000135b39c9104ce 2026-09-11T00:33:10.022 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T00:33:10.022 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T00:33:10.022 [Cloud] Queued cloud request. 2026-09-11T00:33:10.022 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T00:33:10.022 [Cloud] Dequeued cloud request. 2026-09-11T00:33:10.038 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T00:33:10.210 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BE75D627-D253-CED2-A40B-D9DA35D34B8C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 00:33:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T00:33:10.726 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T00:35:43.038 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T00:43:44.381 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T00:43:44.381 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T00:43:44.381 [Cloud] Queued cloud request. 2026-09-11T00:43:44.381 [Cloud] Dequeued cloud request. 2026-09-11T00:43:44.381 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T00:43:44.381 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T00:43:44.569 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{35307418-0C4F-C459-EDED-F96C38ED4CC6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 00:43:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T00:43:45.069 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T00:50:48.037 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T00:57:51.474 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T00:57:51.474 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T00:57:51.474 [Cloud] Queued cloud request. 2026-09-11T00:57:51.474 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T00:57:51.474 [Cloud] Dequeued cloud request. 2026-09-11T00:57:51.474 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T00:58:01.568 [Cloud] End of cloud request. 2026-09-11T00:58:02.068 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003946, FileId: 0x1500000000d0a7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003945, FileId: 0x6000000010b62, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003951, FileId: 0x8000000010b62, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003952, FileId: 0x1700000000d0a7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003957, FileId: 0xa000000010b62, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003958, FileId: 0x1900000000d0a7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003963, FileId: 0xc000000010b62, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003964, FileId: 0x1b00000000d0a7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003969, FileId: 0xe000000010b62, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003970, FileId: 0x1d00000000d0a7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003975, FileId: 0x10000000010b62, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003976, FileId: 0x1f00000000d0a7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.255 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003982, FileId: 0x2100000000d0a7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.255 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003981, FileId: 0x12000000010b62, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.271 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003987, FileId: 0x2300000000d0a7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.271 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003988, FileId: 0x14000000010b62, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.286 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003993, FileId: 0x16000000010b62, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.286 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003994, FileId: 0x2500000000d0a7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.302 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4003999, FileId: 0x2700000000d0a7, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.302 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4004000, FileId: 0x18000000010b62, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.333 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4004005, FileId: 0x1a000000010b62, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.333 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4004006, FileId: 0x2900000000d0a7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.333 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4004011, FileId: 0x1c000000010b62, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:02.333 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4004012, FileId: 0x2b00000000d0a7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T01:00:37.489 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:00:37.489 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:00:37.489 [Cloud] Queued cloud request. 2026-09-11T01:00:37.489 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:00:37.489 [Cloud] Dequeued cloud request. 2026-09-11T01:00:37.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:00:37.646 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{947AE718-5F47-8B38-F79E-36C84F36ABDD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 01:00:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T01:00:38.146 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:03:20.958 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:03:20.958 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:03:20.958 [Cloud] Queued cloud request. 2026-09-11T01:03:20.958 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:03:20.958 [Cloud] Dequeued cloud request. 2026-09-11T01:03:20.958 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:03:21.333 [Cloud] End of cloud request. 2026-09-11T01:03:21.849 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:04:19.739 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:04:19.739 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:04:19.739 [Cloud] Queued cloud request. 2026-09-11T01:04:19.739 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:04:19.739 [Cloud] Dequeued cloud request. 2026-09-11T01:04:19.739 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:04:19.833 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{30CA3E51-C489-02F5-3FB2-77CBE7752BA2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 01:04:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T01:04:20.349 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:04:36.317 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:04:36.317 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:04:36.317 [Cloud] Queued cloud request. 2026-09-11T01:04:36.317 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:04:36.317 [Cloud] Dequeued cloud request. 2026-09-11T01:04:36.317 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:04:36.395 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9BDCB986-5AFB-4289-D997-1EE720AB17DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 01:04:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T01:04:36.911 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:04:43.630 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:04:43.630 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:04:43.630 [Cloud] Queued cloud request. 2026-09-11T01:04:43.630 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:04:43.630 [Cloud] Dequeued cloud request. 2026-09-11T01:04:43.630 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:04:53.661 [Cloud] End of cloud request. 2026-09-11T01:04:54.161 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:05:53.036 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T01:08:13.801 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:08:13.801 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:08:13.801 [Cloud] Queued cloud request. 2026-09-11T01:08:13.801 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:08:13.801 [Cloud] Dequeued cloud request. 2026-09-11T01:08:13.801 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:08:13.958 [Cloud] End of cloud request. 2026-09-11T01:08:14.458 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:13:55.379 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:13:55.379 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:13:55.379 [Cloud] Queued cloud request. 2026-09-11T01:13:55.379 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:13:55.379 [Cloud] Dequeued cloud request. 2026-09-11T01:13:55.395 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:13:55.552 [Cloud] End of cloud request. 2026-09-11T01:13:56.067 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:14:13.348 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:14:13.348 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:14:13.348 [Cloud] Queued cloud request. 2026-09-11T01:14:13.348 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:14:13.348 [Cloud] Dequeued cloud request. 2026-09-11T01:14:13.348 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:14:13.426 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{46CF2155-97EA-B999-85B1-F90D590FCEB0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 01:14:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T01:14:13.929 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:20:58.035 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T01:24:45.831 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:24:45.831 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:24:45.831 [Cloud] Queued cloud request. 2026-09-11T01:24:45.831 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:24:45.831 [Cloud] Dequeued cloud request. 2026-09-11T01:24:45.847 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:24:46.050 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EC9C2C64-DEDB-5B09-A6F0-2591442DC189} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 01:24:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T01:24:46.566 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:29:13.253 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 364051, Count: 24528, MaxTime: 2046, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 1% 2026-09-11T01:29:13.253 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 7626, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-11T01:29:13.253 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 2275, Count: 119, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-11T01:29:13.253 ProcessImageName: powershell.exe, Pid: 2732, TotalTime: 1679, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-11T01:29:13.253 ProcessImageName: AgentShellService.exe, Pid: 4844, TotalTime: 824, Count: 22, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 49% 2026-09-11T01:29:13.253 ProcessImageName: WmiPrvSE.exe, Pid: 6404, TotalTime: 585, Count: 18, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\mrxsmb.sys, EstimatedImpact: 9% 2026-09-11T01:29:13.253 ProcessImageName: WmiPrvSE.exe, Pid: 1940, TotalTime: 452, Count: 36, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-11T01:29:13.253 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 396, Count: 21, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-11T01:29:13.253 ProcessImageName: WmiPrvSE.exe, Pid: 4064, TotalTime: 279, Count: 5, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-11T01:29:13.253 ProcessImageName: taskhostw.exe, Pid: 5608, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-11T01:29:13.253 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 91, Count: 52, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2.MAI, EstimatedImpact: 23% 2026-09-11T01:29:13.253 ProcessImageName: DeviceCensus.exe, Pid: 1504, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-11T01:29:13.253 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-11T01:29:13.253 ProcessImageName: mysqldump.exe, Pid: 6864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 8% 2026-09-11T01:29:13.253 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-11T01:29:13.253 ProcessImageName: powershell.exe, Pid: 7848, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-11T01:29:13.253 ProcessImageName: taskhostw.exe, Pid: 4184, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-11T01:33:09.034 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:33:09.034 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:33:09.034 [Cloud] Queued cloud request. 2026-09-11T01:33:09.034 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:33:09.034 [Cloud] Dequeued cloud request. 2026-09-11T01:33:09.034 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:33:09.175 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3DDDEBCA-7F78-FAD9-5F96-046CF45746EF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 01:33:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T01:33:09.675 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:34:38.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:34:38.097 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:34:38.097 [Cloud] Queued cloud request. 2026-09-11T01:34:38.097 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:34:38.097 [Cloud] Dequeued cloud request. 2026-09-11T01:34:38.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:34:38.269 [Cloud] End of cloud request. 2026-09-11T01:34:38.784 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:35:36.065 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:35:36.065 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:35:36.065 [Cloud] Queued cloud request. 2026-09-11T01:35:36.065 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:35:36.065 [Cloud] Dequeued cloud request. 2026-09-11T01:35:36.065 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:35:36.175 [Cloud] End of cloud request. 2026-09-11T01:35:36.690 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:36:03.034 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T01:41:39.300 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:41:39.300 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:41:39.300 [Cloud] Queued cloud request. 2026-09-11T01:41:39.300 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:41:39.300 [Cloud] Dequeued cloud request. 2026-09-11T01:41:39.300 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:41:39.518 [Cloud] End of cloud request. 2026-09-11T01:41:40.018 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:44:06.987 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:44:06.987 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:44:06.987 [Cloud] Queued cloud request. 2026-09-11T01:44:06.987 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:44:06.987 [Cloud] Dequeued cloud request. 2026-09-11T01:44:06.987 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:44:07.190 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{82150810-E37A-997A-2BCF-7084B46E0EBD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 01:44:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T01:44:07.690 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:44:56.596 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:44:56.596 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:44:56.596 [Cloud] Queued cloud request. 2026-09-11T01:44:56.596 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:44:56.596 [Cloud] Dequeued cloud request. 2026-09-11T01:44:56.596 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{02EAC7DA-E54C-F702-8613-72F01EE725A5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 01:44:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T01:44:56.705 [Cloud] End of cloud request. 2026-09-11T01:44:57.205 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e 2026-09-11T01:46:05.190 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7 2026-09-11T01:46:05.205 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:46:05.205 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:46:05.205 [Cloud] Queued cloud request. 2026-09-11T01:46:05.205 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:46:05.205 [Cloud] Dequeued cloud request. 2026-09-11T01:46:05.205 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:46:05.752 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-09-11T01:46:05.752 [Cloud] End of cloud request. 2026-09-11T01:46:06.268 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:47:27.018 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:47:27.018 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:47:27.018 [Cloud] Queued cloud request. 2026-09-11T01:47:27.018 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:47:27.018 [Cloud] Dequeued cloud request. 2026-09-11T01:47:27.018 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:47:27.221 [Cloud] End of cloud request. 2026-09-11T01:47:27.736 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T01:51:08.033 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T01:53:44.502 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T01:53:44.502 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T01:53:44.502 [Cloud] Queued cloud request. 2026-09-11T01:53:44.502 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T01:53:44.502 [Cloud] Dequeued cloud request. 2026-09-11T01:53:44.502 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T01:53:44.892 [Cloud] End of cloud request. 2026-09-11T01:53:45.408 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T02:06:13.032 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T02:08:08.516 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T02:08:08.516 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T02:08:08.516 [Cloud] Queued cloud request. 2026-09-11T02:08:08.516 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T02:08:08.516 [Cloud] Dequeued cloud request. 2026-09-11T02:08:08.532 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T02:08:08.688 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BB7939A8-BDDB-5F32-EF4C-9E34F4301707} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 02:08:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T02:08:09.188 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T02:14:50.172 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T02:14:50.172 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T02:14:50.172 [Cloud] Queued cloud request. 2026-09-11T02:14:50.172 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T02:14:50.172 [Cloud] Dequeued cloud request. 2026-09-11T02:14:50.172 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T02:14:50.329 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E70A6AC-5E62-6000-8234-6C305C35C502} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 02:14:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T02:14:50.829 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T02:21:18.031 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T02:36:23.030 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T02:47:27.420 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T02:47:27.420 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T02:47:27.420 [Cloud] Queued cloud request. 2026-09-11T02:47:27.420 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T02:47:27.420 [Cloud] Dequeued cloud request. 2026-09-11T02:47:27.420 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T02:47:27.561 [Cloud] End of cloud request. 2026-09-11T02:47:28.061 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T02:50:30.795 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T02:50:30.795 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T02:50:30.795 [Cloud] Queued cloud request. 2026-09-11T02:50:30.795 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T02:50:30.795 [Cloud] Dequeued cloud request. 2026-09-11T02:50:30.810 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T02:50:30.935 [Cloud] End of cloud request. 2026-09-11T02:50:31.451 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T02:51:01.420 [RTP] [Mini-filter] Unsuccessful scan status(#27): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048019, FileId: 0x1d00000000d317, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.420 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048018, FileId: 0xd000000011e6d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.435 [RTP] [Mini-filter] Unsuccessful scan status(#29): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-3.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048023, FileId: 0x1e00000000d317, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.435 [RTP] [Mini-filter] Unsuccessful scan status(#28): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-3.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048022, FileId: 0xe000000011e6d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.435 [RTP] [Mini-filter] Unsuccessful scan status(#31): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-5.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048027, FileId: 0x1f00000000d317, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.435 [RTP] [Mini-filter] Unsuccessful scan status(#30): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-5.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048026, FileId: 0xf000000011e6d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.451 [RTP] [Mini-filter] Unsuccessful scan status(#33): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-7.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048031, FileId: 0x2000000000d317, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.451 [RTP] [Mini-filter] Unsuccessful scan status(#32): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-7.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048030, FileId: 0x10000000011e6d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.451 [RTP] [Mini-filter] Unsuccessful scan status(#35): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-9.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048035, FileId: 0x2100000000d317, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.451 [RTP] [Mini-filter] Unsuccessful scan status(#34): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-9.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048034, FileId: 0x11000000011e6d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.451 [RTP] [Mini-filter] Unsuccessful scan status(#36): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048038, FileId: 0x12000000011e6d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.467 [RTP] [Mini-filter] Unsuccessful scan status(#37): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048039, FileId: 0x2200000000d317, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.467 [RTP] [Mini-filter] Unsuccessful scan status(#39): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048043, FileId: 0x2300000000d317, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.467 [RTP] [Mini-filter] Unsuccessful scan status(#38): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048042, FileId: 0x13000000011e6d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.467 [RTP] [Mini-filter] Unsuccessful scan status(#41): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048047, FileId: 0x2400000000d317, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.467 [RTP] [Mini-filter] Unsuccessful scan status(#40): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048046, FileId: 0x14000000011e6d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.482 [RTP] [Mini-filter] Unsuccessful scan status(#42): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-11.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048050, FileId: 0x15000000011e6d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:01.482 [RTP] [Mini-filter] Unsuccessful scan status(#43): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fe57-11.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4048051, FileId: 0x2500000000d317, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T02:51:28.029 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T02:54:29.169 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T02:54:29.169 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T02:54:29.169 [Cloud] Queued cloud request. 2026-09-11T02:54:29.169 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T02:54:29.169 [Cloud] Dequeued cloud request. 2026-09-11T02:54:29.169 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T02:54:29.326 [Cloud] End of cloud request. 2026-09-11T02:54:29.841 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T02:55:40.529 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T02:55:40.529 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T02:55:40.529 [Cloud] Queued cloud request. 2026-09-11T02:55:40.529 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T02:55:40.529 [Cloud] Dequeued cloud request. 2026-09-11T02:55:40.529 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T02:55:40.669 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{347AB281-C605-0F9B-AA27-E288BE6799DF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 02:55:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T02:55:41.169 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:00:37.981 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:00:37.981 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:00:37.981 [Cloud] Queued cloud request. 2026-09-11T03:00:37.981 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:00:38.138 [Cloud] Dequeued cloud request. 2026-09-11T03:00:38.138 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:00:38.278 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{156B83A1-010D-975B-2AFB-1654BA34E40D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 03:00:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T03:00:38.794 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:05:11.325 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:05:11.340 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:05:11.340 [Cloud] Queued cloud request. 2026-09-11T03:05:11.340 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:05:11.340 [Cloud] Dequeued cloud request. 2026-09-11T03:05:11.340 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:05:11.497 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{78475E18-8DED-EF93-7EA8-0BAE5BD197AB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 03:05:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T03:05:11.997 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:06:33.028 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T03:07:02.794 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:07:02.794 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:07:02.794 [Cloud] Queued cloud request. 2026-09-11T03:07:02.794 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:07:02.794 [Cloud] Dequeued cloud request. 2026-09-11T03:07:02.809 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:07:02.965 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5D2D3692-38F2-F29E-1A72-5F061C370FB2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 03:07:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T03:07:03.465 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:07:04.028 [AutoPurge] Cleanup Routine tasks have started. 2026-09-11T03:07:04.028 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-11T03:07:04.028 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-11T03:07:04.028 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-11T03:07:04.028 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-11T03:07:04.028 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-11T03:07:04.028 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-11T03:07:04.044 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-11T03:07:04.044 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-11T03:07:04.044 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 3, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-11-2026 03:07:04 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-11-2026 03:07:04 2026-09-11T03:07:04.059 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-11T03:07:04.059 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-11T03:07:04.059 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-11T03:07:04.059 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-11T03:07:04.059 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-11T03:07:04.169 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-11T03:07:04.278 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-11T03:07:04.309 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-11T03:07:04.325 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-11T03:07:04.325 [AutoPurge] Removing expired default signature package ... 2026-09-11T03:07:04.731 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-11T03:07:04.762 Job Notification: New process added to job (5620) 2026-09-11T03:07:04.981 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-11T03:07:05.575 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:07:06.137 Job Notification: Process exited from job (5620) 2026-09-11T03:07:06.231 [AutoPurge] Verification Routine tasks have ended. 2026-09-11T03:07:06.497 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-11T03:07:06.622 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-11T03:07:07.200 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-11T03:07:07.309 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-11T03:07:07.512 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-11T03:07:09.575 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_mi.dll", hr=0x0 2026-09-11T03:07:09.653 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-11T03:07:10.106 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-11T03:07:10.387 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-11T03:07:10.403 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:10.637 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-11T03:07:11.450 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-11T03:07:12.278 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-11T03:07:12.434 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-11T03:07:12.606 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-11T03:07:12.887 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:07:12.965 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psuser_arm64.dll", hr=0x0 2026-09-11T03:07:13.247 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-11T03:07:13.762 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-11T03:07:13.809 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ko.dll", hr=0x0 2026-09-11T03:07:13.934 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-11T03:07:14.169 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:14.309 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:14.387 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-11T03:07:14.403 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-11T03:07:14.747 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:07:14.840 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-11T03:07:14.903 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-11T03:07:14.903 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.695_none_7572f17cd4648630\penimc.dll", hr=0x0 2026-09-11T03:07:14.950 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ro.dll", hr=0x0 2026-09-11T03:07:14.997 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-11T03:07:15.137 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-11T03:07:15.731 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:15.794 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-11T03:07:16.122 Engine:Setting original file name "libVoiceFabric.dll" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\voicefabric.dll", hr=0x0 2026-09-11T03:07:16.294 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ga.dll", hr=0x0 2026-09-11T03:07:16.372 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:07:16.559 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-11T03:07:17.497 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-11T03:07:18.106 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:18.309 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:07:18.481 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fil.dll", hr=0x0 2026-09-11T03:07:18.747 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-11T03:07:19.090 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fr.dll", hr=0x0 2026-09-11T03:07:19.372 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-11T03:07:19.497 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-11T03:07:20.106 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-11T03:07:20.262 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:20.872 Engine:Setting original file name "BmModels.dll" for "c:\programdata\microsoft\windows defender\models\model_5e2a8ecd-08ac-4a01-a24d-fe70f03b147c.dll", hr=0x0 2026-09-11T03:07:20.903 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:07:21.090 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-11T03:07:21.090 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-11T03:07:21.168 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psmachine.dll", hr=0x0 2026-09-11T03:07:21.200 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-11T03:07:21.434 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-11T03:07:21.528 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-11T03:07:21.590 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-11T03:07:21.684 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-11T03:07:21.793 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.695_none_daf240e70cab3235\penimc_v0400.dll", hr=0x0 2026-09-11T03:07:21.965 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-11T03:07:22.512 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-11T03:07:22.825 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-11T03:07:23.512 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-11T03:07:23.950 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_zh-tw.dll", hr=0x0 2026-09-11T03:07:25.293 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-11T03:07:25.512 Engine:Setting original file name "BmModels.dll" for "c:\programdata\microsoft\windows defender\models\model_d736908c-85f9-4e40-8415-5cdb6c7a8981.dll", hr=0x0 2026-09-11T03:07:25.903 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-11T03:07:25.950 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-11T03:07:25.997 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-11T03:07:26.012 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-11T03:07:26.044 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-11T03:07:26.215 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-11T03:07:26.497 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-11T03:07:26.528 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:26.606 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-11T03:07:27.168 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-11T03:07:27.231 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-11T03:07:27.247 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-11T03:07:27.325 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-11T03:07:27.497 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_hr.dll", hr=0x0 2026-09-11T03:07:28.012 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-11T03:07:28.231 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:28.278 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-11T03:07:28.340 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-11T03:07:28.372 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-11T03:07:28.903 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-11T03:07:29.340 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-11T03:07:29.372 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:29.918 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_th.dll", hr=0x0 2026-09-11T03:07:30.293 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-11T03:07:30.325 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-11T03:07:31.153 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:07:31.590 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-11T03:07:32.168 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-11T03:07:32.403 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-11T03:07:32.622 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:32.825 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-11T03:07:32.934 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ca-es-valencia.dll", hr=0x0 2026-09-11T03:07:33.122 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-11T03:07:33.528 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-11T03:07:33.606 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-11T03:07:34.137 Engine:Setting original file name "Microsoft Cognitive Services Speech SDK" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\microsoft.cognitiveservices.speech.extension.lu.dll", hr=0x0 2026-09-11T03:07:34.247 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-11T03:07:34.653 Engine:Setting original file name "CoreMessaging.dll" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\coremessagingxp.dll", hr=0x0 2026-09-11T03:07:34.700 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-11T03:07:34.762 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-11T03:07:34.840 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:07:35.231 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:07:35.528 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-11T03:07:35.543 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_gd.dll", hr=0x0 2026-09-11T03:07:35.668 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-11T03:07:35.856 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-11T03:07:35.887 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-11T03:07:36.262 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-11T03:07:37.059 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-11T03:07:37.622 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-11T03:07:37.778 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-11T03:07:37.918 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-11T03:07:38.090 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\microsoftedgeupdatebroker.exe", hr=0x0 2026-09-11T03:07:38.668 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\x86_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.695_none_229f77be21275b3b\penimc_v0400.dll", hr=0x0 2026-09-11T03:07:38.715 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-11T03:07:38.778 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:39.215 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-11T03:07:39.340 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-11T03:07:39.340 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-11T03:07:39.387 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-11T03:07:39.481 Engine:Setting original file name "MSHTML.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-i..tmlrendering-legacy_31bf3856ad364e35_11.0.20348.5386_none_fe665d760dfcbf57\mshtml.dll.mun", hr=0x0 2026-09-11T03:07:39.559 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-11T03:07:39.590 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-11T03:07:39.653 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-11T03:07:40.137 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-11T03:07:40.137 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-11T03:07:40.575 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-11T03:07:40.793 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-11T03:07:40.918 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-11T03:07:40.918 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-11T03:07:41.215 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:07:41.543 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-11T03:07:41.934 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.20348.3451_none_87d480d8b356cff3\apphelp.dll", hr=0x0 2026-09-11T03:07:42.075 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:07:42.543 Engine:Setting original file name "propsys.dll" for "c:\windows\winsxs\amd64_microsoft-windows-propsys_31bf3856ad364e35_7.0.20348.5386_none_cc9e52b39cfe064e\propsys.dll.mun", hr=0x0 2026-09-11T03:07:42.575 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-11T03:07:42.747 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-11T03:07:43.215 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-11T03:07:43.231 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-11T03:07:43.418 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-11T03:07:43.575 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-11T03:07:44.262 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-11T03:07:44.325 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-11T03:07:44.590 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-11T03:07:44.606 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-11T03:07:45.075 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-11T03:07:45.153 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-11T03:07:45.575 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:07:45.668 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.20348.5386_none_ff775c057dcff4c1\edgehtml.dll.mun", hr=0x0 2026-09-11T03:07:46.121 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:07:46.278 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-11T03:07:46.340 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-11T03:07:47.106 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-11T03:07:47.121 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-11T03:07:47.450 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-11T03:07:47.637 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-11T03:07:48.200 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-11T03:07:49.059 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fa.dll", hr=0x0 2026-09-11T03:07:49.075 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:07:49.278 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_de.dll", hr=0x0 2026-09-11T03:07:49.293 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-11T03:07:49.809 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-11T03:07:50.200 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-11T03:07:50.403 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-11T03:07:50.450 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:50.450 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-11T03:07:50.465 Engine:Setting original file name "chakra.dll" for "c:\windows\winsxs\amd64_microsoft-windows-scripting-chakra_31bf3856ad364e35_11.0.20348.5386_none_af92b8d8361dbd13\chakra.dll.mun", hr=0x0 2026-09-11T03:07:50.528 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ca.dll", hr=0x0 2026-09-11T03:07:50.606 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-11T03:07:50.887 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-11T03:07:51.309 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-11T03:07:51.387 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-11T03:07:51.653 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-11T03:07:51.668 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sl.dll", hr=0x0 2026-09-11T03:07:52.043 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-11T03:07:52.090 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-11T03:07:52.450 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:07:52.746 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-11T03:07:52.965 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-11T03:07:53.418 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_da.dll", hr=0x0 2026-09-11T03:07:53.934 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:07:54.028 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-11T03:07:54.153 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-11T03:07:54.200 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-11T03:07:55.543 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\wpf\naturallanguage6.dll", hr=0x0 2026-09-11T03:07:55.637 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-11T03:07:55.746 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-11T03:07:55.996 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-11T03:07:56.262 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-11T03:07:56.465 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-11T03:07:57.340 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-11T03:07:57.387 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-11T03:07:57.403 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-11T03:07:57.496 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-11T03:07:57.621 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-11T03:07:58.028 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-11T03:07:58.200 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-11T03:07:58.231 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-11T03:07:58.246 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-11T03:07:58.371 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-11T03:07:58.481 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-11T03:07:58.512 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-11T03:07:58.934 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-11T03:07:58.981 Engine:Setting original file name "MicrosoftEdgeUpdate.exe" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\microsoftedgeupdatecore.exe", hr=0x0 2026-09-11T03:07:59.090 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-11T03:07:59.668 Engine:Setting original file name "copilotapphost.dll" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\copilotapphost.exe", hr=0x0 2026-09-11T03:07:59.684 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-11T03:07:59.856 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:00.215 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-11T03:08:00.653 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-11T03:08:00.731 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-11T03:08:01.028 Engine:Setting original file name " " for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\dxcompiler.dll", hr=0x0 2026-09-11T03:08:01.278 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-11T03:08:01.543 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-11T03:08:01.606 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-11T03:08:01.746 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:01.934 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:02.184 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-11T03:08:02.293 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-11T03:08:02.481 Engine:Setting original file name "mpasdlta.vdm" for "c:\programdata\microsoft\windows defender\definition updates\backup\mpasdlta.lkg", hr=0x0 2026-09-11T03:08:02.653 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:08:02.825 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-11T03:08:02.934 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:03.246 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:08:03.293 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-11T03:08:03.356 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-11T03:08:03.575 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-11T03:08:03.621 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-11T03:08:03.637 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-11T03:08:04.200 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-11T03:08:04.278 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-11T03:08:04.309 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_cs.dll", hr=0x0 2026-09-11T03:08:04.325 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-11T03:08:04.418 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:04.684 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:08:04.918 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-11T03:08:05.653 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-11T03:08:05.809 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-11T03:08:05.840 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_bn.dll", hr=0x0 2026-09-11T03:08:05.887 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-11T03:08:06.184 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-11T03:08:06.215 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-11T03:08:06.278 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-11T03:08:06.700 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-11T03:08:06.746 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-11T03:08:07.137 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-11T03:08:07.215 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-11T03:08:07.246 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\microsoftedgeupdateondemand.exe", hr=0x0 2026-09-11T03:08:07.278 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-11T03:08:07.293 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:07.309 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-11T03:08:07.356 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:08:07.356 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-11T03:08:07.387 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:07.684 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ja.dll", hr=0x0 2026-09-11T03:08:08.075 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-11T03:08:08.403 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-11T03:08:08.762 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:08.809 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-11T03:08:09.059 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_lv.dll", hr=0x0 2026-09-11T03:08:09.090 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:09.106 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:08:09.200 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sq.dll", hr=0x0 2026-09-11T03:08:09.278 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-11T03:08:09.278 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_eu.dll", hr=0x0 2026-09-11T03:08:09.700 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:09.715 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-11T03:08:09.981 Engine:Setting original file name "mini_installer.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{56eb18f8-b008-4cbd-b6d2-8c97fe7e9062}\152.0.4191.66\microsoftedge_x64_152.0.4191.66_152.0.4191.62.exe", hr=0x0 2026-09-11T03:08:10.153 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-11T03:08:10.168 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-11T03:08:10.340 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-11T03:08:10.450 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-11T03:08:10.465 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-11T03:08:10.731 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-11T03:08:10.762 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-11T03:08:10.778 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-11T03:08:10.950 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_az.dll", hr=0x0 2026-09-11T03:08:10.981 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-11T03:08:11.168 Engine:Setting original file name "dnsapi" for "c:\windows\winsxs\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.20348.5386_none_485c938889b83d9d\dnsapi.dll", hr=0x0 2026-09-11T03:08:11.231 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:11.543 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-11T03:08:11.918 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\winsxs\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.20348.3692_none_ea9c313aecda491b\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-11T03:08:12.059 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-11T03:08:12.184 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-11T03:08:12.387 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-11T03:08:12.575 Engine:Setting original file name "Vulkan Runtime" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\vulkan-1.dll", hr=0x0 2026-09-11T03:08:12.590 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-11T03:08:12.606 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-11T03:08:12.621 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:08:12.871 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-11T03:08:12.903 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-11T03:08:13.137 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:13.293 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-11T03:08:13.309 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-11T03:08:13.809 Engine:Setting original file name "osloader.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5386_none_03a2efa89ed8c204\winload.exe", hr=0x0 2026-09-11T03:08:14.278 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:08:14.278 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-11T03:08:14.418 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-11T03:08:14.590 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:08:14.606 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:08:14.793 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_hi.dll", hr=0x0 2026-09-11T03:08:15.762 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:16.465 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-11T03:08:16.778 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:16.793 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-11T03:08:17.012 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psuser.dll", hr=0x0 2026-09-11T03:08:17.059 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:17.090 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-11T03:08:17.215 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-11T03:08:17.418 Engine:Setting original file name "libcrypto" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\libcrypto-3-x64.dll", hr=0x0 2026-09-11T03:08:17.450 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-11T03:08:17.450 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_el.dll", hr=0x0 2026-09-11T03:08:17.528 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-11T03:08:17.762 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.265.7\microsoftedgeupdatesetup_x86_1.3.265.7.exe", hr=0x0 2026-09-11T03:08:17.950 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-11T03:08:17.996 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:18.309 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:08:18.325 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:18.387 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-11T03:08:19.075 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-11T03:08:19.731 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-11T03:08:19.762 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:19.840 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-11T03:08:19.981 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:20.262 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:20.340 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-11T03:08:20.512 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sr.dll", hr=0x0 2026-09-11T03:08:20.731 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-11T03:08:21.340 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:21.371 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-11T03:08:21.746 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:08:21.934 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-11T03:08:22.184 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-11T03:08:22.200 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:22.543 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-11T03:08:23.012 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-11T03:08:23.043 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:23.184 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:23.387 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-11T03:08:23.418 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-11T03:08:23.871 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-11T03:08:23.996 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:24.200 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-11T03:08:24.231 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-11T03:08:24.246 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:24.309 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:24.496 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-11T03:08:24.575 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:24.606 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ka.dll", hr=0x0 2026-09-11T03:08:25.075 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-11T03:08:25.153 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_en.dll", hr=0x0 2026-09-11T03:08:25.200 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-11T03:08:25.668 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_pt-pt.dll", hr=0x0 2026-09-11T03:08:25.856 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-11T03:08:25.934 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-11T03:08:26.043 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-11T03:08:26.184 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-11T03:08:26.231 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:26.278 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-11T03:08:26.325 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-11T03:08:27.043 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-11T03:08:27.246 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-11T03:08:27.621 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-11T03:08:27.637 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-11T03:08:28.043 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-11T03:08:28.043 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:28.450 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-11T03:08:28.887 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-11T03:08:29.246 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-11T03:08:29.325 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-11T03:08:29.387 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-11T03:08:29.450 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:29.606 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-11T03:08:29.668 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-11T03:08:29.731 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-11T03:08:29.825 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-11T03:08:30.246 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-11T03:08:30.293 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:08:30.356 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:08:30.996 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-11T03:08:31.107 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:08:31.387 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-11T03:08:31.684 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-11T03:08:31.965 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_mk.dll", hr=0x0 2026-09-11T03:08:32.043 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-11T03:08:32.059 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:32.137 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ml.dll", hr=0x0 2026-09-11T03:08:32.496 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-11T03:08:32.496 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-11T03:08:32.559 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-11T03:08:32.746 Engine:Setting original file name "ScreenMagnifier.exe" for "c:\windows\winsxs\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.20348.5256_none_16b1dbf0cadc5989\magnify.exe.mun", hr=0x0 2026-09-11T03:08:32.856 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-11T03:08:33.153 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-11T03:08:33.168 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-11T03:08:33.606 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-11T03:08:33.700 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-11T03:08:33.840 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-11T03:08:33.950 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:33.981 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-11T03:08:34.168 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-11T03:08:34.418 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-11T03:08:34.637 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-11T03:08:34.731 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-11T03:08:34.965 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-11T03:08:35.215 Engine:Setting original file name "DWriteCore" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\dwritecore.dll", hr=0x0 2026-09-11T03:08:36.825 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-11T03:08:37.404 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-11T03:08:37.606 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-11T03:08:37.950 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:38.012 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_tr.dll", hr=0x0 2026-09-11T03:08:38.356 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-11T03:08:38.590 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-11T03:08:38.965 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-11T03:08:39.293 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-11T03:08:39.403 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-11T03:08:39.434 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-11T03:08:39.450 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-11T03:08:39.590 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-11T03:08:40.059 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-11T03:08:40.090 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:40.090 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-11T03:08:40.168 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-11T03:08:40.200 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-11T03:08:40.309 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-11T03:08:40.606 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sk.dll", hr=0x0 2026-09-11T03:08:40.700 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-11T03:08:40.840 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-11T03:08:41.059 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-11T03:08:41.075 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:41.215 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-11T03:08:41.231 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-11T03:08:41.465 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-11T03:08:41.528 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:08:41.871 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-11T03:08:42.106 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_it.dll", hr=0x0 2026-09-11T03:08:42.304 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-11T03:08:42.371 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ms.dll", hr=0x0 2026-09-11T03:08:43.012 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:08:43.512 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-11T03:08:43.621 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-11T03:08:44.121 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-11T03:08:44.528 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:08:44.637 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:45.137 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-11T03:08:45.481 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-11T03:08:45.559 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-11T03:08:45.762 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-11T03:08:45.950 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-11T03:08:46.621 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-11T03:08:47.668 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-11T03:08:47.778 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-11T03:08:47.904 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-11T03:08:48.778 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-11T03:08:48.965 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-11T03:08:49.309 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-11T03:08:49.434 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-11T03:08:49.559 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-11T03:08:49.559 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-11T03:08:50.215 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_lb.dll", hr=0x0 2026-09-11T03:08:50.231 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-11T03:08:50.434 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-11T03:08:50.450 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:50.481 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-11T03:08:50.934 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-11T03:08:50.965 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_quz.dll", hr=0x0 2026-09-11T03:08:50.965 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:08:51.309 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-11T03:08:51.465 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-11T03:08:51.715 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psmachine_arm64.dll", hr=0x0 2026-09-11T03:08:51.746 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psmachine_64.dll", hr=0x0 2026-09-11T03:08:51.778 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fi.dll", hr=0x0 2026-09-11T03:08:51.918 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-11T03:08:52.528 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-11T03:08:52.653 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:08:52.871 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:53.090 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-11T03:08:53.512 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:53.590 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-11T03:08:53.871 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-11T03:08:53.950 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_id.dll", hr=0x0 2026-09-11T03:08:54.121 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-11T03:08:54.293 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:54.465 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-11T03:08:54.621 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_tt.dll", hr=0x0 2026-09-11T03:08:54.793 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-11T03:08:55.340 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-11T03:08:55.387 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-11T03:08:55.434 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-11T03:08:55.606 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:55.653 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-11T03:08:56.028 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sr-cyrl-rs.dll", hr=0x0 2026-09-11T03:08:56.043 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-11T03:08:56.278 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-11T03:08:56.418 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:57.653 Engine:Setting original file name "dwmcorei" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\dwmcorei.dll", hr=0x0 2026-09-11T03:08:57.653 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-11T03:08:57.715 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_et.dll", hr=0x0 2026-09-11T03:08:58.559 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-11T03:08:58.637 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-11T03:08:58.731 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-11T03:08:58.804 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-11T03:08:59.200 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:59.278 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-11T03:08:59.512 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-11T03:08:59.621 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-11T03:08:59.731 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-11T03:08:59.746 Engine:Setting original file name "Microsoft Cognitive Services Speech SDK" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\microsoft.cognitiveservices.speech.extension.codec.dll", hr=0x0 2026-09-11T03:08:59.856 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-11T03:08:59.965 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-11T03:09:00.293 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-11T03:09:00.371 Engine:Setting original file name "mssvp.dll" for "c:\windows\winsxs\amd64_windowssearchengine_31bf3856ad364e35_7.0.20348.5386_none_14595fad9de96e70\mssvp.dll.mun", hr=0x0 2026-09-11T03:09:00.403 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-11T03:09:00.840 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-11T03:09:00.918 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-11T03:09:00.996 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-11T03:09:01.012 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-11T03:09:01.028 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-11T03:09:01.043 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-11T03:09:01.184 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-11T03:09:01.200 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:09:01.231 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-11T03:09:01.309 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-11T03:09:01.778 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-11T03:09:01.809 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-11T03:09:02.231 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:09:02.309 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-11T03:09:02.340 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-11T03:09:02.356 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-11T03:09:03.371 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-11T03:09:03.528 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:09:03.746 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:09:03.746 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-11T03:09:03.950 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-11T03:09:04.215 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-11T03:09:04.371 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-11T03:09:04.465 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_nb.dll", hr=0x0 2026-09-11T03:09:04.481 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-11T03:09:05.278 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-11T03:09:05.309 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-11T03:09:05.496 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-11T03:09:05.528 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-11T03:09:05.528 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:09:06.059 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:09:06.075 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-11T03:09:06.216 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-11T03:09:06.231 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-11T03:09:06.418 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-11T03:09:07.075 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-11T03:09:07.559 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-11T03:09:07.856 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-11T03:09:08.356 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-11T03:09:08.653 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-11T03:09:08.700 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-11T03:09:08.950 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-11T03:09:08.981 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-11T03:09:09.090 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-11T03:09:09.215 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-11T03:09:09.309 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-11T03:09:09.309 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:09:09.606 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-11T03:09:09.731 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-11T03:09:10.200 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-11T03:09:10.340 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-11T03:09:10.512 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-11T03:09:10.543 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-11T03:09:10.543 OriginalFileName Maintenance::28235 files in Moac, 0 skipped (cached), 575 filename set 2026-09-11T03:09:10.543 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-11T03:11:44.184 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:11:44.184 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:11:44.184 [Cloud] Queued cloud request. 2026-09-11T03:11:44.184 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:11:44.184 [Cloud] Dequeued cloud request. 2026-09-11T03:11:44.184 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:11:54.340 [Cloud] End of cloud request. 2026-09-11T03:11:54.871 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-11T03:11:54.887 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:11:54.903 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:11:54.903 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-11T03:11:54.903 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-11T03:11:54.903 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-11T03:11:54.903 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-11T03:11:54.903 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-11T03:11:54.903 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-11T03:11:54.903 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-11T03:11:54.903 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-11T03:11:54.903 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-11T03:11:54.903 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-11T03:11:54.903 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-11T03:11:54.903 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:11:54.903 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-11T03:11:54.903 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-11T03:11:54.903 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-11T03:11:54.903 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-11T03:11:54.903 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-11T03:11:54.903 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-11T03:11:54.903 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-11T03:11:54.903 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-11T03:11:54.903 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-11T03:11:54.903 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:11:54.903 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:11:57.481 [RTP] Duplicating the current plugin configuration object... 2026-09-11T03:11:57.481 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-11T03:11:57.481 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-11T03:11:57.481 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-11T03:11:57.481 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-11T03:11:57.481 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-11T03:17:27.637 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:17:27.637 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:17:27.637 [Cloud] Queued cloud request. 2026-09-11T03:17:27.637 [Cloud] Dequeued cloud request. 2026-09-11T03:17:27.637 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:17:27.637 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:17:27.840 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{10A4D941-F416-EBD3-6FC3-89DEC6392904} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 03:17:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T03:17:28.340 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:21:38.027 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T03:22:03.418 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:22:03.418 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:22:03.418 [Cloud] Queued cloud request. 2026-09-11T03:22:03.418 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:22:03.418 [Cloud] Dequeued cloud request. 2026-09-11T03:22:03.418 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:22:13.590 [Cloud] End of cloud request. 2026-09-11T03:22:14.090 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:24:20.542 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:24:20.542 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:24:20.542 [Cloud] Queued cloud request. 2026-09-11T03:24:20.542 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:24:20.542 [Cloud] Dequeued cloud request. 2026-09-11T03:24:20.542 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:24:20.730 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ACE0C0C8-14CD-F5AD-56BC-0250D468D672} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 03:24:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T03:24:21.230 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=true, source=2, resourceid=0xd681195e Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=true, source=2, resourceid=0xa9fc2db7 2026-09-11T03:29:13.245 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 586581, Count: 39857, MaxTime: 2046, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 2% 2026-09-11T03:29:13.245 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 7626, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-11T03:29:13.245 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 4865, Count: 306, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-11T03:29:13.245 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 2260, Count: 271, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\E42B523C1E0748BD919FEA9988E1EFDD.MAI, EstimatedImpact: 0% 2026-09-11T03:29:13.245 ProcessImageName: powershell.exe, Pid: 2732, TotalTime: 1679, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-11T03:29:13.245 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 1633, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\5C5638AD3B10487481E768CEC099433C.MAI, EstimatedImpact: 23% 2026-09-11T03:29:13.245 ProcessImageName: php.exe, Pid: 6468, TotalTime: 1082, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 30% 2026-09-11T03:29:13.245 ProcessImageName: AgentShellService.exe, Pid: 4844, TotalTime: 824, Count: 22, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 49% 2026-09-11T03:29:13.245 ProcessImageName: WmiPrvSE.exe, Pid: 6404, TotalTime: 585, Count: 18, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\mrxsmb.sys, EstimatedImpact: 9% 2026-09-11T03:29:13.245 ProcessImageName: WmiPrvSE.exe, Pid: 1940, TotalTime: 452, Count: 36, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-11T03:29:13.245 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 426, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-11T03:29:13.245 ProcessImageName: powershell.exe, Pid: 7300, TotalTime: 340, Count: 23, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 20% 2026-09-11T03:29:13.245 ProcessImageName: WmiPrvSE.exe, Pid: 4064, TotalTime: 279, Count: 5, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-11T03:29:13.245 ProcessImageName: python.exe, Pid: 6300, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-11T03:29:13.245 ProcessImageName: cmd.exe, Pid: 4996, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100% 2026-09-11T03:29:13.245 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 121, Count: 72, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2.MAI, EstimatedImpact: 0% 2026-09-11T03:29:13.245 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\F3E83A3B09D643F8B1E640AC1D63B48B.MAI, EstimatedImpact: 5% 2026-09-11T03:29:13.245 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-11T03:29:13.245 ProcessImageName: taskhostw.exe, Pid: 5608, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-11T03:29:13.245 ProcessImageName: DeviceCensus.exe, Pid: 1504, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-11T03:29:13.245 ProcessImageName: cmd.exe, Pid: 6388, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-11T03:29:13.245 ProcessImageName: mysqldump.exe, Pid: 6864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 8% 2026-09-11T03:29:13.245 ProcessImageName: powershell.exe, Pid: 7848, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-11T03:29:13.245 ProcessImageName: taskhostw.exe, Pid: 4184, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-11T03:30:14.870 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:30:14.870 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:30:14.870 [Cloud] Queued cloud request. 2026-09-11T03:30:14.870 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:30:14.870 [Cloud] Dequeued cloud request. 2026-09-11T03:30:14.870 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:30:15.058 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{55EF6EBC-CAD9-850D-0C20-DFBBBB39A9EF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 03:30:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T03:30:15.558 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x56d96c17 2026-09-11T03:30:47.792 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpMyAdmin\tbl_changer.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x3329faf726b1 2026-09-11T03:35:25.698 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:35:25.698 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:35:25.698 [Cloud] Queued cloud request. 2026-09-11T03:35:25.714 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:35:25.714 [Cloud] Dequeued cloud request. 2026-09-11T03:35:25.714 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:35:25.870 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D73CE23E-AC7D-D9D5-F99B-F90D6F8C8CF9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 03:35:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T03:35:26.386 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:36:43.026 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T03:38:31.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:38:31.088 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:38:31.088 [Cloud] Queued cloud request. 2026-09-11T03:38:31.088 [Cloud] Dequeued cloud request. 2026-09-11T03:38:31.088 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:38:31.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:38:31.229 [Cloud] End of cloud request. 2026-09-11T03:38:31.729 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:44:21.291 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:44:21.291 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:44:21.291 [Cloud] Queued cloud request. 2026-09-11T03:44:21.291 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:44:21.291 [Cloud] Dequeued cloud request. 2026-09-11T03:44:21.291 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:44:21.447 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B7C61B81-90B5-E531-B964-3BE2B7010E72} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 03:44:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T03:44:21.947 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:48:27.822 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:48:27.822 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:48:27.822 [Cloud] Queued cloud request. 2026-09-11T03:48:27.822 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:48:27.822 [Cloud] Dequeued cloud request. 2026-09-11T03:48:27.822 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:48:27.978 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{382ECA7A-21B3-741B-89C3-E95852217E5F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 03:48:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T03:48:28.494 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:49:13.853 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T03:49:13.853 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T03:49:13.853 [Cloud] Queued cloud request. 2026-09-11T03:49:13.853 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T03:49:13.853 [Cloud] Dequeued cloud request. 2026-09-11T03:49:14.025 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T03:49:14.103 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ADD3D11B-8065-FCCA-C570-164CBD0A36FE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 03:49:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T03:49:14.619 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T03:51:48.025 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T04:01:59.915 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T04:01:59.915 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T04:01:59.915 [Cloud] Queued cloud request. 2026-09-11T04:01:59.915 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T04:01:59.915 [Cloud] Dequeued cloud request. 2026-09-11T04:01:59.915 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T04:02:05.634 [Cloud] End of cloud request. 2026-09-11T04:02:06.150 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T04:03:19.493 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T04:03:19.493 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T04:03:19.493 [Cloud] Queued cloud request. 2026-09-11T04:03:19.493 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T04:03:19.493 [Cloud] Dequeued cloud request. 2026-09-11T04:03:19.493 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T04:03:19.665 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3426BF70-F3D6-7231-4024-11B782F46644} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 04:03:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T04:03:20.181 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T04:06:53.024 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T04:21:58.023 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T04:26:37.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T04:26:37.445 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T04:26:37.445 [Cloud] Queued cloud request. 2026-09-11T04:26:37.445 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T04:26:37.445 [Cloud] Dequeued cloud request. 2026-09-11T04:26:37.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T04:26:37.632 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{646ED9DD-1733-B51F-2721-3E42F5670B56} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 04:26:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T04:26:38.148 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T04:26:59.570 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T04:26:59.570 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T04:26:59.570 [Cloud] Queued cloud request. 2026-09-11T04:26:59.570 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T04:26:59.570 [Cloud] Dequeued cloud request. 2026-09-11T04:26:59.570 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T04:27:00.945 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A1E8671B-DA88-71D3-22DD-313F7DC2CE0A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 04:27:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T04:27:01.460 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T04:34:12.710 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T04:34:12.710 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T04:34:12.710 [Cloud] Queued cloud request. 2026-09-11T04:34:12.710 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T04:34:12.710 [Cloud] Dequeued cloud request. 2026-09-11T04:34:12.710 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T04:34:12.960 [Cloud] End of cloud request. 2026-09-11T04:34:13.475 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T04:35:17.038 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T04:35:17.038 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T04:35:17.038 [Cloud] Queued cloud request. 2026-09-11T04:35:17.038 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T04:35:17.038 [Cloud] Dequeued cloud request. 2026-09-11T04:35:17.053 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T04:35:17.225 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8BA3B98A-E0C4-1853-7B88-E363875F7462} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 04:35:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T04:35:17.725 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T04:37:03.022 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T04:37:13.085 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T04:37:13.085 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T04:37:13.085 [Cloud] Queued cloud request. 2026-09-11T04:37:13.085 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T04:37:13.085 [Cloud] Dequeued cloud request. 2026-09-11T04:37:13.085 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T04:37:13.288 [Cloud] End of cloud request. 2026-09-11T04:37:13.788 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T04:45:46.334 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T04:45:46.334 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T04:45:46.350 [Cloud] Queued cloud request. 2026-09-11T04:45:46.350 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T04:45:46.350 [Cloud] Dequeued cloud request. 2026-09-11T04:45:46.350 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T04:45:46.522 [Cloud] End of cloud request. 2026-09-11T04:45:47.022 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T04:52:08.021 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T04:52:14.271 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T04:52:14.271 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T04:52:14.271 [Cloud] Queued cloud request. 2026-09-11T04:52:14.271 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T04:52:14.271 [Cloud] Dequeued cloud request. 2026-09-11T04:52:14.271 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T04:52:14.521 [Cloud] End of cloud request. 2026-09-11T04:52:15.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T04:54:10.834 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T04:54:10.834 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T04:54:10.834 [Cloud] Queued cloud request. 2026-09-11T04:54:10.834 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T04:54:10.834 [Cloud] Dequeued cloud request. 2026-09-11T04:54:10.834 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T04:54:10.990 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A7DF9BDC-16BE-A8A5-0F8C-233931550BAB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 04:54:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T04:54:11.490 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T04:58:34.130 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T04:58:34.130 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T04:58:34.130 [Cloud] Queued cloud request. 2026-09-11T04:58:34.130 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T04:58:34.130 [Cloud] Dequeued cloud request. 2026-09-11T04:58:34.130 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T04:58:34.286 [Cloud] End of cloud request. 2026-09-11T04:58:34.802 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:01:11.724 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:01:11.724 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:01:11.724 [Cloud] Queued cloud request. 2026-09-11T05:01:11.724 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:01:11.724 [Cloud] Dequeued cloud request. 2026-09-11T05:01:11.724 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:01:11.880 [Cloud] End of cloud request. 2026-09-11T05:01:12.396 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:02:30.380 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:02:30.380 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:02:30.380 [Cloud] Queued cloud request. 2026-09-11T05:02:30.380 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:02:30.380 [Cloud] Dequeued cloud request. 2026-09-11T05:02:30.380 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:02:30.568 [Cloud] End of cloud request. 2026-09-11T05:02:31.068 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:07:13.020 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T05:09:11.598 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:09:11.598 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:09:11.598 [Cloud] Queued cloud request. 2026-09-11T05:09:11.598 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:09:11.598 [Cloud] Dequeued cloud request. 2026-09-11T05:09:11.598 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:09:11.801 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{02E6F878-F483-2721-3D2D-3B43D6570F26} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 05:09:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T05:09:12.317 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:18:32.348 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:18:32.348 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:18:32.348 [Cloud] Queued cloud request. 2026-09-11T05:18:32.348 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:18:32.348 [Cloud] Dequeued cloud request. 2026-09-11T05:18:32.348 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{18F199F7-D2C2-4A4D-FAF4-98923541A9B9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 05:18:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T05:18:32.551 [Cloud] End of cloud request. 2026-09-11T05:18:33.051 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:22:18.019 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T05:24:10.332 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:24:10.332 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:24:10.332 [Cloud] Queued cloud request. 2026-09-11T05:24:10.332 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:24:10.504 [Cloud] Dequeued cloud request. 2026-09-11T05:24:10.504 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:24:10.691 [Cloud] End of cloud request. 2026-09-11T05:24:11.191 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:26:58.441 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:26:58.441 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:26:58.441 [Cloud] Queued cloud request. 2026-09-11T05:26:58.441 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:26:58.441 [Cloud] Dequeued cloud request. 2026-09-11T05:26:58.457 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:26:58.613 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{269E6FDC-5443-EAE3-2FD2-8FDDFEE5F554} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 05:26:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T05:26:59.129 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:29:13.238 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 854529, Count: 58804, MaxTime: 2046, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 2% 2026-09-11T05:29:13.238 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 7626, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-11T05:29:13.238 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 7272, Count: 489, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-11T05:29:13.238 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 2260, Count: 271, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\E42B523C1E0748BD919FEA9988E1EFDD.MAI, EstimatedImpact: 0% 2026-09-11T05:29:13.238 ProcessImageName: powershell.exe, Pid: 2732, TotalTime: 1679, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-11T05:29:13.238 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 1633, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\5C5638AD3B10487481E768CEC099433C.MAI, EstimatedImpact: 23% 2026-09-11T05:29:13.238 ProcessImageName: php.exe, Pid: 6468, TotalTime: 1082, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 30% 2026-09-11T05:29:13.238 ProcessImageName: AgentShellService.exe, Pid: 4844, TotalTime: 824, Count: 22, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 49% 2026-09-11T05:29:13.238 ProcessImageName: WmiPrvSE.exe, Pid: 6404, TotalTime: 585, Count: 18, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\mrxsmb.sys, EstimatedImpact: 9% 2026-09-11T05:29:13.238 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 487, Count: 27, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-11T05:29:13.238 ProcessImageName: WmiPrvSE.exe, Pid: 1940, TotalTime: 452, Count: 36, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-11T05:29:13.238 ProcessImageName: powershell.exe, Pid: 7300, TotalTime: 340, Count: 23, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 20% 2026-09-11T05:29:13.238 ProcessImageName: WmiPrvSE.exe, Pid: 4064, TotalTime: 279, Count: 5, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-11T05:29:13.238 ProcessImageName: python.exe, Pid: 6300, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-11T05:29:13.238 ProcessImageName: cmd.exe, Pid: 4996, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100% 2026-09-11T05:29:13.238 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 121, Count: 72, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2.MAI, EstimatedImpact: 0% 2026-09-11T05:29:13.238 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\F3E83A3B09D643F8B1E640AC1D63B48B.MAI, EstimatedImpact: 5% 2026-09-11T05:29:13.238 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-11T05:29:13.238 ProcessImageName: taskhostw.exe, Pid: 8140, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 5% 2026-09-11T05:29:13.238 ProcessImageName: taskhostw.exe, Pid: 5608, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-11T05:29:13.238 ProcessImageName: DeviceCensus.exe, Pid: 1504, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-11T05:29:13.238 ProcessImageName: cmd.exe, Pid: 6388, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-11T05:29:13.238 ProcessImageName: mysqldump.exe, Pid: 6864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 8% 2026-09-11T05:29:13.238 ProcessImageName: powershell.exe, Pid: 7848, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-11T05:29:13.238 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-11T05:29:13.238 ProcessImageName: taskhostw.exe, Pid: 4184, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-11T05:29:13.238 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-11T05:30:19.394 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:30:19.394 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:30:19.394 [Cloud] Queued cloud request. 2026-09-11T05:30:19.394 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:30:19.581 [Cloud] Dequeued cloud request. 2026-09-11T05:30:19.581 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:30:19.816 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4306B24C-0E20-A266-0E21-D357199BB425} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 05:30:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T05:30:20.300 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:30:32.019 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:30:32.019 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:30:32.019 [Cloud] Queued cloud request. 2026-09-11T05:30:32.019 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:30:32.019 [Cloud] Dequeued cloud request. 2026-09-11T05:30:32.019 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:30:32.113 [Cloud] End of cloud request. 2026-09-11T05:30:32.628 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:33:32.894 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:33:32.894 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:33:32.894 [Cloud] Queued cloud request. 2026-09-11T05:33:32.894 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:33:32.894 [Cloud] Dequeued cloud request. 2026-09-11T05:33:32.910 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:33:33.066 [Cloud] End of cloud request. 2026-09-11T05:33:33.581 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:36:18.472 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:36:18.472 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:36:18.472 [Cloud] Queued cloud request. 2026-09-11T05:36:18.472 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:36:18.472 [Cloud] Dequeued cloud request. 2026-09-11T05:36:18.472 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:36:18.643 [Cloud] End of cloud request. 2026-09-11T05:36:19.144 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:37:23.018 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T05:50:05.908 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:50:05.908 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:50:05.908 [Cloud] Queued cloud request. 2026-09-11T05:50:05.908 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:50:06.065 [Cloud] Dequeued cloud request. 2026-09-11T05:50:06.221 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:50:06.377 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A6E71164-3AF8-1005-EA5F-05522327E051} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 05:50:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T05:50:06.893 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:52:28.017 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T05:52:49.408 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:52:49.408 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:52:49.408 [Cloud] Queued cloud request. 2026-09-11T05:52:49.408 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:52:49.408 [Cloud] Dequeued cloud request. 2026-09-11T05:52:49.408 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:52:49.564 [Cloud] End of cloud request. 2026-09-11T05:52:50.080 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:54:43.174 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:54:43.174 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:54:43.174 [Cloud] Queued cloud request. 2026-09-11T05:54:43.174 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:54:43.330 [Cloud] Dequeued cloud request. 2026-09-11T05:54:43.502 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:54:43.658 [Cloud] End of cloud request. 2026-09-11T05:54:44.158 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:56:46.627 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:56:46.627 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:56:46.627 [Cloud] Queued cloud request. 2026-09-11T05:56:46.627 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:56:46.627 [Cloud] Dequeued cloud request. 2026-09-11T05:56:46.642 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:56:46.783 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2CB91E57-262C-FDF5-D1F0-B7F9FAA94507} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 05:56:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T05:56:47.299 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:59:19.783 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:59:19.783 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:59:19.783 [Cloud] Queued cloud request. 2026-09-11T05:59:19.783 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:59:19.783 [Cloud] Dequeued cloud request. 2026-09-11T05:59:19.798 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:59:29.876 [Cloud] End of cloud request. 2026-09-11T05:59:30.392 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T05:59:54.845 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T05:59:54.845 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T05:59:54.845 [Cloud] Queued cloud request. 2026-09-11T05:59:54.845 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T05:59:54.845 [Cloud] Dequeued cloud request. 2026-09-11T05:59:54.845 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T05:59:54.923 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BE8816BC-F9B6-B52D-6EFE-388173218293} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 05:59:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T05:59:55.423 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{22CC1FD4-B952-9B97-8842-EA8BE4793B6C} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-11-2026 06:01:45 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T06:01:46.923 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T06:01:46.923 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T06:01:46.923 [Cloud] Queued cloud request. 2026-09-11T06:01:46.923 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T06:01:46.923 [Cloud] Dequeued cloud request. 2026-09-11T06:01:46.923 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T06:01:47.111 [Cloud] End of cloud request. 2026-09-11T06:01:47.626 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T06:07:33.016 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T06:08:00.704 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T06:08:00.704 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T06:08:00.704 [Cloud] Queued cloud request. 2026-09-11T06:08:00.704 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T06:08:00.704 [Cloud] Dequeued cloud request. 2026-09-11T06:08:00.704 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T06:08:00.907 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E310ACB-7E7E-E871-5B03-3ACB1F84BBB8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 06:08:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T06:08:01.407 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T06:13:29.719 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T06:13:29.719 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T06:13:29.719 [Cloud] Queued cloud request. 2026-09-11T06:13:29.719 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T06:13:29.719 [Cloud] Dequeued cloud request. 2026-09-11T06:13:29.719 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T06:13:29.954 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5EA095F9-E066-09AD-5BAD-3FB6208E6E2F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 06:13:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T06:13:30.454 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T06:17:28.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T06:17:28.672 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T06:17:28.672 [Cloud] Queued cloud request. 2026-09-11T06:17:28.672 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T06:17:28.672 [Cloud] Dequeued cloud request. 2026-09-11T06:17:28.672 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T06:17:28.875 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CAB135C2-5987-A6D7-0BEA-5FD42DB215F6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 06:17:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T06:17:29.375 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T06:18:35.986 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T06:18:35.986 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T06:18:35.986 [Cloud] Queued cloud request. 2026-09-11T06:18:35.986 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T06:18:35.986 [Cloud] Dequeued cloud request. 2026-09-11T06:18:35.986 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T06:18:36.281 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6B6B7814-4688-AD02-1985-9FFFF2C733E1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 06:18:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T06:18:36.781 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T06:19:37.375 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T06:19:37.375 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T06:19:37.375 [Cloud] Queued cloud request. 2026-09-11T06:19:37.375 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T06:19:37.375 [Cloud] Dequeued cloud request. 2026-09-11T06:19:37.375 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T06:19:37.594 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{79FE352E-7308-6BFB-0D67-AE2E244F7A36} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 06:19:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T06:19:38.094 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T06:22:38.016 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T06:24:18.484 Bm signature throttled:0x000135b39c9104ce 2026-09-11T06:28:50.327 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T06:28:50.327 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T06:28:50.327 [Cloud] Queued cloud request. 2026-09-11T06:28:50.327 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T06:28:50.327 [Cloud] Dequeued cloud request. 2026-09-11T06:28:50.343 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T06:28:50.687 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{30A73A10-2EAB-9A69-4CFD-7F15DF5A4097} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 06:28:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T06:28:51.187 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T06:32:39.671 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T06:32:39.671 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T06:32:39.671 [Cloud] Queued cloud request. 2026-09-11T06:32:39.671 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T06:32:39.671 [Cloud] Dequeued cloud request. 2026-09-11T06:32:39.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T06:32:39.859 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FFC81B85-498C-6180-58B9-856BC06E4749} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 06:32:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T06:32:40.359 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T06:37:43.015 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T06:41:24.546 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T06:41:24.546 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T06:41:24.546 [Cloud] Queued cloud request. 2026-09-11T06:41:24.546 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T06:41:24.546 [Cloud] Dequeued cloud request. 2026-09-11T06:41:24.561 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T06:41:24.749 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F3862F96-0CC9-89AB-D993-A961B77FF408} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 06:41:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T06:41:25.249 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T06:52:48.014 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T06:59:36.576 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T06:59:36.576 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T06:59:36.576 [Cloud] Queued cloud request. 2026-09-11T06:59:36.576 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T06:59:36.576 [Cloud] Dequeued cloud request. 2026-09-11T06:59:36.576 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T06:59:36.732 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{694B61D8-B310-5DC8-E028-0F7CE152ABD8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 06:59:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T06:59:37.248 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T07:05:20.403 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T07:05:20.403 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T07:05:20.403 [Cloud] Queued cloud request. 2026-09-11T07:05:20.403 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T07:05:20.403 [Cloud] Dequeued cloud request. 2026-09-11T07:05:20.403 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T07:05:30.544 [Cloud] End of cloud request. 2026-09-11T07:05:31.044 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T07:07:53.013 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T07:22:58.012 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T07:27:34.543 Bm signature throttled:0x000135b39c9104ce 2026-09-11T07:29:13.230 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1076007, Count: 75395, MaxTime: 2046, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 2% 2026-09-11T07:29:13.230 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 9760, Count: 670, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-11T07:29:13.230 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 7626, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-11T07:29:13.230 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 2260, Count: 271, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\E42B523C1E0748BD919FEA9988E1EFDD.MAI, EstimatedImpact: 0% 2026-09-11T07:29:13.230 ProcessImageName: powershell.exe, Pid: 2732, TotalTime: 1679, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-11T07:29:13.230 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 1633, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\5C5638AD3B10487481E768CEC099433C.MAI, EstimatedImpact: 23% 2026-09-11T07:29:13.230 ProcessImageName: php.exe, Pid: 6468, TotalTime: 1082, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 30% 2026-09-11T07:29:13.230 ProcessImageName: AgentShellService.exe, Pid: 4844, TotalTime: 824, Count: 22, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 49% 2026-09-11T07:29:13.230 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 593, Count: 33, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-11T07:29:13.230 ProcessImageName: WmiPrvSE.exe, Pid: 6404, TotalTime: 585, Count: 18, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\mrxsmb.sys, EstimatedImpact: 9% 2026-09-11T07:29:13.230 ProcessImageName: WmiPrvSE.exe, Pid: 1940, TotalTime: 452, Count: 36, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-11T07:29:13.230 ProcessImageName: powershell.exe, Pid: 7300, TotalTime: 340, Count: 23, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 20% 2026-09-11T07:29:13.230 ProcessImageName: WmiPrvSE.exe, Pid: 4064, TotalTime: 279, Count: 5, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-11T07:29:13.230 ProcessImageName: python.exe, Pid: 6300, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-11T07:29:13.230 ProcessImageName: cmd.exe, Pid: 4996, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100% 2026-09-11T07:29:13.230 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 121, Count: 72, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2.MAI, EstimatedImpact: 0% 2026-09-11T07:29:13.230 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\F3E83A3B09D643F8B1E640AC1D63B48B.MAI, EstimatedImpact: 5% 2026-09-11T07:29:13.230 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-11T07:29:13.230 ProcessImageName: taskhostw.exe, Pid: 8140, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 5% 2026-09-11T07:29:13.230 ProcessImageName: taskhostw.exe, Pid: 5608, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-11T07:29:13.230 ProcessImageName: DeviceCensus.exe, Pid: 1504, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-11T07:29:13.230 ProcessImageName: cmd.exe, Pid: 6388, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-11T07:29:13.230 ProcessImageName: mysqldump.exe, Pid: 6864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 8% 2026-09-11T07:29:13.230 ProcessImageName: powershell.exe, Pid: 7848, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-11T07:29:13.230 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-11T07:29:13.230 ProcessImageName: taskhostw.exe, Pid: 4184, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-11T07:29:13.230 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-11T07:38:03.011 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T07:46:20.917 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T07:46:20.917 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T07:46:20.917 [Cloud] Queued cloud request. 2026-09-11T07:46:20.917 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T07:46:20.917 [Cloud] Dequeued cloud request. 2026-09-11T07:46:20.917 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T07:46:21.089 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{226347A2-37A5-FF86-4DA4-D780FC4D4FDB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 07:46:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T07:46:21.589 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T07:53:08.010 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T07:54:38.229 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T07:54:38.229 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T07:54:38.229 [Cloud] Queued cloud request. 2026-09-11T07:54:38.229 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T07:54:38.229 [Cloud] Dequeued cloud request. 2026-09-11T07:54:38.229 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T07:54:38.432 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E1443BF-5EB6-B86F-60EA-CA8695872F12} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 07:54:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T07:54:38.932 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T07:54:51.042 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T07:54:51.042 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T07:54:51.042 [Cloud] Queued cloud request. 2026-09-11T07:54:51.042 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T07:54:51.042 [Cloud] Dequeued cloud request. 2026-09-11T07:54:51.042 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T07:54:51.120 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8B15CAE4-5B58-F03C-BEDF-BB59AF8945B4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 07:54:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T07:54:51.620 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T07:58:18.291 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T07:58:18.291 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T07:58:18.291 [Cloud] Queued cloud request. 2026-09-11T07:58:18.291 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T07:58:18.291 [Cloud] Dequeued cloud request. 2026-09-11T07:58:18.307 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T07:58:18.463 [Cloud] End of cloud request. 2026-09-11T07:58:18.963 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T08:08:13.010 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T08:11:39.494 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T08:11:39.494 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T08:11:39.494 [Cloud] Queued cloud request. 2026-09-11T08:11:39.494 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T08:11:39.494 [Cloud] Dequeued cloud request. 2026-09-11T08:11:39.494 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T08:11:39.775 [Cloud] End of cloud request. 2026-09-11T08:11:40.291 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T08:11:41.634 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T08:11:41.634 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T08:11:41.634 [Cloud] Queued cloud request. 2026-09-11T08:11:41.634 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T08:11:41.634 [Cloud] Dequeued cloud request. 2026-09-11T08:11:41.634 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T08:11:41.728 [Cloud] End of cloud request. 2026-09-11T08:11:42.228 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T08:12:54.416 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T08:12:54.416 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T08:12:54.416 [Cloud] Queued cloud request. 2026-09-11T08:12:54.416 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T08:12:54.416 [Cloud] Dequeued cloud request. 2026-09-11T08:12:54.416 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T08:12:54.603 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3740B6B0-4D2B-BB00-26E8-F8B3CA2F0EF8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 08:12:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T08:12:55.103 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T08:15:43.884 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T08:15:43.884 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T08:15:43.884 [Cloud] Queued cloud request. 2026-09-11T08:15:43.884 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T08:15:43.884 [Cloud] Dequeued cloud request. 2026-09-11T08:15:43.884 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T08:15:44.165 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A7A8D244-04D2-05D6-D4CB-D985557175C4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 08:15:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T08:15:44.681 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T08:23:18.009 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T08:38:23.008 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T08:53:28.008 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T08:53:29.258 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T08:53:29.258 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T08:53:29.258 [Cloud] Queued cloud request. 2026-09-11T08:53:29.258 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T08:53:29.258 [Cloud] Dequeued cloud request. 2026-09-11T08:53:29.258 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T08:53:29.492 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4BA54111-5F71-EFF8-1943-12AD3C31298C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 08:53:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T08:53:30.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T09:03:25.242 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T09:03:25.242 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T09:03:25.242 [Cloud] Queued cloud request. 2026-09-11T09:03:25.242 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T09:03:25.242 [Cloud] Dequeued cloud request. 2026-09-11T09:03:25.242 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T09:03:25.429 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B500089E-D846-523B-9836-DDF6546729A6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 09:03:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T09:03:25.929 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T09:08:33.007 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T09:23:30.866 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T09:23:30.866 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T09:23:30.866 [Cloud] Queued cloud request. 2026-09-11T09:23:30.866 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T09:23:30.881 [Cloud] Dequeued cloud request. 2026-09-11T09:23:30.881 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T09:23:31.084 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2B6E8E19-24A4-FD4C-25FC-C5FF3383A74E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 09:23:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T09:23:31.600 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T09:23:38.006 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T09:29:13.241 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1329971, Count: 93469, MaxTime: 2046, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 2% 2026-09-11T09:29:13.241 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 12431, Count: 844, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-11T09:29:13.241 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 7626, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-11T09:29:13.241 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 2260, Count: 271, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\E42B523C1E0748BD919FEA9988E1EFDD.MAI, EstimatedImpact: 0% 2026-09-11T09:29:13.241 ProcessImageName: powershell.exe, Pid: 2732, TotalTime: 1679, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-11T09:29:13.241 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 1633, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\5C5638AD3B10487481E768CEC099433C.MAI, EstimatedImpact: 23% 2026-09-11T09:29:13.241 ProcessImageName: php.exe, Pid: 6468, TotalTime: 1082, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 30% 2026-09-11T09:29:13.241 ProcessImageName: AgentShellService.exe, Pid: 4844, TotalTime: 824, Count: 22, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 49% 2026-09-11T09:29:13.241 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 638, Count: 37, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-11T09:29:13.241 ProcessImageName: WmiPrvSE.exe, Pid: 6404, TotalTime: 585, Count: 18, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\mrxsmb.sys, EstimatedImpact: 9% 2026-09-11T09:29:13.241 ProcessImageName: WmiPrvSE.exe, Pid: 1940, TotalTime: 452, Count: 36, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-11T09:29:13.241 ProcessImageName: powershell.exe, Pid: 7300, TotalTime: 340, Count: 23, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 20% 2026-09-11T09:29:13.241 ProcessImageName: WmiPrvSE.exe, Pid: 4064, TotalTime: 279, Count: 5, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-11T09:29:13.241 ProcessImageName: python.exe, Pid: 6300, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-11T09:29:13.241 ProcessImageName: cmd.exe, Pid: 4996, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100% 2026-09-11T09:29:13.241 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 121, Count: 72, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2.MAI, EstimatedImpact: 0% 2026-09-11T09:29:13.241 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\F3E83A3B09D643F8B1E640AC1D63B48B.MAI, EstimatedImpact: 5% 2026-09-11T09:29:13.241 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-11T09:29:13.241 ProcessImageName: taskhostw.exe, Pid: 8140, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 5% 2026-09-11T09:29:13.241 ProcessImageName: taskhostw.exe, Pid: 5608, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-11T09:29:13.241 ProcessImageName: DeviceCensus.exe, Pid: 1504, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-11T09:29:13.241 ProcessImageName: cmd.exe, Pid: 6388, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-11T09:29:13.241 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-11T09:29:13.241 ProcessImageName: mysqldump.exe, Pid: 6864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 8% 2026-09-11T09:29:13.241 ProcessImageName: powershell.exe, Pid: 7848, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-11T09:29:13.241 ProcessImageName: taskhostw.exe, Pid: 4184, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-11T09:29:13.241 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-11T09:33:38.131 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T09:33:38.131 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T09:33:38.131 [Cloud] Queued cloud request. 2026-09-11T09:33:38.131 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T09:33:38.131 [Cloud] Dequeued cloud request. 2026-09-11T09:33:38.131 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T09:33:38.365 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E45CCBC-4295-8AFA-355E-EA04CF487B20} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 09:33:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T09:33:38.881 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T09:38:43.131 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T09:40:33.646 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T09:40:33.646 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T09:40:33.646 [Cloud] Queued cloud request. 2026-09-11T09:40:33.646 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T09:40:33.646 [Cloud] Dequeued cloud request. 2026-09-11T09:40:33.646 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T09:40:43.787 [Cloud] End of cloud request. 2026-09-11T09:40:44.287 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T09:53:48.005 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T09:55:42.130 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T09:55:42.146 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T09:55:42.146 [Cloud] Queued cloud request. 2026-09-11T09:55:42.146 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T09:55:42.146 [Cloud] Dequeued cloud request. 2026-09-11T09:55:42.146 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T09:55:48.411 [Cloud] End of cloud request. 2026-09-11T09:55:48.911 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T10:07:17.239 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T10:07:17.239 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T10:07:17.239 [Cloud] Queued cloud request. 2026-09-11T10:07:17.239 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T10:07:17.239 [Cloud] Dequeued cloud request. 2026-09-11T10:07:17.239 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T10:07:17.458 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B6E282BC-B124-0271-9DEC-696BAFDF67BE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 10:07:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T10:07:17.973 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T10:08:37.489 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T10:08:37.489 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T10:08:37.489 [Cloud] Queued cloud request. 2026-09-11T10:08:37.489 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T10:08:37.489 [Cloud] Dequeued cloud request. 2026-09-11T10:08:37.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T10:08:37.676 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E9BB4C82-D0DC-EE42-EE68-842769F4624E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 10:08:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T10:08:38.176 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T10:08:53.004 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T10:20:07.942 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T10:20:07.942 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T10:20:07.942 [Cloud] Queued cloud request. 2026-09-11T10:20:07.942 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T10:20:07.942 [Cloud] Dequeued cloud request. 2026-09-11T10:20:07.942 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T10:20:08.113 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A850157F-6C12-C15A-7C17-D5CC7399CC92} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 10:20:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T10:20:08.613 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T10:23:58.004 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T10:24:36.832 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T10:24:36.832 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T10:24:36.832 [Cloud] Queued cloud request. 2026-09-11T10:24:36.832 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T10:24:36.832 [Cloud] Dequeued cloud request. 2026-09-11T10:24:36.832 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T10:24:36.973 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7D58630F-0BC3-64B7-ABA9-E6C215739E6A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 10:24:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T10:24:37.473 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T10:35:28.597 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T10:35:28.597 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T10:35:28.597 [Cloud] Queued cloud request. 2026-09-11T10:35:28.597 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T10:35:28.597 [Cloud] Dequeued cloud request. 2026-09-11T10:35:28.597 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T10:35:28.785 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F21EC960-BEEE-53ED-DB69-CBB8C92B02A2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 10:35:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T10:35:29.300 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T10:39:03.003 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T10:54:08.003 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T10:57:48.909 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T10:57:48.909 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T10:57:48.909 [Cloud] Queued cloud request. 2026-09-11T10:57:48.909 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T10:57:48.909 [Cloud] Dequeued cloud request. 2026-09-11T10:57:48.909 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T10:57:49.112 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F256BD98-CFC2-BD6D-BA26-E9F3E0CFB0F3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 10:57:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T10:57:49.614 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T11:04:56.159 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T11:04:56.159 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T11:04:56.159 [Cloud] Queued cloud request. 2026-09-11T11:04:56.159 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T11:04:56.159 [Cloud] Dequeued cloud request. 2026-09-11T11:04:56.159 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T11:04:56.378 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CBAB0C4C-8EF5-C16B-0D16-C945B87B1D3B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 11:04:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T11:04:56.878 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T11:09:13.002 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T11:14:49.955 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T11:14:49.955 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T11:14:49.955 [Cloud] Queued cloud request. 2026-09-11T11:14:49.955 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T11:14:49.955 [Cloud] Dequeued cloud request. 2026-09-11T11:14:49.971 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T11:14:50.143 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E4438FFD-3CD5-ED54-547F-E6D7D1BE8F33} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 11:14:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T11:14:50.643 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T11:18:30.471 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T11:18:30.471 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T11:18:30.471 [Cloud] Queued cloud request. 2026-09-11T11:18:30.471 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T11:18:30.471 [Cloud] Dequeued cloud request. 2026-09-11T11:18:30.471 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T11:18:30.611 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C3ED9FC8-CCD6-EBC8-C731-52EE56DAF8C9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 11:18:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T11:18:31.127 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T11:18:34.627 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T11:18:34.627 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T11:18:34.627 [Cloud] Queued cloud request. 2026-09-11T11:18:34.627 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T11:18:34.627 [Cloud] Dequeued cloud request. 2026-09-11T11:18:34.627 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T11:18:40.736 [Cloud] End of cloud request. 2026-09-11T11:18:41.236 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T11:24:18.002 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T11:29:13.252 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1400909, Count: 99039, MaxTime: 2046, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 2% 2026-09-11T11:29:13.252 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 15260, Count: 1012, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-11T11:29:13.252 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 7626, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-11T11:29:13.252 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 2260, Count: 271, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\E42B523C1E0748BD919FEA9988E1EFDD.MAI, EstimatedImpact: 0% 2026-09-11T11:29:13.252 ProcessImageName: powershell.exe, Pid: 2732, TotalTime: 1679, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-11T11:29:13.252 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 1633, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\5C5638AD3B10487481E768CEC099433C.MAI, EstimatedImpact: 23% 2026-09-11T11:29:13.252 ProcessImageName: php.exe, Pid: 6468, TotalTime: 1082, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 30% 2026-09-11T11:29:13.252 ProcessImageName: AgentShellService.exe, Pid: 4844, TotalTime: 824, Count: 22, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 49% 2026-09-11T11:29:13.252 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 730, Count: 41, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-11T11:29:13.252 ProcessImageName: WmiPrvSE.exe, Pid: 6404, TotalTime: 585, Count: 18, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\mrxsmb.sys, EstimatedImpact: 9% 2026-09-11T11:29:13.252 ProcessImageName: WmiPrvSE.exe, Pid: 1940, TotalTime: 452, Count: 36, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-11T11:29:13.252 ProcessImageName: powershell.exe, Pid: 7300, TotalTime: 340, Count: 23, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 20% 2026-09-11T11:29:13.252 ProcessImageName: WmiPrvSE.exe, Pid: 4064, TotalTime: 279, Count: 5, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-11T11:29:13.252 ProcessImageName: python.exe, Pid: 6300, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-11T11:29:13.252 ProcessImageName: cmd.exe, Pid: 4996, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100% 2026-09-11T11:29:13.252 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 121, Count: 72, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2.MAI, EstimatedImpact: 0% 2026-09-11T11:29:13.252 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\F3E83A3B09D643F8B1E640AC1D63B48B.MAI, EstimatedImpact: 5% 2026-09-11T11:29:13.252 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-11T11:29:13.252 ProcessImageName: taskhostw.exe, Pid: 8140, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 5% 2026-09-11T11:29:13.252 ProcessImageName: taskhostw.exe, Pid: 5608, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-11T11:29:13.252 ProcessImageName: DeviceCensus.exe, Pid: 1504, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-11T11:29:13.252 ProcessImageName: cmd.exe, Pid: 6388, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-11T11:29:13.252 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-11T11:29:13.252 ProcessImageName: mysqldump.exe, Pid: 6864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 8% 2026-09-11T11:29:13.252 ProcessImageName: powershell.exe, Pid: 7848, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-11T11:29:13.252 ProcessImageName: taskhostw.exe, Pid: 4184, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-11T11:29:13.252 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-11T11:32:20.533 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T11:32:20.533 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T11:32:20.533 [Cloud] Queued cloud request. 2026-09-11T11:32:20.533 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T11:32:20.533 [Cloud] Dequeued cloud request. 2026-09-11T11:32:20.533 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T11:32:20.720 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{91AAF21C-7900-E8E8-48AA-9BDCF2EECEE3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 11:32:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T11:32:21.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T11:39:23.001 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T11:45:09.376 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T11:45:09.376 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T11:45:09.376 [Cloud] Queued cloud request. 2026-09-11T11:45:09.376 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T11:45:09.376 [Cloud] Dequeued cloud request. 2026-09-11T11:45:09.376 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T11:45:09.611 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{02352A6B-3CFD-2BF9-4C3E-E730B8E06715} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 11:45:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T11:45:10.111 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T11:46:21.267 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T11:46:21.267 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T11:46:21.267 [Cloud] Queued cloud request. 2026-09-11T11:46:21.267 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T11:46:21.267 [Cloud] Dequeued cloud request. 2026-09-11T11:46:21.267 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T11:46:31.361 [Cloud] End of cloud request. 2026-09-11T11:46:31.876 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T11:46:54.626 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T11:46:54.626 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T11:46:54.626 [Cloud] Queued cloud request. 2026-09-11T11:46:54.626 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T11:46:54.626 [Cloud] Dequeued cloud request. 2026-09-11T11:46:54.626 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T11:46:54.704 [Cloud] End of cloud request. 2026-09-11T11:46:55.204 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T11:51:51.548 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T11:51:51.548 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T11:51:51.548 [Cloud] Queued cloud request. 2026-09-11T11:51:51.548 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T11:51:51.548 [Cloud] Dequeued cloud request. 2026-09-11T11:51:51.564 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T11:51:51.704 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1956620A-0ED0-74C9-88F0-5BCDB1077A52} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 11:51:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T11:51:52.204 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T11:53:39.048 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T11:53:39.048 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T11:53:39.048 [Cloud] Queued cloud request. 2026-09-11T11:53:39.048 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T11:53:39.048 [Cloud] Dequeued cloud request. 2026-09-11T11:53:39.048 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T11:53:39.204 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6EFC895A-0B00-7AA6-F703-BBE2E2B82476} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 11:53:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T11:53:39.704 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T11:54:28.001 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T11:55:19.642 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T11:55:19.642 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T11:55:19.642 [Cloud] Queued cloud request. 2026-09-11T11:55:19.642 [Cloud] Dequeued cloud request. 2026-09-11T11:55:19.657 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T11:55:19.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T11:55:19.938 [Cloud] End of cloud request. 2026-09-11T11:55:20.438 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T11:57:36.438 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T11:57:36.438 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T11:57:36.438 [Cloud] Queued cloud request. 2026-09-11T11:57:36.438 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T11:57:36.438 [Cloud] Dequeued cloud request. 2026-09-11T11:57:36.438 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{60FBF018-36FA-9F20-9859-90F9A45A0977} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 11:57:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T11:57:36.626 [Cloud] End of cloud request. 2026-09-11T11:57:37.126 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T12:05:12.266 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T12:05:12.266 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T12:05:12.266 [Cloud] Queued cloud request. 2026-09-11T12:05:12.266 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T12:05:12.266 [Cloud] Dequeued cloud request. 2026-09-11T12:05:12.282 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T12:05:12.891 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BF70F8FD-56D9-DC63-CCB3-1F02358AF094} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 12:05:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T12:05:13.407 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T12:09:33.001 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T12:17:12.688 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T12:17:12.688 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T12:17:12.688 [Cloud] Queued cloud request. 2026-09-11T12:17:12.688 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T12:17:12.688 [Cloud] Dequeued cloud request. 2026-09-11T12:17:12.688 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T12:17:12.907 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{96210B15-2B24-5613-E896-77CD42EE0289} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 12:17:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T12:17:13.407 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T12:24:38.000 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T12:28:39.109 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T12:28:39.109 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T12:28:39.109 [Cloud] Queued cloud request. 2026-09-11T12:28:39.109 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T12:28:39.109 [Cloud] Dequeued cloud request. 2026-09-11T12:28:39.109 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T12:28:39.313 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{76EE2574-AB9E-3066-A856-1A9999D2BD55} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 12:28:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T12:28:39.813 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{C8D0628B-490B-EA3D-9E2C-318176C4ADD4} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-11-2026 12:32:28 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T12:32:29.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T12:32:29.672 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T12:32:29.672 [Cloud] Queued cloud request. 2026-09-11T12:32:29.672 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T12:32:29.672 [Cloud] Dequeued cloud request. 2026-09-11T12:32:29.672 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T12:32:39.812 [Cloud] End of cloud request. 2026-09-11T12:32:40.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T12:39:43.000 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T12:42:17.640 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T12:42:17.640 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T12:42:17.640 [Cloud] Queued cloud request. 2026-09-11T12:42:17.640 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T12:42:17.640 [Cloud] Dequeued cloud request. 2026-09-11T12:42:17.656 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T12:42:17.843 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0349E703-9675-3595-74EB-102A42A8695B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 12:42:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T12:42:18.343 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T12:54:47.999 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T13:00:03.031 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:00:03.031 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:00:03.031 [Cloud] Queued cloud request. 2026-09-11T13:00:03.031 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:00:03.031 [Cloud] Dequeued cloud request. 2026-09-11T13:00:03.031 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:00:04.812 [Cloud] End of cloud request. 2026-09-11T13:00:05.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:05:20.999 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:05:20.999 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:05:20.999 [Cloud] Queued cloud request. 2026-09-11T13:05:20.999 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:05:20.999 [Cloud] Dequeued cloud request. 2026-09-11T13:05:20.999 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:05:21.203 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{65587BEA-A617-71AC-E178-1DA4D3EB3C33} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 13:05:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T13:05:21.703 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:07:00.843 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:07:00.843 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:07:00.843 [Cloud] Queued cloud request. 2026-09-11T13:07:00.843 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:07:00.843 [Cloud] Dequeued cloud request. 2026-09-11T13:07:00.843 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:07:01.031 [Cloud] End of cloud request. 2026-09-11T13:07:01.546 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:09:47.984 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:09:47.984 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:09:47.984 [Cloud] Queued cloud request. 2026-09-11T13:09:47.984 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:09:47.984 [Cloud] Dequeued cloud request. 2026-09-11T13:09:47.984 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:09:48.171 [Cloud] End of cloud request. 2026-09-11T13:09:48.687 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:09:52.999 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T13:10:24.749 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:10:24.749 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:10:24.749 [Cloud] Queued cloud request. 2026-09-11T13:10:24.749 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:10:24.749 [Cloud] Dequeued cloud request. 2026-09-11T13:10:24.749 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:10:24.890 [Cloud] End of cloud request. 2026-09-11T13:10:25.390 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:17:34.343 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:17:34.343 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:17:34.343 [Cloud] Queued cloud request. 2026-09-11T13:17:34.343 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:17:34.343 [Cloud] Dequeued cloud request. 2026-09-11T13:17:34.343 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:17:34.499 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{08D55CB3-9524-0294-1227-BC1F96A4C150} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 13:17:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T13:17:34.999 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:24:57.999 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T13:25:38.702 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:25:38.702 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:25:38.702 [Cloud] Queued cloud request. 2026-09-11T13:25:38.702 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:25:38.702 [Cloud] Dequeued cloud request. 2026-09-11T13:25:38.717 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:25:38.874 [Cloud] End of cloud request. 2026-09-11T13:25:39.374 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:29:13.249 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1422346, Count: 101742, MaxTime: 2046, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 2% 2026-09-11T13:29:13.249 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 18863, Count: 1183, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-11T13:29:13.249 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 7626, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-11T13:29:13.249 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 2260, Count: 271, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\E42B523C1E0748BD919FEA9988E1EFDD.MAI, EstimatedImpact: 0% 2026-09-11T13:29:13.249 ProcessImageName: powershell.exe, Pid: 2732, TotalTime: 1679, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-11T13:29:13.249 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 1633, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\5C5638AD3B10487481E768CEC099433C.MAI, EstimatedImpact: 23% 2026-09-11T13:29:13.249 ProcessImageName: php.exe, Pid: 6468, TotalTime: 1082, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 30% 2026-09-11T13:29:13.249 ProcessImageName: AgentShellService.exe, Pid: 4844, TotalTime: 824, Count: 22, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 49% 2026-09-11T13:29:13.249 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 792, Count: 43, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-11T13:29:13.249 ProcessImageName: WmiPrvSE.exe, Pid: 6404, TotalTime: 585, Count: 18, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\mrxsmb.sys, EstimatedImpact: 9% 2026-09-11T13:29:13.249 ProcessImageName: WmiPrvSE.exe, Pid: 1940, TotalTime: 452, Count: 36, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-11T13:29:13.249 ProcessImageName: powershell.exe, Pid: 7300, TotalTime: 340, Count: 23, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 20% 2026-09-11T13:29:13.249 ProcessImageName: WmiPrvSE.exe, Pid: 4064, TotalTime: 279, Count: 5, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-11T13:29:13.249 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 181, Count: 76, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2.MAI, EstimatedImpact: 0% 2026-09-11T13:29:13.249 ProcessImageName: python.exe, Pid: 6300, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-11T13:29:13.249 ProcessImageName: cmd.exe, Pid: 4996, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100% 2026-09-11T13:29:13.249 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\F3E83A3B09D643F8B1E640AC1D63B48B.MAI, EstimatedImpact: 5% 2026-09-11T13:29:13.249 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-11T13:29:13.249 ProcessImageName: taskhostw.exe, Pid: 8140, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 5% 2026-09-11T13:29:13.249 ProcessImageName: taskhostw.exe, Pid: 5608, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-11T13:29:13.249 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 91, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-11T13:29:13.249 ProcessImageName: DeviceCensus.exe, Pid: 1504, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-11T13:29:13.249 ProcessImageName: cmd.exe, Pid: 6388, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-11T13:29:13.249 ProcessImageName: mysqldump.exe, Pid: 6864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 8% 2026-09-11T13:29:13.249 ProcessImageName: powershell.exe, Pid: 7848, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-11T13:29:13.249 ProcessImageName: taskhostw.exe, Pid: 4184, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-11T13:29:13.249 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-11T13:33:17.420 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:33:17.420 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:33:17.420 [Cloud] Queued cloud request. 2026-09-11T13:33:17.420 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:33:17.420 [Cloud] Dequeued cloud request. 2026-09-11T13:33:17.420 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:33:17.592 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8EC6A61C-401D-7287-AAB8-B4932CF3D9A3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 13:33:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T13:33:18.092 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:34:14.717 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:34:14.717 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:34:14.717 [Cloud] Queued cloud request. 2026-09-11T13:34:14.717 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:34:14.717 [Cloud] Dequeued cloud request. 2026-09-11T13:34:14.717 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:34:14.811 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F5E5F624-F337-0A4C-ED03-116C592E8C44} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 13:34:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T13:34:15.327 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:38:23.920 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:38:23.920 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:38:23.920 [Cloud] Queued cloud request. 2026-09-11T13:38:23.920 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:38:23.920 [Cloud] Dequeued cloud request. 2026-09-11T13:38:23.920 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:38:24.092 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C25F3974-E5CC-3309-5FFD-C0E722E99AF3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 13:38:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T13:38:24.592 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:40:02.998 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T13:44:19.248 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:44:19.248 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:44:19.248 [Cloud] Queued cloud request. 2026-09-11T13:44:19.248 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:44:19.248 [Cloud] Dequeued cloud request. 2026-09-11T13:44:19.248 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:44:19.467 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E70CD741-6D6E-C5E1-7DD8-BC5554911F31} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 13:44:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T13:44:19.967 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:55:07.998 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T13:56:40.014 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:56:40.014 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:56:40.014 [Cloud] Queued cloud request. 2026-09-11T13:56:40.014 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:56:40.014 [Cloud] Dequeued cloud request. 2026-09-11T13:56:40.014 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:56:50.123 [Cloud] End of cloud request. 2026-09-11T13:56:50.623 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:57:42.389 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:57:42.389 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:57:42.389 [Cloud] Queued cloud request. 2026-09-11T13:57:42.389 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:57:42.389 [Cloud] Dequeued cloud request. 2026-09-11T13:57:42.389 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:57:42.482 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1355D3F4-8FE5-E67C-6AF3-1C8012FD634A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 13:57:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T13:57:42.982 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:58:00.170 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:58:00.170 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:58:00.170 [Cloud] Queued cloud request. 2026-09-11T13:58:00.170 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:58:00.170 [Cloud] Dequeued cloud request. 2026-09-11T13:58:00.170 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:58:00.279 [Cloud] End of cloud request. 2026-09-11T13:58:00.795 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T13:59:27.998 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T13:59:27.998 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T13:59:27.998 [Cloud] Queued cloud request. 2026-09-11T13:59:27.998 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T13:59:27.998 [Cloud] Dequeued cloud request. 2026-09-11T13:59:27.998 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T13:59:28.310 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3C1C5284-2C07-80BB-2AB7-175F82A4801D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 13:59:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T13:59:28.810 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:00:40.810 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:00:40.810 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:00:40.810 [Cloud] Queued cloud request. 2026-09-11T14:00:40.810 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:00:40.810 [Cloud] Dequeued cloud request. 2026-09-11T14:00:40.810 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:00:41.107 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9AC55A6A-B8D7-B679-CE08-A8CED090D2A8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 14:00:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T14:00:41.623 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:00:49.170 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:00:49.170 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:00:49.170 [Cloud] Queued cloud request. 2026-09-11T14:00:49.170 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:00:49.170 [Cloud] Dequeued cloud request. 2026-09-11T14:00:49.170 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:00:49.310 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{46799478-1AB1-CED3-9678-D56E89FAD958} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 14:00:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T14:00:49.810 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:03:11.091 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:03:11.091 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:03:11.091 [Cloud] Queued cloud request. 2026-09-11T14:03:11.091 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:03:11.091 [Cloud] Dequeued cloud request. 2026-09-11T14:03:11.091 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:03:21.216 [Cloud] End of cloud request. 2026-09-11T14:03:21.716 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:03:56.029 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:03:56.029 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:03:56.029 [Cloud] Queued cloud request. 2026-09-11T14:03:56.029 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:03:56.029 [Cloud] Dequeued cloud request. 2026-09-11T14:03:56.029 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:03:56.201 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{92E78E7B-24A8-F183-1CE1-474109D9FCC8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 14:03:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T14:03:56.716 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:05:24.466 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:05:24.466 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:05:24.466 [Cloud] Queued cloud request. 2026-09-11T14:05:24.466 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:05:24.466 [Cloud] Dequeued cloud request. 2026-09-11T14:05:24.466 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:05:24.623 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4AF007AE-5C6E-1E4F-A07D-196FDAFED36E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 14:05:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T14:05:25.138 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:08:29.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:08:29.904 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:08:29.904 [Cloud] Queued cloud request. 2026-09-11T14:08:29.904 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:08:29.904 [Cloud] Dequeued cloud request. 2026-09-11T14:08:29.919 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:08:40.029 [Cloud] End of cloud request. 2026-09-11T14:08:40.529 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:10:12.998 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T14:15:11.966 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:15:11.966 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:15:11.966 [Cloud] Queued cloud request. 2026-09-11T14:15:11.966 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:15:11.966 [Cloud] Dequeued cloud request. 2026-09-11T14:15:11.966 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:15:12.122 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E6EECF0-7C11-F3D1-52E0-378A3CE905E6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 14:15:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T14:15:12.622 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:22:50.778 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:22:50.778 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:22:50.778 [Cloud] Queued cloud request. 2026-09-11T14:22:50.778 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:22:50.778 [Cloud] Dequeued cloud request. 2026-09-11T14:22:50.778 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:22:50.982 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9EDE7C6F-DA37-D9F3-32E2-F2085AE8DFF7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 14:22:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T14:22:51.497 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:25:17.997 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T14:26:19.294 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:26:19.294 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:26:19.294 [Cloud] Queued cloud request. 2026-09-11T14:26:19.294 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:26:19.294 [Cloud] Dequeued cloud request. 2026-09-11T14:26:19.294 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:26:19.497 [Cloud] End of cloud request. 2026-09-11T14:26:20.013 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:31:16.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:31:16.700 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:31:16.700 [Cloud] Queued cloud request. 2026-09-11T14:31:16.700 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:31:16.700 [Cloud] Dequeued cloud request. 2026-09-11T14:31:16.716 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:31:16.903 [Cloud] End of cloud request. 2026-09-11T14:31:17.403 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:33:21.559 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:33:21.559 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:33:21.559 [Cloud] Queued cloud request. 2026-09-11T14:33:21.559 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:33:21.559 [Cloud] Dequeued cloud request. 2026-09-11T14:33:21.559 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:33:21.763 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8E4D12B1-4E29-46A8-42A5-746AEBDECACC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 14:33:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T14:33:22.263 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:38:33.200 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:38:33.200 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:38:33.200 [Cloud] Queued cloud request. 2026-09-11T14:38:33.200 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:38:33.200 [Cloud] Dequeued cloud request. 2026-09-11T14:38:33.200 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:38:43.309 [Cloud] End of cloud request. 2026-09-11T14:38:43.809 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:40:22.997 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T14:53:54.434 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T14:53:54.434 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T14:53:54.434 [Cloud] Queued cloud request. 2026-09-11T14:53:54.434 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T14:53:54.434 [Cloud] Dequeued cloud request. 2026-09-11T14:53:54.434 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T14:53:54.856 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{82D5618E-A83A-1410-F488-59357D512409} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 14:53:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T14:53:55.372 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T14:55:27.997 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T15:10:32.996 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T15:13:33.090 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T15:13:33.090 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T15:13:33.090 [Cloud] Queued cloud request. 2026-09-11T15:13:33.090 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T15:13:33.090 [Cloud] Dequeued cloud request. 2026-09-11T15:13:33.090 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T15:13:33.278 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0FBE1580-5B83-F3B4-A56F-C0E51E85CBC9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 15:13:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T15:13:33.778 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T15:14:55.465 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T15:14:55.465 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T15:14:55.465 [Cloud] Queued cloud request. 2026-09-11T15:14:55.465 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T15:14:55.465 [Cloud] Dequeued cloud request. 2026-09-11T15:14:55.481 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T15:14:55.606 [Cloud] End of cloud request. 2026-09-11T15:14:56.106 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T15:17:17.590 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T15:17:17.590 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T15:17:17.590 [Cloud] Queued cloud request. 2026-09-11T15:17:17.590 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T15:17:17.590 [Cloud] Dequeued cloud request. 2026-09-11T15:17:17.590 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T15:17:17.746 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06F119EC-0C1A-1983-A169-17A0FE9D997C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 15:17:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T15:17:18.278 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T15:18:27.699 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T15:18:27.699 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T15:18:27.699 [Cloud] Queued cloud request. 2026-09-11T15:18:27.699 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T15:18:27.699 [Cloud] Dequeued cloud request. 2026-09-11T15:18:27.699 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T15:18:27.856 [Cloud] End of cloud request. 2026-09-11T15:18:28.356 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T15:19:50.653 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T15:19:50.653 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T15:19:50.653 [Cloud] Queued cloud request. 2026-09-11T15:19:50.653 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T15:19:50.653 [Cloud] Dequeued cloud request. 2026-09-11T15:19:50.653 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T15:19:50.793 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0F93191F-2FFC-7087-4E97-56B495F901A1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 15:19:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T15:19:51.293 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T15:25:37.996 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T15:28:36.590 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T15:28:36.590 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T15:28:36.590 [Cloud] Queued cloud request. 2026-09-11T15:28:36.590 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T15:28:36.590 [Cloud] Dequeued cloud request. 2026-09-11T15:28:36.590 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T15:28:36.731 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5B117CCD-93E9-5A7C-2F0E-7AA29FD76F82} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 15:28:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T15:28:37.231 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T15:29:13.246 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1422606, Count: 101752, MaxTime: 2046, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 2% 2026-09-11T15:29:13.246 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 22987, Count: 1354, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-11T15:29:13.246 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 7626, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-11T15:29:13.246 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 2260, Count: 271, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\E42B523C1E0748BD919FEA9988E1EFDD.MAI, EstimatedImpact: 0% 2026-09-11T15:29:13.246 ProcessImageName: powershell.exe, Pid: 2732, TotalTime: 1679, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-11T15:29:13.246 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 1633, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\5C5638AD3B10487481E768CEC099433C.MAI, EstimatedImpact: 23% 2026-09-11T15:29:13.246 ProcessImageName: php.exe, Pid: 6468, TotalTime: 1082, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 30% 2026-09-11T15:29:13.246 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 883, Count: 47, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-11T15:29:13.246 ProcessImageName: AgentShellService.exe, Pid: 4844, TotalTime: 824, Count: 22, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 49% 2026-09-11T15:29:13.246 ProcessImageName: WmiPrvSE.exe, Pid: 6404, TotalTime: 585, Count: 18, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\mrxsmb.sys, EstimatedImpact: 9% 2026-09-11T15:29:13.246 ProcessImageName: WmiPrvSE.exe, Pid: 1940, TotalTime: 452, Count: 36, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-11T15:29:13.246 ProcessImageName: powershell.exe, Pid: 7300, TotalTime: 340, Count: 23, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 20% 2026-09-11T15:29:13.246 ProcessImageName: WmiPrvSE.exe, Pid: 4064, TotalTime: 279, Count: 5, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-11T15:29:13.246 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 181, Count: 76, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2.MAI, EstimatedImpact: 0% 2026-09-11T15:29:13.246 ProcessImageName: python.exe, Pid: 6300, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-11T15:29:13.246 ProcessImageName: cmd.exe, Pid: 4996, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100% 2026-09-11T15:29:13.246 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\F3E83A3B09D643F8B1E640AC1D63B48B.MAI, EstimatedImpact: 5% 2026-09-11T15:29:13.246 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-11T15:29:13.246 ProcessImageName: taskhostw.exe, Pid: 8140, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 5% 2026-09-11T15:29:13.246 ProcessImageName: taskhostw.exe, Pid: 5608, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-11T15:29:13.246 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 91, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-11T15:29:13.246 ProcessImageName: DeviceCensus.exe, Pid: 1504, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-11T15:29:13.246 ProcessImageName: cmd.exe, Pid: 6388, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-11T15:29:13.246 ProcessImageName: mysqldump.exe, Pid: 6864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 8% 2026-09-11T15:29:13.246 ProcessImageName: powershell.exe, Pid: 7848, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-11T15:29:13.246 ProcessImageName: taskhostw.exe, Pid: 4184, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-11T15:29:13.246 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-11T15:40:42.996 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T15:41:02.981 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T15:41:02.981 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T15:41:02.981 [Cloud] Queued cloud request. 2026-09-11T15:41:02.981 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T15:41:02.981 [Cloud] Dequeued cloud request. 2026-09-11T15:41:02.981 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T15:41:03.184 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A0AC0467-FD6D-2DF4-7A0D-403EE7B13066} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 15:41:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T15:41:03.684 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T15:47:39.074 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T15:47:39.074 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T15:47:39.074 [Cloud] Queued cloud request. 2026-09-11T15:47:39.074 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T15:47:39.090 [Cloud] Dequeued cloud request. 2026-09-11T15:47:39.090 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T15:47:39.277 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6A88C2A1-E9DD-5794-9126-311700D8A9BF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 15:47:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T15:47:39.777 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T15:50:53.574 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T15:50:53.574 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T15:50:53.574 [Cloud] Queued cloud request. 2026-09-11T15:50:53.574 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T15:50:53.574 [Cloud] Dequeued cloud request. 2026-09-11T15:50:53.574 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T15:50:53.762 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1B4C79AD-DC91-ED3D-BDE8-E0AA9ABDC0BB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 15:50:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T15:50:54.277 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T15:53:16.433 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T15:53:16.433 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T15:53:16.433 [Cloud] Queued cloud request. 2026-09-11T15:53:16.433 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T15:53:16.433 [Cloud] Dequeued cloud request. 2026-09-11T15:53:16.433 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T15:53:16.637 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4E4DEA9A-43BF-9DE1-558C-1C2EB7C33F4C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 15:53:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T15:53:17.137 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T15:55:47.996 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T15:57:52.199 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T15:57:52.199 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T15:57:52.199 [Cloud] Queued cloud request. 2026-09-11T15:57:52.199 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T15:57:52.199 [Cloud] Dequeued cloud request. 2026-09-11T15:57:52.199 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T15:57:52.386 [Cloud] End of cloud request. 2026-09-11T15:57:52.886 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T16:07:51.839 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T16:07:51.839 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T16:07:51.839 [Cloud] Queued cloud request. 2026-09-11T16:07:51.839 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T16:07:51.855 [Cloud] Dequeued cloud request. 2026-09-11T16:07:51.855 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T16:07:52.121 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F92A67E-797F-18DE-1DC4-310367817B63} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 16:07:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T16:07:52.636 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T16:08:56.918 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T16:08:56.918 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T16:08:56.918 [Cloud] Queued cloud request. 2026-09-11T16:08:56.918 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T16:08:56.918 [Cloud] Dequeued cloud request. 2026-09-11T16:08:56.918 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T16:08:57.121 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{93956424-2555-2AF0-FDF0-BAD21933E9EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 16:08:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T16:08:57.636 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T16:10:52.996 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T16:16:57.621 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T16:16:57.621 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T16:16:57.621 [Cloud] Queued cloud request. 2026-09-11T16:16:57.621 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T16:16:57.621 [Cloud] Dequeued cloud request. 2026-09-11T16:16:57.621 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T16:16:57.824 [Cloud] End of cloud request. 2026-09-11T16:16:58.324 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T16:18:12.183 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T16:18:12.183 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T16:18:12.183 [Cloud] Queued cloud request. 2026-09-11T16:18:12.183 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T16:18:12.183 [Cloud] Dequeued cloud request. 2026-09-11T16:18:12.183 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T16:18:12.355 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9AD7D6A6-815F-A3BA-2878-4D00B3786070} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 16:18:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T16:18:12.870 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T16:25:57.995 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T16:26:25.777 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T16:26:25.777 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T16:26:25.777 [Cloud] Queued cloud request. 2026-09-11T16:26:25.777 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T16:26:25.777 [Cloud] Dequeued cloud request. 2026-09-11T16:26:25.777 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T16:26:28.401 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B09F340D-535D-43C6-F4B0-C0BB7AB96979} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 16:26:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T16:26:28.902 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T16:28:39.948 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T16:28:39.948 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T16:28:39.948 [Cloud] Queued cloud request. 2026-09-11T16:28:39.948 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T16:28:39.948 [Cloud] Dequeued cloud request. 2026-09-11T16:28:39.948 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T16:28:40.167 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{450BB15B-BE45-6A56-2EC2-259FA1C5B4FC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 16:28:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T16:28:40.667 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T16:41:02.995 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T16:56:07.995 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T17:06:42.760 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T17:06:42.760 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T17:06:42.760 [Cloud] Queued cloud request. 2026-09-11T17:06:42.760 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T17:06:42.760 [Cloud] Dequeued cloud request. 2026-09-11T17:06:42.760 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T17:06:42.963 [Cloud] End of cloud request. 2026-09-11T17:06:43.463 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T17:07:24.041 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T17:07:24.041 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T17:07:24.041 [Cloud] Queued cloud request. 2026-09-11T17:07:24.041 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T17:07:24.041 [Cloud] Dequeued cloud request. 2026-09-11T17:07:24.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T17:07:24.385 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{43B4AC54-62E0-E47F-9296-618C94A3F8DF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 17:07:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T17:07:24.901 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T17:07:39.823 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T17:07:39.823 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T17:07:39.823 [Cloud] Queued cloud request. 2026-09-11T17:07:39.823 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T17:07:39.823 [Cloud] Dequeued cloud request. 2026-09-11T17:07:39.823 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T17:07:39.901 [Cloud] End of cloud request. 2026-09-11T17:07:40.401 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T17:11:12.995 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T17:14:28.776 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T17:14:28.776 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T17:14:28.776 [Cloud] Queued cloud request. 2026-09-11T17:14:28.776 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T17:14:28.776 [Cloud] Dequeued cloud request. 2026-09-11T17:14:28.776 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T17:14:29.151 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D37BD79B-A157-13FF-E79E-91FCD1718328} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 17:14:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T17:14:29.666 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T17:23:21.104 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T17:23:21.104 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T17:23:21.104 [Cloud] Queued cloud request. 2026-09-11T17:23:21.104 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T17:23:21.104 [Cloud] Dequeued cloud request. 2026-09-11T17:23:21.104 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T17:23:21.307 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{701D9780-B72F-064F-4041-FEE24DC0FC13} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 17:23:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T17:23:21.807 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T17:26:17.994 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T17:29:13.260 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1423393, Count: 101807, MaxTime: 2046, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 1% 2026-09-11T17:29:13.260 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 26829, Count: 1527, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-11T17:29:13.260 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 7626, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-11T17:29:13.260 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 2260, Count: 271, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\E42B523C1E0748BD919FEA9988E1EFDD.MAI, EstimatedImpact: 0% 2026-09-11T17:29:13.260 ProcessImageName: powershell.exe, Pid: 2732, TotalTime: 1679, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-11T17:29:13.260 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 1633, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\5C5638AD3B10487481E768CEC099433C.MAI, EstimatedImpact: 23% 2026-09-11T17:29:13.260 ProcessImageName: php.exe, Pid: 6468, TotalTime: 1082, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 30% 2026-09-11T17:29:13.260 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 883, Count: 47, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-11T17:29:13.260 ProcessImageName: AgentShellService.exe, Pid: 4844, TotalTime: 824, Count: 22, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 49% 2026-09-11T17:29:13.260 ProcessImageName: WmiPrvSE.exe, Pid: 6404, TotalTime: 585, Count: 18, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\mrxsmb.sys, EstimatedImpact: 9% 2026-09-11T17:29:13.260 ProcessImageName: WmiPrvSE.exe, Pid: 1940, TotalTime: 452, Count: 36, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-11T17:29:13.260 ProcessImageName: powershell.exe, Pid: 7300, TotalTime: 340, Count: 23, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 20% 2026-09-11T17:29:13.260 ProcessImageName: WmiPrvSE.exe, Pid: 4064, TotalTime: 279, Count: 5, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-11T17:29:13.260 ProcessImageName: python.exe, Pid: 6556, TotalTime: 212, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 6% 2026-09-11T17:29:13.260 ProcessImageName: powershell.exe, Pid: 828, TotalTime: 201, Count: 19, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7d2adaded18de0da71ab05bff349ca5a\Microsoft.PowerShell.Security.ni.dll, EstimatedImpact: 22% 2026-09-11T17:29:13.260 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 181, Count: 76, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-fb26-2.MAI, EstimatedImpact: 0% 2026-09-11T17:29:13.260 ProcessImageName: python.exe, Pid: 6300, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-11T17:29:13.260 ProcessImageName: cmd.exe, Pid: 4996, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 100% 2026-09-11T17:29:13.260 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\F3E83A3B09D643F8B1E640AC1D63B48B.MAI, EstimatedImpact: 5% 2026-09-11T17:29:13.260 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-11T17:29:13.260 ProcessImageName: taskhostw.exe, Pid: 8140, TotalTime: 92, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 5% 2026-09-11T17:29:13.260 ProcessImageName: taskhostw.exe, Pid: 5608, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-11T17:29:13.260 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 91, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-11T17:29:13.260 ProcessImageName: DeviceCensus.exe, Pid: 1504, TotalTime: 77, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-11T17:29:13.260 ProcessImageName: cmd.exe, Pid: 6388, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-11T17:29:13.260 ProcessImageName: mysqldump.exe, Pid: 6864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 8% 2026-09-11T17:29:13.260 ProcessImageName: powershell.exe, Pid: 7848, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-11T17:29:13.260 ProcessImageName: taskhostw.exe, Pid: 4184, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-11T17:29:13.260 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-11T17:35:44.010 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T17:35:44.010 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T17:35:44.010 [Cloud] Queued cloud request. 2026-09-11T17:35:44.010 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T17:35:44.010 [Cloud] Dequeued cloud request. 2026-09-11T17:35:44.010 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T17:35:44.213 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{022E298E-F57A-D658-1E73-8D2A83DA2085} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 17:35:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T17:35:44.729 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T17:41:22.994 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T17:41:58.728 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T17:41:58.728 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T17:41:58.728 [Cloud] Queued cloud request. 2026-09-11T17:41:58.728 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T17:41:58.728 [Cloud] Dequeued cloud request. 2026-09-11T17:41:58.728 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T17:41:58.885 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A5957028-501F-58B1-530B-9990A05A85FB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 17:41:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T17:41:59.400 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T17:56:27.994 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T17:59:43.041 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T17:59:43.041 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T17:59:43.041 [Cloud] Queued cloud request. 2026-09-11T17:59:43.041 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T17:59:43.041 [Cloud] Dequeued cloud request. 2026-09-11T17:59:43.041 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T17:59:43.291 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2B647D16-DBAB-5A36-5AB7-29C019CC8CCD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 17:59:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T17:59:43.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T18:00:16.353 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T18:00:16.353 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T18:00:16.353 [Cloud] Queued cloud request. 2026-09-11T18:00:16.353 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T18:00:16.353 [Cloud] Dequeued cloud request. 2026-09-11T18:00:16.353 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T18:00:20.322 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{606DE8B9-9A03-2004-9C8B-48B85A4BF350} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 18:00:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T18:00:20.822 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T18:03:01.634 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T18:03:01.634 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T18:03:01.634 [Cloud] Queued cloud request. 2026-09-11T18:03:01.634 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T18:03:01.634 [Cloud] Dequeued cloud request. 2026-09-11T18:03:01.634 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T18:03:01.822 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B4CCB1F8-56DF-5847-DFB5-31DEDE746085} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 18:03:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T18:03:02.322 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T18:05:49.415 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T18:05:49.415 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T18:05:49.415 [Cloud] Queued cloud request. 2026-09-11T18:05:49.415 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T18:05:49.415 [Cloud] Dequeued cloud request. 2026-09-11T18:05:49.415 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T18:05:49.650 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{84A22490-EB66-DB78-9F39-A89E49C0023B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 18:05:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T18:05:50.165 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T18:11:32.993 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T18:11:58.197 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T18:11:58.197 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T18:11:58.197 [Cloud] Queued cloud request. 2026-09-11T18:11:58.197 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T18:11:58.197 [Cloud] Dequeued cloud request. 2026-09-11T18:11:58.197 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T18:11:58.368 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C459B0EF-1576-1553-37CC-9887E2B0666B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 18:11:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T18:11:58.868 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T18:12:17.119 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T18:12:17.119 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T18:12:17.119 [Cloud] Queued cloud request. 2026-09-11T18:12:17.119 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T18:12:17.119 [Cloud] Dequeued cloud request. 2026-09-11T18:12:17.119 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T18:12:27.150 [Cloud] End of cloud request. 2026-09-11T18:12:27.650 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T18:19:34.415 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T18:19:34.415 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T18:19:34.415 [Cloud] Queued cloud request. 2026-09-11T18:19:34.415 [Cloud] Dequeued cloud request. 2026-09-11T18:19:34.415 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T18:19:34.415 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T18:19:34.571 [Cloud] End of cloud request. 2026-09-11T18:19:35.071 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T18:26:37.993 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T18:28:11.930 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T18:28:11.930 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T18:28:11.930 [Cloud] Queued cloud request. 2026-09-11T18:28:11.930 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T18:28:11.930 [Cloud] Dequeued cloud request. 2026-09-11T18:28:11.930 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T18:28:22.024 [Cloud] End of cloud request. 2026-09-11T18:28:22.524 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T18:34:17.587 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T18:34:17.587 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T18:34:17.587 [Cloud] Queued cloud request. 2026-09-11T18:34:17.587 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T18:34:17.587 [Cloud] Dequeued cloud request. 2026-09-11T18:34:17.587 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T18:34:17.727 [Cloud] End of cloud request. 2026-09-11T18:34:18.243 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T18:41:42.993 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T18:52:53.180 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T18:52:53.180 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T18:52:53.180 [Cloud] Queued cloud request. 2026-09-11T18:52:53.180 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T18:52:53.180 [Cloud] Dequeued cloud request. 2026-09-11T18:52:53.180 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T18:52:53.445 [Cloud] End of cloud request. 2026-09-11T18:52:53.961 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T18:56:47.992 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T19:08:01.195 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T19:08:01.195 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T19:08:01.195 [Cloud] Queued cloud request. 2026-09-11T19:08:01.195 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T19:08:01.195 [Cloud] Dequeued cloud request. 2026-09-11T19:08:01.195 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T19:08:01.351 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{62FBD49F-4165-66F4-AECE-D287E4A717BA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 19:08:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T19:08:01.867 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T19:11:52.992 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T19:26:57.992 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T19:28:17.991 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-11T19:28:18.038 Job Notification: New process added to job (4960) 2026-09-11T19:28:18.054 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-11T19:28:18.070 Aggressive catchup quick scan threshold: 692443418967 / 25920000000000 2026-09-11T19:28:18.070 Job Notification: New process added to job (7632) 2026-09-11T19:28:18.085 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:4960] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7632]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-11T19:28:18.257 Job Notification: New process added to job (5452) 2026-09-11T19:28:18.257 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-11T19:28:18.273 Job Notification: New process added to job (4880) 2026-09-11T19:28:18.351 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:5452] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:4880]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-11T19:28:18.403 Job Notification: New process added to job (5728) 2026-09-11T19:28:18.570 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-11T19:28:18.570 [RTP] Duplicating the current plugin configuration object... 2026-09-11T19:28:18.570 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-11T19:28:18.570 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-11T19:28:18.570 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-11T19:28:18.570 [RTP] No config change detected. Not updating plugin configuration. 2026-09-11T19:28:18.570 [RTP] No config changes found. No configuration switch. 2026-09-11T19:28:18.570 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-11T19:28:18.882 Task(GetDeviceTicket -AccessKey 909E58EF-9F07-FA24-5CEE-00003C80013B ) launched as network service 2026-09-11T19:28:19.210 Job Notification: Process exited from job (5728) 2026-09-11T19:28:19.382 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-11T19:28:19.382 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T19:28:19.382 [Cloud] Queued cloud request. 2026-09-11T19:28:19.382 [Cloud] Dequeued cloud request. 2026-09-11T19:28:19.398 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T19:28:19.523 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-11T19:28:19.538 [Cloud] End of cloud request. 2026-09-11T19:28:19.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T19:28:30.976 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\C308650B-240F-413D-A3C0-67BF25D71D7C1868.1dd4223b8d1723e 2026-09-11T19:28:31.054 Verifying engine and signature files (source: 0) ... 2026-09-11T19:28:31.054 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82}\mpengine.dll] due to PPL. 2026-09-11T19:28:31.054 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82}\mpasbase.vdm]. File not in cache (0x1) 2026-09-11T19:28:32.241 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82}\mpasbase.vdm] 2026-09-11T19:28:32.241 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-11T19:28:32.257 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82}\mpasdlta.vdm] 2026-09-11T19:28:32.257 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82}\mpavbase.vdm]. File not in cache (0x1) 2026-09-11T19:28:32.773 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82}\mpavbase.vdm] 2026-09-11T19:28:32.773 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-11T19:28:32.788 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82}\mpavdlta.vdm] 2026-09-11T19:28:33.038 [Engine] IsHybridMode: 0 2026-09-11T19:28:33.038 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-11T19:28:33.054 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-6265B5BF1122785B996A2212624BB90AE67777D1.bin): 0x00000002 2026-09-11T19:28:33.054 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-6265B5BF1122785B996A2212624BB90AE67777D1.bin) 2026-09-11T19:28:33.054 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-11T19:28:33.054 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-11T19:28:33.054 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-11T19:28:33.054 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-11T19:28:47.382 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-11T19:28:47.398 [AutoExclusion] Applied roles from cache. 2026-09-11T19:28:47.398 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-11T19:28:47.538 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF4ABB020, lRefCount: 6, hr=0 2026-09-11T19:28:47.538 [Engine] New active engine 00007FFCF68AB020 replacing engine 00007FFCF4ABB020. Number of active engines: 2 2026-09-11T19:28:47.554 EngineInit:Global ASOC is enabled 2026-09-11T19:28:47.554 EngineInit:ASOO is enabled for developer volumes 2026-09-11T19:28:47.741 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-11T19:28:47.741 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.741 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-11T19:28:47.741 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-11T19:28:47.741 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.757 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-11T19:28:47.788 MpWriteUupSignatureVersion 1.459.163.0, hr = 0 2026-09-11T19:28:47.788 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-11T19:28:47.835 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-11T19:28:47.835 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-11T19:28:47.835 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-11T19:28:47.835 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-11T19:28:47.866 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-11T19:28:47.866 [Plugin] Initializing RTP plugin state... 2026-09-11T19:28:47.866 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-11T19:28:47.866 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎10‎-‎2026 21:29:13 Last Perf:‎09‎-‎10‎-‎2026 21:29:13 First RTP Scan:‎09‎-‎10‎-‎2026 21:29:14 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:13590 Misses:57764 BM Queue:0,1189,0 Proc:0,28,0 File:0,1187,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:2,3,0 SetEngine:1,1,0 SetState:1,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:4417140 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:-1545776878 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:22591 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:730312 TotalHits:21985891 InstanceCacheInserts:451461 InstanceCacheUpdates:0 InstanceCacheDeletes:59845 InstanceCacheHits:16548 InstanceCacheMisses:786286 InstanceCacheOverflows:366876 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:6ms (9995/1516) Success: 1516, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-11T19:28:47.866 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82} 2026-09-11T19:28:47.866 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{01049F39-9537-4BCC-B35E-B4EB4D2A846D} removed 2026-09-11T19:28:47.866 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D}\mpasbase.vdm in use, hr=0x80070020 2026-09-11T19:28:47.866 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-11T19:28:47.866 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-11T19:28:47.866 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-11T19:28:47.866 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-11T19:28:47.866 MdCoreSvc is supported in this platform and OS 2026-09-11T19:28:47.866 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-11-2026 19:28:47 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-11-2026 19:28:47 2026-09-11T19:28:47.882 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-11T19:28:47.882 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-11T19:28:47.882 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-11T19:28:47.882 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-11T19:28:47.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T19:28:47.898 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-11T19:28:47.898 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-11T19:28:47.898 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-11T19:28:47.898 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-11T19:28:47.898 MdCoreSvc is supported in this platform and OS Signature updated on 09-11-2026 19:28:47 Product Version: 4.18.26080.3 Service Version: 4.18.26080.3 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.163.0 AV Signature Version: 1.459.163.0 ************************************************************ 2026-09-11T19:28:47.898 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-11T19:28:47.898 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\C308650B-240F-413D-A3C0-67BF25D71D7C1868.1dd4223b8d1723e 2026-09-11T19:28:47.976 Process scan (postsignatureupdatescan) started. 2026-09-11T19:28:47.976 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-11T19:28:47.976 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-11-2026 19:28:48 ************************************************************ 2026-09-11T19:28:48.288 Job Notification: Process exited from job (4960) 2026-09-11T19:28:48.320 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-11T19:28:48.320 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-11T19:28:48.320 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-11T19:28:48.320 Job Notification: Process exited from job (7632) 2026-09-11T19:28:48.320 Job Notification: Process exited from job (5452) 2026-09-11T19:28:48.335 Job Notification: Process exited from job (4880) 2026-09-11T19:28:48.429 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-11T19:28:48.429 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-11T19:28:48.429 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-11T19:28:48.429 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-11T19:28:48.429 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-11T19:28:48.445 [Engine] Engine 00007FFCF4ABB020 no longer in use. Number of active engines: 1 2026-09-11T19:28:48.445 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-11T19:28:48.445 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-11T19:28:49.023 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1423470, Count: 101809, MaxTime: 2046, MaxTimeFile: \Device\HarddiskVolume2\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\vendor.bundle.js, EstimatedImpact: 1% 2026-09-11T19:28:49.023 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 30927, Count: 1705, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-11T19:28:49.023 ProcessImageName: AgentShell.exe, Pid: 7176, TotalTime: 7626, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-11T19:28:49.023 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 2260, Count: 271, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\E42B523C1E0748BD919FEA9988E1EFDD.MAI, EstimatedImpact: 0% 2026-09-11T19:28:49.023 ProcessImageName: powershell.exe, Pid: 2732, TotalTime: 1679, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-11T19:28:49.023 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 1633, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\5C5638AD3B10487481E768CEC099433C.MAI, EstimatedImpact: 23% 2026-09-11T19:28:49.023 ProcessImageName: php.exe, Pid: 6468, TotalTime: 1082, Count: 21, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 30% 2026-09-11T19:28:49.023 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1066, Count: 57, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-11T19:28:49.023 ProcessImageName: AgentShellService.exe, Pid: 4844, TotalTime: 824, Count: 22, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 49% 2026-09-11T19:28:49.023 ProcessImageName: WmiPrvSE.exe, Pid: 6404, TotalTime: 585, Count: 18, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\mrxsmb.sys, EstimatedImpact: 9% 2026-09-11T19:28:49.023 ProcessImageName: WmiPrvSE.exe, Pid: 1940, TotalTime: 452, Count: 36, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-11T19:28:49.023 ProcessImageName: powershell.exe, Pid: 7300, TotalTime: 340, Count: 23, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 20% 2026-09-11T19:28:49.023 ProcessImageName: WmiPrvSE.exe, Pid: 4064, TotalTime: 279, Count: 5, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-11T19:28:49.023 ProcessImageName: python.exe, Pid: 6556, TotalTime: 212, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 6% 2026-09-11T19:28:49.023 ProcessImageName: powershell.exe, Pid: 828, TotalTime: 201, Count: 19, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7d2adaded18de0da71ab05bff349ca5a\Microsoft.PowerShell.Security.ni.dll, EstimatedImpact: 22% 2026-09-11T19:28:49.104 [Engine] RSIG_UNLOADENGINE, 00007FFCF4ABB020, err=0x0 2026-09-11T19:28:49.132 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EB276A3F-7091-4AB3-8DD1-0468E845318D} removed 2026-09-11T19:29:06.335 Process scan (postsignatureupdatescan) completed. 2026-09-11T19:32:12.460 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T19:32:12.460 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T19:32:12.460 [Cloud] Queued cloud request. 2026-09-11T19:32:12.460 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T19:32:12.460 [Cloud] Dequeued cloud request. 2026-09-11T19:32:12.460 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{F8B94722-D295-FC82-97EA-A8F453B0AC2E} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 19:32:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T19:32:22.554 [Cloud] End of cloud request. 2026-09-11T19:32:23.054 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T19:33:47.616 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-11T19:37:53.022 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T19:37:53.022 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T19:37:53.022 [Cloud] Queued cloud request. 2026-09-11T19:37:53.022 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T19:37:53.022 [Cloud] Dequeued cloud request. 2026-09-11T19:37:53.022 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T19:37:53.194 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{72E6AF7E-7E95-C73F-0F3B-ADD4EE875772} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 19:37:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T19:37:53.710 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T19:42:02.991 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T19:49:52.584 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T19:49:52.584 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T19:49:52.584 [Cloud] Queued cloud request. 2026-09-11T19:49:52.584 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T19:49:52.584 [Cloud] Dequeued cloud request. 2026-09-11T19:49:52.584 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T19:49:52.741 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FCF64ADB-7CCB-D031-1A44-D55F4BE1C4CD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 19:49:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T19:49:53.256 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T19:54:00.897 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T19:54:00.897 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T19:54:00.897 [Cloud] Queued cloud request. 2026-09-11T19:54:00.897 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T19:54:00.897 [Cloud] Dequeued cloud request. 2026-09-11T19:54:00.897 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T19:54:01.053 [Cloud] End of cloud request. 2026-09-11T19:54:01.553 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T19:57:07.991 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T20:01:54.631 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T20:01:54.631 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T20:01:54.631 [Cloud] Queued cloud request. 2026-09-11T20:01:54.631 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T20:01:54.631 [Cloud] Dequeued cloud request. 2026-09-11T20:01:54.647 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T20:01:54.850 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AF04DB07-48E0-6E5A-AA07-A3E6FDA7B348} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 20:01:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T20:01:55.350 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T20:11:58.021 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T20:11:58.021 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T20:11:58.021 [Cloud] Queued cloud request. 2026-09-11T20:11:58.021 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T20:11:58.021 [Cloud] Dequeued cloud request. 2026-09-11T20:11:58.021 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T20:11:58.209 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A4B0247D-5632-7F6C-74B7-D253043F2FFE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 20:11:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T20:11:58.724 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T20:12:12.990 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T20:12:14.771 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T20:12:14.771 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T20:12:14.771 [Cloud] Queued cloud request. 2026-09-11T20:12:14.771 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T20:12:14.771 [Cloud] Dequeued cloud request. 2026-09-11T20:12:14.771 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T20:12:14.849 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6977B9B8-2570-63CC-52E5-00E74AD3D24C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 20:12:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T20:12:15.349 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T20:25:23.708 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T20:25:23.708 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T20:25:23.708 [Cloud] Queued cloud request. 2026-09-11T20:25:23.708 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T20:25:23.708 [Cloud] Dequeued cloud request. 2026-09-11T20:25:23.708 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T20:25:23.974 [Cloud] End of cloud request. 2026-09-11T20:25:24.474 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T20:26:53.911 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T20:26:53.911 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T20:26:53.911 [Cloud] Queued cloud request. 2026-09-11T20:26:53.911 [Cloud] Dequeued cloud request. 2026-09-11T20:26:53.911 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T20:26:53.911 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T20:26:54.161 [Cloud] End of cloud request. 2026-09-11T20:26:54.661 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T20:27:17.989 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T20:28:24.099 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T20:28:24.099 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T20:28:24.099 [Cloud] Queued cloud request. 2026-09-11T20:28:24.099 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T20:28:24.099 [Cloud] Dequeued cloud request. 2026-09-11T20:28:24.099 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T20:28:24.286 [Cloud] End of cloud request. 2026-09-11T20:28:24.802 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T20:42:22.989 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T20:43:43.677 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T20:43:43.677 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T20:43:43.677 [Cloud] Queued cloud request. 2026-09-11T20:43:43.677 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T20:43:43.677 [Cloud] Dequeued cloud request. 2026-09-11T20:43:43.677 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T20:43:43.833 [Cloud] End of cloud request. 2026-09-11T20:43:44.349 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T20:57:27.988 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T21:00:34.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T21:00:34.145 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T21:00:34.145 [Cloud] Queued cloud request. 2026-09-11T21:00:34.145 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T21:00:34.145 [Cloud] Dequeued cloud request. 2026-09-11T21:00:34.145 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T21:00:34.316 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{10C8EC43-9F89-8F8B-783D-B5D25EECD70F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 21:00:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T21:00:34.816 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T21:03:47.176 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T21:03:47.176 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T21:03:47.176 [Cloud] Queued cloud request. 2026-09-11T21:03:47.176 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T21:03:47.176 [Cloud] Dequeued cloud request. 2026-09-11T21:03:47.176 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T21:03:47.316 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0ECE6BB4-F085-8EA6-7514-4B54B2FC7D37} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 21:03:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T21:03:47.832 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T21:09:20.816 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\IDR_XML_DEFAULT_TRANSFORM[1]. Process: \Device\HarddiskVolume2\Windows\System32\taskhostw.exe, Status: 0xc0000001, State: 0, ScanRequest #4451092, FileId: 0xd000000012090, Reason: OnClose, IoStatusBlockForNewFile: 0x3, DesiredAccess:0x0, FileAttributes:0x2020, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T21:10:19.675 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T21:10:19.675 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T21:10:19.675 [Cloud] Queued cloud request. 2026-09-11T21:10:19.675 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T21:10:19.675 [Cloud] Dequeued cloud request. 2026-09-11T21:10:19.675 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T21:10:19.832 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DF6EB876-1D94-7822-AFD6-56C01939377B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 21:10:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T21:10:20.347 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T21:12:32.988 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T21:27:37.987 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T21:28:47.550 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 10612, Count: 490, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-11T21:28:47.550 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 4467, Count: 181, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-11T21:28:47.550 ProcessImageName: powershell.exe, Pid: 8144, TotalTime: 2041, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-11T21:28:47.550 ProcessImageName: WmiPrvSE.exe, Pid: 5828, TotalTime: 325, Count: 5, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-11T21:28:47.550 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 230, Count: 12, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-11T21:28:47.550 ProcessImageName: taskhostw.exe, Pid: 4784, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-11T21:28:47.550 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-11T21:28:47.550 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-11T21:28:47.550 ProcessImageName: makecab.exe, Pid: 7332, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\cab_7332_2, EstimatedImpact: 7% 2026-09-11T21:28:47.550 ProcessImageName: ngentask.exe, Pid: 4880, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19% 2026-09-11T21:28:47.550 ProcessImageName: taskhostw.exe, Pid: 6328, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-11T21:30:37.518 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T21:30:37.518 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T21:30:37.518 [Cloud] Queued cloud request. 2026-09-11T21:30:37.518 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T21:30:37.518 [Cloud] Dequeued cloud request. 2026-09-11T21:30:37.518 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T21:30:37.675 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F337541A-E466-0B1D-2BD1-955EDC6AF78E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 21:30:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T21:30:38.190 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T21:41:26.346 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T21:41:26.346 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T21:41:26.346 [Cloud] Queued cloud request. 2026-09-11T21:41:26.346 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T21:41:26.346 [Cloud] Dequeued cloud request. 2026-09-11T21:41:26.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T21:41:26.534 [Cloud] End of cloud request. 2026-09-11T21:41:27.034 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T21:42:42.987 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T21:57:35.236 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T21:57:35.236 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T21:57:35.236 [Cloud] Queued cloud request. 2026-09-11T21:57:35.236 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T21:57:35.236 [Cloud] Dequeued cloud request. 2026-09-11T21:57:35.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T21:57:39.986 [Cloud] End of cloud request. 2026-09-11T21:57:40.486 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T21:57:47.986 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T22:04:30.548 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T22:04:30.548 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T22:04:30.548 [Cloud] Queued cloud request. 2026-09-11T22:04:30.548 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T22:04:30.548 [Cloud] Dequeued cloud request. 2026-09-11T22:04:30.564 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T22:04:30.705 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1C55B09B-02CD-5D47-B8FF-CDAB291414D6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 22:04:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T22:04:31.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T22:12:03.064 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T22:12:03.064 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T22:12:03.064 [Cloud] Queued cloud request. 2026-09-11T22:12:03.064 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T22:12:03.064 [Cloud] Dequeued cloud request. 2026-09-11T22:12:03.064 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T22:12:13.157 [Cloud] End of cloud request. 2026-09-11T22:12:13.657 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T22:12:51.392 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T22:12:51.392 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T22:12:51.392 [Cloud] Queued cloud request. 2026-09-11T22:12:51.392 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T22:12:51.392 [Cloud] Dequeued cloud request. 2026-09-11T22:12:51.392 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T22:12:51.486 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{88A1CCA6-8207-DD0B-3B98-6B2A2AADD52E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 22:12:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T22:12:51.986 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T22:12:52.986 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T22:14:09.392 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T22:14:09.392 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T22:14:09.392 [Cloud] Queued cloud request. 2026-09-11T22:14:09.392 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T22:14:09.392 [Cloud] Dequeued cloud request. 2026-09-11T22:14:09.392 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T22:14:09.532 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F61B4E34-7371-1C80-F2CF-B118FFAD9AD5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 22:14:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T22:14:10.048 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T22:24:12.204 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_2mt4ojac.5lj.psm1. Process: \Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #4476054, FileId: 0xf00000000d0e0, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-11T22:27:57.985 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T22:34:51.032 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T22:34:51.032 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T22:34:51.032 [Cloud] Queued cloud request. 2026-09-11T22:34:51.032 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T22:34:51.032 [Cloud] Dequeued cloud request. 2026-09-11T22:34:51.032 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T22:34:51.219 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6085D722-B0DC-9ADF-139C-90E5C7F916A1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 22:34:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T22:34:51.735 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T22:43:02.984 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T22:43:17.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T22:43:17.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T22:43:17.297 [Cloud] Queued cloud request. 2026-09-11T22:43:17.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T22:43:17.297 [Cloud] Dequeued cloud request. 2026-09-11T22:43:17.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T22:43:17.562 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F1FE82A-43F1-FC7A-D010-484B319278CF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 22:43:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T22:43:18.062 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T22:55:32.406 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T22:55:32.406 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T22:55:32.406 [Cloud] Queued cloud request. 2026-09-11T22:55:32.406 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T22:55:32.406 [Cloud] Dequeued cloud request. 2026-09-11T22:55:32.406 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T22:55:32.609 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{96AFEA7C-015A-8158-7098-1C01CADF7302} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 22:55:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T22:55:33.109 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T22:57:28.687 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T22:57:28.687 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T22:57:28.687 [Cloud] Queued cloud request. 2026-09-11T22:57:28.687 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T22:57:28.687 [Cloud] Dequeued cloud request. 2026-09-11T22:57:28.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T22:57:28.874 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E57E3D1C-C27D-11C2-B8D5-89B86D82A87F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 22:57:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T22:57:29.390 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T22:58:07.983 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T23:03:01.655 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T23:03:01.655 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T23:03:01.655 [Cloud] Queued cloud request. 2026-09-11T23:03:01.655 [Cloud] Dequeued cloud request. 2026-09-11T23:03:01.655 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T23:03:01.655 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T23:03:01.843 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F8DA4A7D-FA14-3255-D32F-2F247ED23A15} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 23:03:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T23:03:02.374 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T23:13:12.983 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T23:20:03.795 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T23:20:03.795 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T23:20:03.795 [Cloud] Queued cloud request. 2026-09-11T23:20:03.795 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T23:20:03.795 [Cloud] Dequeued cloud request. 2026-09-11T23:20:03.795 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T23:20:04.013 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BDD33B9A-1C07-58F8-327D-9E4D802D1E11} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 23:20:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T23:20:04.529 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T23:27:47.341 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T23:27:47.341 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T23:27:47.341 [Cloud] Queued cloud request. 2026-09-11T23:27:47.341 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T23:27:47.341 [Cloud] Dequeued cloud request. 2026-09-11T23:27:47.341 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T23:27:47.575 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{45F0259E-EA7A-4D88-852B-089A6CF7040F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 23:27:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T23:27:48.091 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T23:28:17.982 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T23:28:47.560 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 14493, Count: 745, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-11T23:28:47.560 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 6348, Count: 260, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-11T23:28:47.560 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 3258, Count: 147, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-11T23:28:47.560 ProcessImageName: powershell.exe, Pid: 8144, TotalTime: 2041, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-11T23:28:47.560 ProcessImageName: AgentShellService.exe, Pid: 6496, TotalTime: 870, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-11T23:28:47.560 ProcessImageName: WmiPrvSE.exe, Pid: 2028, TotalTime: 737, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-11T23:28:47.560 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 336, Count: 18, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-11T23:28:47.560 ProcessImageName: WmiPrvSE.exe, Pid: 5828, TotalTime: 325, Count: 5, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-11T23:28:47.560 ProcessImageName: taskhostw.exe, Pid: 4784, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-11T23:28:47.560 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-11T23:28:47.560 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-11T23:28:47.560 ProcessImageName: makecab.exe, Pid: 7332, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\cab_7332_2, EstimatedImpact: 7% 2026-09-11T23:28:47.560 ProcessImageName: ngentask.exe, Pid: 4880, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19% 2026-09-11T23:28:47.560 ProcessImageName: taskhostw.exe, Pid: 6328, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-11T23:28:47.560 ProcessImageName: powershell.exe, Pid: 5548, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-11T23:30:38.091 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T23:30:38.091 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T23:30:38.091 [Cloud] Queued cloud request. 2026-09-11T23:30:38.091 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T23:30:38.091 [Cloud] Dequeued cloud request. 2026-09-11T23:30:38.091 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T23:30:38.310 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{18983FD3-6489-A108-371C-E45E34CF5B2A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 23:30:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T23:30:38.810 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T23:40:31.012 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-11T23:40:31.012 [Cloud] Start of cloud request. Passive mode: 0 2026-09-11T23:40:31.012 [Cloud] Queued cloud request. 2026-09-11T23:40:31.012 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-11T23:40:31.012 [Cloud] Dequeued cloud request. 2026-09-11T23:40:31.012 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-11T23:40:31.215 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6CDB14A3-0712-D7FD-CB91-83B3D2A656A8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-11-2026 23:40:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-11T23:40:31.715 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-11T23:43:22.981 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-11T23:58:27.980 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T00:12:08.808 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T00:12:08.808 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T00:12:08.808 [Cloud] Queued cloud request. 2026-09-12T00:12:08.808 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T00:12:08.808 [Cloud] Dequeued cloud request. 2026-09-12T00:12:08.823 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T00:12:08.979 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4D30B833-A90F-F7B7-B92E-6757887599D3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 00:12:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T00:12:09.479 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T00:13:27.136 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T00:13:27.136 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T00:13:27.136 [Cloud] Queued cloud request. 2026-09-12T00:13:27.136 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T00:13:27.136 [Cloud] Dequeued cloud request. 2026-09-12T00:13:27.136 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{138D73FB-876F-F510-EB69-C9D39EA9965C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 00:13:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T00:13:27.276 [Cloud] End of cloud request. 2026-09-12T00:13:27.792 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T00:13:32.979 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T00:14:13.511 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:83D9BCD8-7EFA-4253-9573-3C4250A5D636, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-12T00:14:13.511 Scheduled scan with Id 83D9BCD8-7EFA-4253-9573-3C4250A5D636 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-12T00:14:13.511 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-12T00:14:13.511 [SFC] System file cache build is not needed (already completed) 2026-09-12T00:14:38.854 Engine:Triggered AR EMS scan 2026-09-12T00:14:38.854 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.886 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.901 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.901 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.901 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.917 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.917 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.933 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.948 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.948 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.948 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.948 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.964 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.964 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.979 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.995 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:38.995 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.011 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.011 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.026 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.026 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.042 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.042 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.042 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.042 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.058 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.073 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.073 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.089 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.089 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.089 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.089 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.104 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.120 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.136 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.136 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.151 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.151 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.167 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.167 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.167 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.167 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.183 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.183 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.198 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.198 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.198 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.214 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.229 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.229 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.245 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.261 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.276 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.276 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.292 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.308 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.339 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.339 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.354 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.370 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:14:39.386 Engine:EMS scan for process: svchost pid: 7888, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-12T00:15:23.839 QuickScan:ScanID:83D9BCD8-7EFA-4253-9573-3C4250A5D636: Quick scan finished with error 0 2026-09-12T00:15:24.370 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-12T00:15:24.370 [RTP] Duplicating the current plugin configuration object... 2026-09-12T00:15:24.370 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-12T00:15:24.370 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-12T00:15:24.370 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-12T00:15:24.370 [RTP] No config change detected. Not updating plugin configuration. 2026-09-12T00:15:24.370 [RTP] No config changes found. No configuration switch. 2026-09-12T00:15:24.370 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-12T00:18:28.323 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T00:18:28.323 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T00:18:28.323 [Cloud] Queued cloud request. 2026-09-12T00:18:28.323 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T00:18:28.323 [Cloud] Dequeued cloud request. 2026-09-12T00:18:28.323 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T00:18:28.526 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2429E314-AF8A-B707-C9E5-B4B6C5CEF16F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 00:18:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T00:18:29.026 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T00:19:31.245 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T00:19:31.245 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T00:19:31.245 [Cloud] Queued cloud request. 2026-09-12T00:19:31.245 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T00:19:31.245 [Cloud] Dequeued cloud request. 2026-09-12T00:19:31.245 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T00:19:31.385 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C6066F38-FE95-FD8C-D099-411F53C066EB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 00:19:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T00:19:31.901 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T00:28:37.978 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T00:43:42.993 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T00:58:47.977 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T01:00:01.836 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528598, FileId: 0x19000000015685, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.836 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528599, FileId: 0x1d0000000154f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.867 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528604, FileId: 0x1b000000015685, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.867 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528605, FileId: 0x1f0000000154f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.883 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528610, FileId: 0x1d000000015685, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.883 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528611, FileId: 0x210000000154f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.898 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528616, FileId: 0x1f000000015685, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.898 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528617, FileId: 0x230000000154f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.914 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528622, FileId: 0x21000000015685, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.914 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528623, FileId: 0x250000000154f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.930 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528629, FileId: 0x270000000154f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.930 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528628, FileId: 0x23000000015685, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.945 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528634, FileId: 0x25000000015685, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.945 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528635, FileId: 0x290000000154f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.961 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528641, FileId: 0x27000000015685, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.961 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528640, FileId: 0x2b0000000154f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.976 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528647, FileId: 0x2d0000000154f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.976 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528646, FileId: 0x29000000015685, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.992 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528652, FileId: 0x2b000000015685, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:01.992 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528653, FileId: 0x2f0000000154f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:02.023 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528658, FileId: 0x2d000000015685, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:02.023 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528659, FileId: 0x310000000154f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:02.055 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528665, FileId: 0x330000000154f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:00:02.055 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-12c20-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4528664, FileId: 0x2f000000015685, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T01:07:18.617 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T01:07:18.617 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T01:07:18.617 [Cloud] Queued cloud request. 2026-09-12T01:07:18.617 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T01:07:18.617 [Cloud] Dequeued cloud request. 2026-09-12T01:07:18.632 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T01:07:25.835 [Cloud] End of cloud request. 2026-09-12T01:07:26.351 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T01:13:52.976 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T01:17:00.101 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T01:17:00.101 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T01:17:00.101 [Cloud] Queued cloud request. 2026-09-12T01:17:00.101 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T01:17:00.101 [Cloud] Dequeued cloud request. 2026-09-12T01:17:00.116 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T01:17:00.272 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8DE4A6D8-2A77-3271-FB22-206F158ECF5E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 01:17:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T01:17:00.772 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T01:25:18.241 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T01:25:18.241 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T01:25:18.241 [Cloud] Queued cloud request. 2026-09-12T01:25:18.241 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T01:25:18.241 [Cloud] Dequeued cloud request. 2026-09-12T01:25:18.241 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T01:25:18.475 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8E15BAB-46AF-B498-C43F-6FBEB65B81BC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 01:25:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T01:25:18.991 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T01:27:54.928 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T01:27:54.928 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T01:27:54.928 [Cloud] Queued cloud request. 2026-09-12T01:27:54.928 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T01:27:54.928 [Cloud] Dequeued cloud request. 2026-09-12T01:27:54.928 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T01:27:55.115 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E80155C5-00CD-A774-9115-C70D58E5EA56} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 01:27:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T01:27:55.615 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T01:28:47.568 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 17425, Count: 933, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-12T01:28:47.568 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 7073, Count: 339, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-12T01:28:47.568 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 6348, Count: 260, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-12T01:28:47.568 ProcessImageName: powershell.exe, Pid: 8144, TotalTime: 2041, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-12T01:28:47.568 ProcessImageName: AgentShellService.exe, Pid: 6496, TotalTime: 870, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-12T01:28:47.568 ProcessImageName: WmiPrvSE.exe, Pid: 2028, TotalTime: 737, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-12T01:28:47.568 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 503, Count: 27, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-12T01:28:47.568 ProcessImageName: WmiPrvSE.exe, Pid: 5828, TotalTime: 325, Count: 5, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-12T01:28:47.568 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-11f36-0.MAI, EstimatedImpact: 0% 2026-09-12T01:28:47.568 ProcessImageName: taskhostw.exe, Pid: 4784, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-12T01:28:47.568 ProcessImageName: DeviceCensus.exe, Pid: 6304, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-12T01:28:47.568 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-12T01:28:47.568 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-12T01:28:47.568 ProcessImageName: makecab.exe, Pid: 7332, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\cab_7332_2, EstimatedImpact: 7% 2026-09-12T01:28:47.568 ProcessImageName: mysqldump.exe, Pid: 6232, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 16% 2026-09-12T01:28:47.568 ProcessImageName: ngentask.exe, Pid: 4880, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19% 2026-09-12T01:28:47.568 ProcessImageName: taskhostw.exe, Pid: 6328, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-12T01:28:47.568 ProcessImageName: powershell.exe, Pid: 5548, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-12T01:28:57.975 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T01:37:49.927 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T01:37:49.927 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T01:37:49.927 [Cloud] Queued cloud request. 2026-09-12T01:37:49.927 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T01:37:49.927 [Cloud] Dequeued cloud request. 2026-09-12T01:37:49.927 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T01:37:50.084 [Cloud] End of cloud request. 2026-09-12T01:37:50.599 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T01:42:15.084 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T01:42:15.084 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T01:42:15.084 [Cloud] Queued cloud request. 2026-09-12T01:42:15.084 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T01:42:15.084 [Cloud] Dequeued cloud request. 2026-09-12T01:42:15.099 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T01:42:15.240 [Cloud] End of cloud request. 2026-09-12T01:42:15.755 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T01:43:50.193 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T01:43:50.193 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T01:43:50.193 [Cloud] Queued cloud request. 2026-09-12T01:43:50.193 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T01:43:50.193 [Cloud] Dequeued cloud request. 2026-09-12T01:43:50.209 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T01:43:50.349 [Cloud] End of cloud request. 2026-09-12T01:43:50.849 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T01:44:02.974 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T01:44:27.334 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T01:44:27.334 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T01:44:27.334 [Cloud] Queued cloud request. 2026-09-12T01:44:27.334 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T01:44:27.334 [Cloud] Dequeued cloud request. 2026-09-12T01:44:27.334 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T01:44:35.865 [Cloud] End of cloud request. 2026-09-12T01:44:36.365 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T01:55:24.333 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T01:55:24.333 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T01:55:24.333 [Cloud] Queued cloud request. 2026-09-12T01:55:24.333 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T01:55:24.333 [Cloud] Dequeued cloud request. 2026-09-12T01:55:24.333 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T01:55:24.489 [Cloud] End of cloud request. 2026-09-12T01:55:25.004 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T01:56:54.161 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T01:56:54.161 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T01:56:54.161 [Cloud] Queued cloud request. 2026-09-12T01:56:54.161 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T01:56:54.161 [Cloud] Dequeued cloud request. 2026-09-12T01:56:54.161 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T01:56:54.317 [Cloud] End of cloud request. 2026-09-12T01:56:54.817 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T01:59:07.973 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T02:08:13.441 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T02:08:13.441 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T02:08:13.441 [Cloud] Queued cloud request. 2026-09-12T02:08:13.441 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T02:08:13.441 [Cloud] Dequeued cloud request. 2026-09-12T02:08:13.441 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T02:08:13.597 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4D999CF7-5F03-E393-183A-DD111BDF3098} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 02:08:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T02:08:14.097 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T02:14:12.972 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T02:20:59.347 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T02:20:59.347 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T02:20:59.347 [Cloud] Queued cloud request. 2026-09-12T02:20:59.347 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T02:20:59.347 [Cloud] Dequeued cloud request. 2026-09-12T02:20:59.347 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T02:20:59.534 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0EF71B3D-E27C-0E53-A7F0-08AE7BB1014B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 02:20:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T02:21:00.034 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T02:22:34.143 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T02:22:34.143 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T02:22:34.143 [Cloud] Queued cloud request. 2026-09-12T02:22:34.143 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T02:22:34.143 [Cloud] Dequeued cloud request. 2026-09-12T02:22:34.143 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T02:22:34.284 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06C7AD61-E9E8-34DE-BF89-8C0115303F54} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 02:22:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T02:22:34.784 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T02:24:36.206 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T02:24:36.206 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T02:24:36.206 [Cloud] Queued cloud request. 2026-09-12T02:24:36.206 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T02:24:36.206 [Cloud] Dequeued cloud request. 2026-09-12T02:24:36.206 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T02:24:36.362 [Cloud] End of cloud request. 2026-09-12T02:24:36.878 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T02:29:17.971 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T02:30:35.674 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T02:30:35.674 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T02:30:35.674 [Cloud] Queued cloud request. 2026-09-12T02:30:35.674 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T02:30:35.908 [Cloud] Dequeued cloud request. 2026-09-12T02:30:36.096 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T02:30:36.236 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{03D780FE-32BE-BE20-7784-6A85C3C9184C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 02:30:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T02:30:36.736 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T02:44:22.970 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T02:59:27.969 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T03:07:04.718 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-12T03:07:04.734 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-12T03:07:04.734 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-12T03:07:04.734 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-12T03:07:04.734 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-12T03:07:04.734 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-12T03:07:04.781 [AutoPurge] Cleanup Routine tasks have started. 2026-09-12T03:07:04.828 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-12T03:07:04.828 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-12T03:07:04.828 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-12-2026 03:07:04 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-12-2026 03:07:04 2026-09-12T03:07:04.828 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-12T03:07:04.828 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-12T03:07:04.828 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-12T03:07:04.828 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-12T03:07:04.828 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-12T03:07:04.875 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-12T03:07:04.906 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-12T03:07:04.906 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-12T03:07:04.937 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-12T03:07:04.937 [AutoPurge] Removing expired default signature package ... 2026-09-12T03:07:05.281 Job Notification: New process added to job (7936) 2026-09-12T03:07:05.343 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-12T03:07:05.515 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-12T03:07:06.062 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:07:06.546 Job Notification: Process exited from job (7936) 2026-09-12T03:07:06.609 [AutoPurge] Verification Routine tasks have ended. 2026-09-12T03:07:06.906 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-12T03:07:07.031 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-12T03:07:07.562 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-12T03:07:07.687 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-12T03:07:07.890 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-12T03:07:09.687 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_mi.dll", hr=0x0 2026-09-12T03:07:09.781 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-12T03:07:10.187 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-12T03:07:10.484 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-12T03:07:10.500 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:10.765 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-12T03:07:11.625 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-12T03:07:12.406 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-12T03:07:12.546 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-12T03:07:12.718 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-12T03:07:13.000 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:07:13.062 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psuser_arm64.dll", hr=0x0 2026-09-12T03:07:13.343 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-12T03:07:13.781 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-12T03:07:13.843 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ko.dll", hr=0x0 2026-09-12T03:07:13.937 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-12T03:07:14.171 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:14.312 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:14.375 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-12T03:07:14.406 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-12T03:07:14.671 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:07:14.750 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-12T03:07:14.828 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-12T03:07:14.828 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.695_none_7572f17cd4648630\penimc.dll", hr=0x0 2026-09-12T03:07:14.859 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ro.dll", hr=0x0 2026-09-12T03:07:14.906 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-12T03:07:15.078 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-12T03:07:15.625 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:15.671 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-12T03:07:16.015 Engine:Setting original file name "libVoiceFabric.dll" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\voicefabric.dll", hr=0x0 2026-09-12T03:07:16.187 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ga.dll", hr=0x0 2026-09-12T03:07:16.265 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:07:16.421 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-12T03:07:17.140 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-12T03:07:17.687 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:17.875 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:07:18.015 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fil.dll", hr=0x0 2026-09-12T03:07:18.250 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-12T03:07:18.562 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fr.dll", hr=0x0 2026-09-12T03:07:18.781 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-12T03:07:18.921 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-12T03:07:19.484 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-12T03:07:19.625 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:20.187 Engine:Setting original file name "BmModels.dll" for "c:\programdata\microsoft\windows defender\models\model_5e2a8ecd-08ac-4a01-a24d-fe70f03b147c.dll", hr=0x0 2026-09-12T03:07:20.203 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:07:20.374 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-12T03:07:20.374 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-12T03:07:20.437 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psmachine.dll", hr=0x0 2026-09-12T03:07:20.468 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-12T03:07:20.703 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-12T03:07:20.796 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-12T03:07:20.843 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-12T03:07:20.921 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-12T03:07:20.999 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.695_none_daf240e70cab3235\penimc_v0400.dll", hr=0x0 2026-09-12T03:07:21.156 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-12T03:07:21.671 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-12T03:07:21.968 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-12T03:07:22.593 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-12T03:07:22.968 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_zh-tw.dll", hr=0x0 2026-09-12T03:07:24.203 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-12T03:07:24.421 Engine:Setting original file name "BmModels.dll" for "c:\programdata\microsoft\windows defender\models\model_d736908c-85f9-4e40-8415-5cdb6c7a8981.dll", hr=0x0 2026-09-12T03:07:24.796 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-12T03:07:24.828 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-12T03:07:24.874 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-12T03:07:24.874 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-12T03:07:24.906 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-12T03:07:25.062 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-12T03:07:25.343 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-12T03:07:25.374 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:25.453 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-12T03:07:25.984 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-12T03:07:26.031 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-12T03:07:26.046 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-12T03:07:26.109 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-12T03:07:26.265 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_hr.dll", hr=0x0 2026-09-12T03:07:26.718 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-12T03:07:26.937 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:26.984 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-12T03:07:27.031 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-12T03:07:27.046 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-12T03:07:27.531 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-12T03:07:27.921 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-12T03:07:27.937 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:28.468 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_th.dll", hr=0x0 2026-09-12T03:07:28.796 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-12T03:07:28.827 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-12T03:07:29.546 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:07:29.952 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-12T03:07:30.437 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-12T03:07:30.640 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-12T03:07:30.843 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:31.031 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-12T03:07:31.124 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ca-es-valencia.dll", hr=0x0 2026-09-12T03:07:31.296 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-12T03:07:31.671 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-12T03:07:31.734 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-12T03:07:32.202 Engine:Setting original file name "Microsoft Cognitive Services Speech SDK" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\microsoft.cognitiveservices.speech.extension.lu.dll", hr=0x0 2026-09-12T03:07:32.312 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-12T03:07:32.640 Engine:Setting original file name "CoreMessaging.dll" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\coremessagingxp.dll", hr=0x0 2026-09-12T03:07:32.687 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-12T03:07:32.734 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-12T03:07:32.796 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:07:33.156 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:07:33.421 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-12T03:07:33.437 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_gd.dll", hr=0x0 2026-09-12T03:07:33.562 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-12T03:07:33.702 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-12T03:07:33.734 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-12T03:07:34.124 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-12T03:07:34.859 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-12T03:07:35.437 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-12T03:07:35.577 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-12T03:07:35.890 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-12T03:07:36.062 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\microsoftedgeupdatebroker.exe", hr=0x0 2026-09-12T03:07:36.546 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\x86_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.695_none_229f77be21275b3b\penimc_v0400.dll", hr=0x0 2026-09-12T03:07:36.593 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-12T03:07:36.640 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:37.030 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-12T03:07:37.155 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-12T03:07:37.155 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-12T03:07:37.202 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-12T03:07:37.281 Engine:Setting original file name "MSHTML.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-i..tmlrendering-legacy_31bf3856ad364e35_11.0.20348.5386_none_fe665d760dfcbf57\mshtml.dll.mun", hr=0x0 2026-09-12T03:07:37.343 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-12T03:07:37.374 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-12T03:07:37.437 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-12T03:07:37.859 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-12T03:07:37.859 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-12T03:07:38.249 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-12T03:07:38.437 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-12T03:07:38.562 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-12T03:07:38.577 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-12T03:07:38.859 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:07:39.155 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-12T03:07:39.515 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.20348.3451_none_87d480d8b356cff3\apphelp.dll", hr=0x0 2026-09-12T03:07:39.640 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:07:40.077 Engine:Setting original file name "propsys.dll" for "c:\windows\winsxs\amd64_microsoft-windows-propsys_31bf3856ad364e35_7.0.20348.5386_none_cc9e52b39cfe064e\propsys.dll.mun", hr=0x0 2026-09-12T03:07:40.124 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-12T03:07:40.265 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-12T03:07:40.655 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-12T03:07:40.671 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-12T03:07:40.874 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-12T03:07:41.030 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-12T03:07:41.640 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-12T03:07:41.702 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-12T03:07:41.937 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-12T03:07:41.952 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-12T03:07:42.202 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-12T03:07:42.265 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-12T03:07:42.624 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:07:42.702 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.20348.5386_none_ff775c057dcff4c1\edgehtml.dll.mun", hr=0x0 2026-09-12T03:07:43.077 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:07:43.218 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-12T03:07:43.281 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-12T03:07:44.093 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-12T03:07:44.109 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-12T03:07:44.374 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-12T03:07:44.562 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-12T03:07:45.171 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-12T03:07:46.030 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fa.dll", hr=0x0 2026-09-12T03:07:46.046 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:07:46.249 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_de.dll", hr=0x0 2026-09-12T03:07:46.265 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-12T03:07:46.734 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-12T03:07:47.046 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-12T03:07:47.234 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-12T03:07:47.265 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:47.280 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-12T03:07:47.296 Engine:Setting original file name "chakra.dll" for "c:\windows\winsxs\amd64_microsoft-windows-scripting-chakra_31bf3856ad364e35_11.0.20348.5386_none_af92b8d8361dbd13\chakra.dll.mun", hr=0x0 2026-09-12T03:07:47.359 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ca.dll", hr=0x0 2026-09-12T03:07:47.437 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-12T03:07:47.702 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-12T03:07:48.124 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-12T03:07:48.218 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-12T03:07:48.484 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-12T03:07:48.515 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sl.dll", hr=0x0 2026-09-12T03:07:48.874 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-12T03:07:48.921 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-12T03:07:49.265 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:07:49.546 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-12T03:07:49.765 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-12T03:07:50.187 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_da.dll", hr=0x0 2026-09-12T03:07:50.702 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:07:50.796 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-12T03:07:50.890 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-12T03:07:50.937 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-12T03:07:52.140 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-12T03:07:52.234 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-12T03:07:52.343 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-12T03:07:52.624 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-12T03:07:52.874 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-12T03:07:53.062 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-12T03:07:53.952 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-12T03:07:53.999 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-12T03:07:54.030 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-12T03:07:54.124 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-12T03:07:54.249 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-12T03:07:54.624 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-12T03:07:54.796 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-12T03:07:54.827 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-12T03:07:54.859 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-12T03:07:54.952 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:55.077 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-12T03:07:55.124 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-12T03:07:55.530 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-12T03:07:55.577 Engine:Setting original file name "MicrosoftEdgeUpdate.exe" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\microsoftedgeupdatecore.exe", hr=0x0 2026-09-12T03:07:55.702 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-12T03:07:56.280 Engine:Setting original file name "copilotapphost.dll" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\copilotapphost.exe", hr=0x0 2026-09-12T03:07:56.296 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-12T03:07:56.468 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-12T03:07:56.780 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-12T03:07:57.234 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-12T03:07:57.296 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-12T03:07:57.577 Engine:Setting original file name " " for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\dxcompiler.dll", hr=0x0 2026-09-12T03:07:57.765 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-12T03:07:58.015 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-12T03:07:58.077 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-12T03:07:58.218 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:07:58.374 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:07:58.609 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-12T03:07:58.718 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-12T03:07:58.859 Engine:Setting original file name "mpasdlta.vdm" for "c:\programdata\microsoft\windows defender\definition updates\backup\mpasdlta.lkg", hr=0x0 2026-09-12T03:07:59.030 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:07:59.218 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-12T03:07:59.312 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:07:59.640 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:07:59.687 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-12T03:07:59.734 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-12T03:07:59.952 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-12T03:08:00.030 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-12T03:08:00.046 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-12T03:08:00.577 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-12T03:08:00.655 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-12T03:08:00.687 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_cs.dll", hr=0x0 2026-09-12T03:08:00.702 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-12T03:08:00.796 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:01.062 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:08:01.280 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-12T03:08:01.984 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-12T03:08:02.124 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-12T03:08:02.171 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_bn.dll", hr=0x0 2026-09-12T03:08:02.202 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-12T03:08:02.546 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-12T03:08:02.593 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-12T03:08:02.655 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-12T03:08:03.109 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-12T03:08:03.155 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-12T03:08:03.530 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-12T03:08:03.609 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-12T03:08:03.640 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\microsoftedgeupdateondemand.exe", hr=0x0 2026-09-12T03:08:03.687 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-12T03:08:03.702 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:03.718 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-12T03:08:03.765 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:08:03.765 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-12T03:08:03.780 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:04.109 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ja.dll", hr=0x0 2026-09-12T03:08:04.530 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-12T03:08:04.905 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:05.249 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:05.312 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-12T03:08:05.577 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_lv.dll", hr=0x0 2026-09-12T03:08:05.609 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:05.624 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:08:05.734 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sq.dll", hr=0x0 2026-09-12T03:08:05.796 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-12T03:08:05.812 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_eu.dll", hr=0x0 2026-09-12T03:08:06.202 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:06.218 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-12T03:08:06.468 Engine:Setting original file name "mini_installer.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{56eb18f8-b008-4cbd-b6d2-8c97fe7e9062}\152.0.4191.66\microsoftedge_x64_152.0.4191.66_152.0.4191.62.exe", hr=0x0 2026-09-12T03:08:06.640 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-12T03:08:06.671 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-12T03:08:06.843 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-12T03:08:06.968 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-12T03:08:06.968 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:07.249 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-12T03:08:07.296 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-12T03:08:07.296 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-12T03:08:07.468 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_az.dll", hr=0x0 2026-09-12T03:08:07.499 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-12T03:08:07.671 Engine:Setting original file name "dnsapi" for "c:\windows\winsxs\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.20348.5386_none_485c938889b83d9d\dnsapi.dll", hr=0x0 2026-09-12T03:08:07.734 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:07.999 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-12T03:08:08.421 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\systemapps\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-12T03:08:08.546 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-12T03:08:08.702 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:08.937 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-12T03:08:09.124 Engine:Setting original file name "Vulkan Runtime" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\vulkan-1.dll", hr=0x0 2026-09-12T03:08:09.140 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:09.155 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-12T03:08:09.171 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:08:09.421 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-12T03:08:09.452 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-12T03:08:09.655 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:09.827 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-12T03:08:09.827 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-12T03:08:10.296 Engine:Setting original file name "osloader.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5386_none_03a2efa89ed8c204\winload.exe", hr=0x0 2026-09-12T03:08:10.749 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:08:10.749 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-12T03:08:10.890 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-12T03:08:11.046 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:08:11.062 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:08:11.234 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_hi.dll", hr=0x0 2026-09-12T03:08:12.155 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:12.812 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-12T03:08:13.077 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:13.093 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:13.327 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psuser.dll", hr=0x0 2026-09-12T03:08:13.374 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:13.405 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-12T03:08:13.530 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-12T03:08:13.749 Engine:Setting original file name "libcrypto" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\libcrypto-3-x64.dll", hr=0x0 2026-09-12T03:08:13.765 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-12T03:08:13.780 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_el.dll", hr=0x0 2026-09-12T03:08:13.843 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-12T03:08:14.077 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.265.7\microsoftedgeupdatesetup_x86_1.3.265.7.exe", hr=0x0 2026-09-12T03:08:14.218 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-12T03:08:14.265 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:14.562 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:08:14.577 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:14.624 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-12T03:08:15.280 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-12T03:08:15.952 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-12T03:08:15.999 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:16.062 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-12T03:08:16.202 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:16.484 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:16.562 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-12T03:08:16.734 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sr.dll", hr=0x0 2026-09-12T03:08:16.984 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-12T03:08:17.562 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:17.593 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-12T03:08:17.921 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:08:18.077 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-12T03:08:18.327 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-12T03:08:18.359 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:18.671 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-12T03:08:19.093 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-12T03:08:19.124 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:19.249 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:19.421 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-12T03:08:19.452 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-12T03:08:19.890 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-12T03:08:20.015 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:20.187 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-12T03:08:20.202 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-12T03:08:20.234 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:20.280 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:20.452 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-12T03:08:20.530 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:20.546 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ka.dll", hr=0x0 2026-09-12T03:08:21.015 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-12T03:08:21.077 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_en.dll", hr=0x0 2026-09-12T03:08:21.124 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-12T03:08:21.530 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_pt-pt.dll", hr=0x0 2026-09-12T03:08:21.687 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-12T03:08:21.765 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-12T03:08:21.843 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-12T03:08:21.968 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-12T03:08:22.015 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:22.046 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-12T03:08:22.109 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-12T03:08:22.749 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-12T03:08:22.937 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-12T03:08:23.265 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-12T03:08:23.280 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-12T03:08:23.640 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-12T03:08:23.655 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:24.015 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-12T03:08:24.405 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-12T03:08:24.718 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-12T03:08:24.780 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-12T03:08:24.843 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-12T03:08:24.905 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:25.077 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-12T03:08:25.124 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-12T03:08:25.171 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-12T03:08:25.265 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-12T03:08:25.656 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-12T03:08:25.702 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:08:25.765 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:08:26.421 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-12T03:08:26.530 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:08:26.812 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-12T03:08:27.077 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-12T03:08:27.312 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_mk.dll", hr=0x0 2026-09-12T03:08:27.390 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-12T03:08:27.405 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:27.483 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ml.dll", hr=0x0 2026-09-12T03:08:27.843 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-12T03:08:27.859 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:27.905 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-12T03:08:28.077 Engine:Setting original file name "ScreenMagnifier.exe" for "c:\windows\winsxs\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.20348.5256_none_16b1dbf0cadc5989\magnify.exe.mun", hr=0x0 2026-09-12T03:08:28.187 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-12T03:08:28.468 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-12T03:08:28.483 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-12T03:08:28.843 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-12T03:08:28.952 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-12T03:08:29.077 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-12T03:08:29.171 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:29.202 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-12T03:08:29.390 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-12T03:08:29.609 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-12T03:08:29.796 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-12T03:08:29.905 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-12T03:08:30.124 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-12T03:08:30.374 Engine:Setting original file name "DWriteCore" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\dwritecore.dll", hr=0x0 2026-09-12T03:08:31.937 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-12T03:08:32.437 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-12T03:08:32.624 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-12T03:08:32.890 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:32.921 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_tr.dll", hr=0x0 2026-09-12T03:08:33.171 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-12T03:08:33.390 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-12T03:08:33.749 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-12T03:08:34.124 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-12T03:08:34.233 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-12T03:08:34.280 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-12T03:08:34.296 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-12T03:08:34.452 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-12T03:08:34.983 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-12T03:08:35.015 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:35.030 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-12T03:08:35.124 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-12T03:08:35.155 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-12T03:08:35.249 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-12T03:08:35.593 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sk.dll", hr=0x0 2026-09-12T03:08:35.702 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-12T03:08:35.827 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-12T03:08:36.062 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-12T03:08:36.093 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:36.233 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-12T03:08:36.249 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-12T03:08:36.483 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-12T03:08:36.546 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:08:36.858 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-12T03:08:37.062 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_it.dll", hr=0x0 2026-09-12T03:08:37.249 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-12T03:08:37.343 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ms.dll", hr=0x0 2026-09-12T03:08:37.874 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:38.468 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:38.577 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-12T03:08:39.093 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-12T03:08:39.483 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:08:39.593 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:40.077 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-12T03:08:40.390 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:40.468 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-12T03:08:40.640 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-12T03:08:40.827 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-12T03:08:41.390 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-12T03:08:42.358 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-12T03:08:42.452 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-12T03:08:42.562 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-12T03:08:43.233 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:43.390 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-12T03:08:43.718 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-12T03:08:43.827 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-12T03:08:43.968 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-12T03:08:43.968 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-12T03:08:44.593 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_lb.dll", hr=0x0 2026-09-12T03:08:44.608 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-12T03:08:44.733 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-12T03:08:44.765 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:44.796 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-12T03:08:45.124 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:45.155 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_quz.dll", hr=0x0 2026-09-12T03:08:45.155 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:08:45.452 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-12T03:08:45.593 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-12T03:08:45.827 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psmachine_arm64.dll", hr=0x0 2026-09-12T03:08:45.858 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psmachine_64.dll", hr=0x0 2026-09-12T03:08:45.890 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fi.dll", hr=0x0 2026-09-12T03:08:45.984 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-12T03:08:46.562 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-12T03:08:46.687 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:08:46.921 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:47.171 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-12T03:08:47.624 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:47.718 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-12T03:08:48.030 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-12T03:08:48.124 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_id.dll", hr=0x0 2026-09-12T03:08:48.296 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-12T03:08:48.468 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:48.640 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-12T03:08:48.765 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_tt.dll", hr=0x0 2026-09-12T03:08:48.952 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-12T03:08:49.437 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-12T03:08:49.499 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-12T03:08:49.530 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-12T03:08:49.718 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:49.749 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-12T03:08:50.124 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sr-cyrl-rs.dll", hr=0x0 2026-09-12T03:08:50.140 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-12T03:08:50.343 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-12T03:08:50.468 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:51.624 Engine:Setting original file name "dwmcorei" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\dwmcorei.dll", hr=0x0 2026-09-12T03:08:51.624 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-12T03:08:51.655 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_et.dll", hr=0x0 2026-09-12T03:08:52.390 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-12T03:08:52.452 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-12T03:08:52.499 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:52.546 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-12T03:08:52.921 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:52.983 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-12T03:08:53.233 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-12T03:08:53.327 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-12T03:08:53.421 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-12T03:08:53.452 Engine:Setting original file name "Microsoft Cognitive Services Speech SDK" for "c:\program files (x86)\microsoft\edge\application\152.0.4191.66\undocked_copilot\microsoft.cognitiveservices.speech.extension.codec.dll", hr=0x0 2026-09-12T03:08:53.515 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:53.593 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-12T03:08:53.780 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-12T03:08:53.843 Engine:Setting original file name "mssvp.dll" for "c:\windows\winsxs\amd64_windowssearchengine_31bf3856ad364e35_7.0.20348.5386_none_14595fad9de96e70\mssvp.dll.mun", hr=0x0 2026-09-12T03:08:53.874 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-12T03:08:54.265 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-12T03:08:54.343 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-12T03:08:54.437 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-12T03:08:54.437 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-12T03:08:54.452 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:54.468 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-12T03:08:54.608 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-12T03:08:54.640 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:08:54.655 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-12T03:08:54.733 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-12T03:08:55.187 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-12T03:08:55.218 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-12T03:08:55.624 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:08:55.687 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-12T03:08:55.718 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-12T03:08:55.749 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-12T03:08:56.733 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-12T03:08:56.890 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:08:57.124 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:08:57.124 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-12T03:08:57.343 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-12T03:08:57.577 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-12T03:08:57.733 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-12T03:08:57.812 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_nb.dll", hr=0x0 2026-09-12T03:08:57.827 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-12T03:08:58.577 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-12T03:08:58.608 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-12T03:08:58.749 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-12T03:08:58.780 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-12T03:08:58.780 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:08:59.296 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:08:59.296 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-12T03:08:59.452 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-12T03:08:59.468 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-12T03:08:59.655 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-12T03:09:00.374 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-12T03:09:00.890 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-12T03:09:01.187 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-12T03:09:01.640 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-12T03:09:01.905 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-12T03:09:01.968 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-12T03:09:02.233 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-12T03:09:02.280 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-12T03:09:02.390 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-12T03:09:02.515 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-12T03:09:02.624 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-12T03:09:02.624 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:09:02.905 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-12T03:09:03.015 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-12T03:09:03.358 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-12T03:09:03.499 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-12T03:09:03.687 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-12T03:09:03.718 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-12T03:09:03.718 OriginalFileName Maintenance::28245 files in Moac, 0 skipped (cached), 575 filename set 2026-09-12T03:09:03.718 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-12T03:11:01.249 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T03:11:01.249 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T03:11:01.249 [Cloud] Queued cloud request. 2026-09-12T03:11:01.249 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T03:11:01.249 [Cloud] Dequeued cloud request. 2026-09-12T03:11:01.249 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T03:11:01.421 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7AAFCE52-4E1A-2EAA-7DDC-92848FD320E4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 03:11:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T03:11:01.937 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-12T03:11:01.952 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T03:11:01.952 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-12T03:11:01.952 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-12T03:11:01.952 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-12T03:11:01.952 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-12T03:11:01.952 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-12T03:11:01.952 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-12T03:11:01.952 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-12T03:11:01.952 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-12T03:11:01.952 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-12T03:11:01.952 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-12T03:11:01.952 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-12T03:11:01.952 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T03:11:01.952 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-12T03:11:01.952 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-12T03:11:01.952 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-12T03:11:01.968 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-12T03:11:01.968 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-12T03:11:01.968 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-12T03:11:01.968 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-12T03:11:01.968 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-12T03:11:01.968 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-12T03:11:01.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T03:11:01.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T03:11:01.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T03:11:04.530 [RTP] Duplicating the current plugin configuration object... 2026-09-12T03:11:04.530 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-12T03:11:04.530 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-12T03:11:04.530 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-12T03:11:04.530 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-12T03:11:04.530 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-12T03:11:31.593 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T03:11:31.593 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T03:11:31.593 [Cloud] Queued cloud request. 2026-09-12T03:11:31.593 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T03:11:31.593 [Cloud] Dequeued cloud request. 2026-09-12T03:11:31.593 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T03:11:41.609 [Cloud] End of cloud request. 2026-09-12T03:11:42.140 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T03:14:32.968 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T03:24:36.779 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T03:24:36.779 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T03:24:36.779 [Cloud] Queued cloud request. 2026-09-12T03:24:36.779 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T03:24:36.779 [Cloud] Dequeued cloud request. 2026-09-12T03:24:36.779 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T03:24:36.983 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F2D09EDE-23A0-C747-E38A-E72253D2CDBA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 03:24:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T03:24:37.483 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T03:27:00.076 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T03:27:00.076 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T03:27:00.076 [Cloud] Queued cloud request. 2026-09-12T03:27:00.076 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T03:27:00.076 [Cloud] Dequeued cloud request. 2026-09-12T03:27:00.076 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T03:27:00.279 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2BA51DC0-5ADB-EF13-718A-C155CDF12273} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 03:27:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T03:27:00.779 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T03:28:47.576 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 20644, Count: 1180, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-12T03:28:47.576 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 11346, Count: 537, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-12T03:28:47.576 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 6348, Count: 260, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-12T03:28:47.576 ProcessImageName: powershell.exe, Pid: 8144, TotalTime: 2041, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-12T03:28:47.576 ProcessImageName: AgentShellService.exe, Pid: 6496, TotalTime: 870, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-12T03:28:47.576 ProcessImageName: WmiPrvSE.exe, Pid: 2028, TotalTime: 737, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-12T03:28:47.576 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 563, Count: 31, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-12T03:28:47.576 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 525, Count: 265, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-11f36-0.MAI, EstimatedImpact: 0% 2026-09-12T03:28:47.576 ProcessImageName: WmiPrvSE.exe, Pid: 5828, TotalTime: 325, Count: 5, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-12T03:28:47.576 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 186, Count: 3, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-12T03:28:47.576 ProcessImageName: taskhostw.exe, Pid: 4784, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-12T03:28:47.576 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 91, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-12T03:28:47.576 ProcessImageName: DeviceCensus.exe, Pid: 6304, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-12T03:28:47.576 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-12T03:28:47.576 ProcessImageName: cmd.exe, Pid: 6772, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-12T03:28:47.576 ProcessImageName: makecab.exe, Pid: 7332, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\cab_7332_2, EstimatedImpact: 7% 2026-09-12T03:28:47.576 ProcessImageName: mysqldump.exe, Pid: 6232, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 16% 2026-09-12T03:28:47.576 ProcessImageName: ngentask.exe, Pid: 4880, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19% 2026-09-12T03:28:47.576 ProcessImageName: taskhostw.exe, Pid: 6328, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-12T03:28:47.576 ProcessImageName: powershell.exe, Pid: 5548, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-12T03:29:37.967 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T03:33:02.232 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T03:33:02.232 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T03:33:02.232 [Cloud] Queued cloud request. 2026-09-12T03:33:02.232 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T03:33:02.232 [Cloud] Dequeued cloud request. 2026-09-12T03:33:02.232 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T03:33:02.435 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FA9EAEB0-39DC-D280-DBE1-469B6776E68F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 03:33:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T03:33:02.935 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T03:41:33.950 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T03:41:33.950 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T03:41:33.950 [Cloud] Queued cloud request. 2026-09-12T03:41:33.950 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T03:41:33.950 [Cloud] Dequeued cloud request. 2026-09-12T03:41:33.966 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T03:41:34.153 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FA68A388-796B-A01C-1219-67944B9D4CDF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 03:41:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T03:41:34.653 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T03:44:42.966 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T03:49:41.872 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T03:49:41.872 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T03:49:41.872 [Cloud] Queued cloud request. 2026-09-12T03:49:41.872 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T03:49:41.872 [Cloud] Dequeued cloud request. 2026-09-12T03:49:41.872 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T03:49:42.059 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DC544742-360E-8331-997F-D28A696CC28A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 03:49:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T03:49:42.575 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T03:58:07.308 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T03:58:07.308 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T03:58:07.308 [Cloud] Queued cloud request. 2026-09-12T03:58:07.308 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T03:58:07.308 [Cloud] Dequeued cloud request. 2026-09-12T03:58:07.308 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T03:58:07.465 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{41CB9B81-3DE1-A1DB-449B-A4C4BBBE9D1B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 03:58:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T03:58:07.980 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T03:59:47.964 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T04:05:44.058 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T04:05:44.058 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T04:05:44.058 [Cloud] Queued cloud request. 2026-09-12T04:05:44.058 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T04:05:44.058 [Cloud] Dequeued cloud request. 2026-09-12T04:05:44.058 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T04:05:44.214 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4152AFB8-F97A-2516-DD69-FFFB2625A603} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 04:05:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T04:05:44.714 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T04:10:24.198 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T04:10:24.198 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T04:10:24.198 [Cloud] Queued cloud request. 2026-09-12T04:10:24.198 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T04:10:24.198 [Cloud] Dequeued cloud request. 2026-09-12T04:10:24.198 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T04:10:24.370 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{954B04CC-4DD1-5B3D-31F1-29702078D8DF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 04:10:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T04:10:24.870 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T04:14:52.964 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T04:18:57.307 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T04:18:57.307 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T04:18:57.307 [Cloud] Queued cloud request. 2026-09-12T04:18:57.307 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T04:18:57.307 [Cloud] Dequeued cloud request. 2026-09-12T04:18:57.307 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T04:18:57.463 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DAE0FBFB-C3F2-4F07-7723-647A79EC04F7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 04:18:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T04:18:57.963 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T04:27:51.166 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T04:27:51.166 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T04:27:51.166 [Cloud] Queued cloud request. 2026-09-12T04:27:51.166 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T04:27:51.166 [Cloud] Dequeued cloud request. 2026-09-12T04:27:51.166 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T04:27:51.369 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{967EC0D1-BCA9-FDA8-B9C5-FA9204B77F26} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 04:27:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T04:27:51.884 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T04:28:29.119 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T04:28:29.119 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T04:28:29.119 [Cloud] Queued cloud request. 2026-09-12T04:28:29.119 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T04:28:29.119 [Cloud] Dequeued cloud request. 2026-09-12T04:28:29.119 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T04:28:39.150 [Cloud] End of cloud request. 2026-09-12T04:28:39.650 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T04:29:42.009 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T04:29:42.009 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T04:29:42.009 [Cloud] Queued cloud request. 2026-09-12T04:29:42.009 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T04:29:42.212 [Cloud] Dequeued cloud request. 2026-09-12T04:29:42.400 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T04:29:42.603 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{32A7BFAD-07CC-8A39-782B-2094393157D8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 04:29:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T04:29:43.103 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T04:29:57.962 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T04:35:42.806 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T04:35:42.806 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T04:35:42.806 [Cloud] Queued cloud request. 2026-09-12T04:35:42.806 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T04:35:42.806 [Cloud] Dequeued cloud request. 2026-09-12T04:35:42.806 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T04:35:42.993 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E1E15160-73F3-F38D-B158-F7D97E472714} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 04:35:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T04:35:43.494 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T04:39:07.165 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T04:39:07.165 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T04:39:07.165 [Cloud] Queued cloud request. 2026-09-12T04:39:07.165 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T04:39:07.165 [Cloud] Dequeued cloud request. 2026-09-12T04:39:07.165 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T04:39:07.321 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EB5FB510-9183-BAE4-EABC-5EB943B69315} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 04:39:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T04:39:07.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T04:45:02.962 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T04:49:47.945 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T04:49:47.945 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T04:49:47.945 [Cloud] Queued cloud request. 2026-09-12T04:49:47.945 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T04:49:47.945 [Cloud] Dequeued cloud request. 2026-09-12T04:49:47.945 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T04:49:48.102 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5A9CC3C7-89D9-0686-14E6-857A13CFE4BC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 04:49:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T04:49:48.617 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T05:00:07.960 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T05:10:40.866 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T05:10:40.866 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T05:10:40.866 [Cloud] Queued cloud request. 2026-09-12T05:10:40.866 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T05:10:40.866 [Cloud] Dequeued cloud request. 2026-09-12T05:10:40.866 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T05:10:41.054 [Cloud] End of cloud request. 2026-09-12T05:10:41.569 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T05:15:12.959 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T05:23:25.772 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T05:23:25.772 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T05:23:25.772 [Cloud] Queued cloud request. 2026-09-12T05:23:25.772 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T05:23:25.772 [Cloud] Dequeued cloud request. 2026-09-12T05:23:25.772 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T05:23:25.912 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{74C04152-4822-8CFE-841B-97194868EE07} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 05:23:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T05:23:26.428 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T05:27:00.147 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T05:27:00.147 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T05:27:00.147 [Cloud] Queued cloud request. 2026-09-12T05:27:00.147 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T05:27:00.147 [Cloud] Dequeued cloud request. 2026-09-12T05:27:00.147 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{1E131646-D7D9-CA4A-8813-EB0708909C02} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 05:27:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T05:27:00.303 [Cloud] End of cloud request. 2026-09-12T05:27:00.818 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T05:28:37.584 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T05:28:37.584 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T05:28:37.584 [Cloud] Queued cloud request. 2026-09-12T05:28:37.584 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T05:28:37.584 [Cloud] Dequeued cloud request. 2026-09-12T05:28:37.584 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T05:28:47.584 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 23815, Count: 1422, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-12T05:28:47.584 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 15601, Count: 735, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-12T05:28:47.584 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 6348, Count: 260, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-12T05:28:47.584 ProcessImageName: powershell.exe, Pid: 8144, TotalTime: 2041, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-12T05:28:47.584 ProcessImageName: AgentShellService.exe, Pid: 6496, TotalTime: 870, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-12T05:28:47.584 ProcessImageName: WmiPrvSE.exe, Pid: 2028, TotalTime: 737, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-12T05:28:47.584 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 655, Count: 35, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-12T05:28:47.584 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 540, Count: 267, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-11f36-0.MAI, EstimatedImpact: 0% 2026-09-12T05:28:47.584 ProcessImageName: WmiPrvSE.exe, Pid: 4664, TotalTime: 470, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 34% 2026-09-12T05:28:47.584 ProcessImageName: powershell.exe, Pid: 5708, TotalTime: 403, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-12T05:28:47.584 ProcessImageName: WmiPrvSE.exe, Pid: 5828, TotalTime: 325, Count: 5, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-12T05:28:47.584 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 217, Count: 4, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-12T05:28:47.584 ProcessImageName: python.exe, Pid: 6548, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-12T05:28:47.584 ProcessImageName: taskhostw.exe, Pid: 4784, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-12T05:28:47.584 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 91, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-12T05:28:47.584 ProcessImageName: DeviceCensus.exe, Pid: 6304, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-12T05:28:47.584 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-12T05:28:47.584 ProcessImageName: cmd.exe, Pid: 6772, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-12T05:28:47.584 ProcessImageName: makecab.exe, Pid: 7332, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\cab_7332_2, EstimatedImpact: 7% 2026-09-12T05:28:47.584 ProcessImageName: mysqldump.exe, Pid: 6232, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 16% 2026-09-12T05:28:47.584 ProcessImageName: ngentask.exe, Pid: 4880, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19% 2026-09-12T05:28:47.584 ProcessImageName: taskhostw.exe, Pid: 6328, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-12T05:28:47.584 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-12T05:28:47.584 ProcessImageName: powershell.exe, Pid: 5548, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-12T05:28:47.677 [Cloud] End of cloud request. 2026-09-12T05:28:48.193 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T05:30:17.959 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T05:30:43.162 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T05:30:43.162 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T05:30:43.162 [Cloud] Queued cloud request. 2026-09-12T05:30:43.162 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T05:30:43.412 [Cloud] Dequeued cloud request. 2026-09-12T05:30:43.568 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T05:30:43.709 [Cloud] End of cloud request. 2026-09-12T05:30:44.209 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T05:37:23.318 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T05:37:23.318 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T05:37:23.318 [Cloud] Queued cloud request. 2026-09-12T05:37:23.318 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T05:37:23.318 [Cloud] Dequeued cloud request. 2026-09-12T05:37:23.318 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T05:37:23.521 [Cloud] End of cloud request. 2026-09-12T05:37:24.021 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T05:45:22.958 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T06:00:27.957 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T06:15:32.956 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T06:30:37.955 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T06:45:42.954 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T07:00:47.953 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T07:07:46.093 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T07:07:46.093 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T07:07:46.093 [Cloud] Queued cloud request. 2026-09-12T07:07:46.093 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T07:07:46.093 [Cloud] Dequeued cloud request. 2026-09-12T07:07:46.093 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T07:07:46.296 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{07C39F9D-F2DE-F34B-F753-FC81371E5542} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 07:07:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T07:07:46.812 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{7709296E-FC40-FF0C-213A-C99DE72A09AA} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-12-2026 07:08:21 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T07:08:23.327 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T07:08:23.327 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T07:08:23.327 [Cloud] Queued cloud request. 2026-09-12T07:08:23.327 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T07:08:23.327 [Cloud] Dequeued cloud request. 2026-09-12T07:08:23.327 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T07:08:23.562 [Cloud] End of cloud request. 2026-09-12T07:08:24.077 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T07:09:10.546 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T07:09:10.546 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T07:09:10.562 [Cloud] Queued cloud request. 2026-09-12T07:09:10.562 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T07:09:10.562 [Cloud] Dequeued cloud request. 2026-09-12T07:09:10.562 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T07:09:10.640 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CD91604A-8C1E-EB67-6248-D0B36449D65F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 07:09:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T07:09:11.140 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T07:12:26.608 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T07:12:26.608 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T07:12:26.608 [Cloud] Queued cloud request. 2026-09-12T07:12:26.608 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T07:12:26.608 [Cloud] Dequeued cloud request. 2026-09-12T07:12:26.608 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T07:12:26.796 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CE3FB7B3-5542-FBE4-905E-8830C9D84D47} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 07:12:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T07:12:27.296 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T07:14:21.139 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T07:14:21.139 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T07:14:21.139 [Cloud] Queued cloud request. 2026-09-12T07:14:21.139 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T07:14:21.139 [Cloud] Dequeued cloud request. 2026-09-12T07:14:21.139 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T07:14:21.327 [Cloud] End of cloud request. 2026-09-12T07:14:21.827 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T07:15:52.952 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T07:19:30.921 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T07:19:30.921 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T07:19:30.921 [Cloud] Queued cloud request. 2026-09-12T07:19:30.921 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T07:19:30.921 [Cloud] Dequeued cloud request. 2026-09-12T07:19:30.921 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T07:19:31.092 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{887C62EC-6777-A103-D906-712524601761} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 07:19:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T07:19:31.592 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T07:28:47.592 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 25904, Count: 1522, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-12T07:28:47.592 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 19644, Count: 932, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-12T07:28:47.592 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 6348, Count: 260, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-12T07:28:47.592 ProcessImageName: powershell.exe, Pid: 8144, TotalTime: 2041, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-12T07:28:47.592 ProcessImageName: AgentShellService.exe, Pid: 6496, TotalTime: 870, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-12T07:28:47.592 ProcessImageName: WmiPrvSE.exe, Pid: 2028, TotalTime: 737, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-12T07:28:47.592 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 715, Count: 39, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-12T07:28:47.592 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 540, Count: 267, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-11f36-0.MAI, EstimatedImpact: 0% 2026-09-12T07:28:47.592 ProcessImageName: WmiPrvSE.exe, Pid: 4664, TotalTime: 470, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 34% 2026-09-12T07:28:47.592 ProcessImageName: powershell.exe, Pid: 5708, TotalTime: 403, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-12T07:28:47.592 ProcessImageName: WmiPrvSE.exe, Pid: 5828, TotalTime: 325, Count: 5, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-12T07:28:47.592 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 217, Count: 4, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-12T07:28:47.592 ProcessImageName: python.exe, Pid: 6548, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-12T07:28:47.592 ProcessImageName: taskhostw.exe, Pid: 4784, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-12T07:28:47.592 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 91, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-12T07:28:47.592 ProcessImageName: DeviceCensus.exe, Pid: 6304, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-12T07:28:47.592 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-12T07:28:47.592 ProcessImageName: cmd.exe, Pid: 6772, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-12T07:28:47.592 ProcessImageName: makecab.exe, Pid: 7332, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\cab_7332_2, EstimatedImpact: 7% 2026-09-12T07:28:47.592 ProcessImageName: mysqldump.exe, Pid: 6232, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 16% 2026-09-12T07:28:47.592 ProcessImageName: ngentask.exe, Pid: 4880, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19% 2026-09-12T07:28:47.592 ProcessImageName: taskhostw.exe, Pid: 6328, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-12T07:28:47.592 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-12T07:28:47.592 ProcessImageName: powershell.exe, Pid: 5548, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-12T07:30:57.951 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T07:43:02.685 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T07:43:02.685 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T07:43:02.685 [Cloud] Queued cloud request. 2026-09-12T07:43:02.685 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T07:43:02.685 [Cloud] Dequeued cloud request. 2026-09-12T07:43:02.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T07:43:02.888 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{43A61FCA-2778-EC7B-D11E-D54415583B4A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 07:43:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T07:43:03.403 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T07:43:06.232 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T07:43:06.232 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T07:43:06.232 [Cloud] Queued cloud request. 2026-09-12T07:43:06.232 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T07:43:06.232 [Cloud] Dequeued cloud request. 2026-09-12T07:43:06.232 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T07:43:06.310 [Cloud] End of cloud request. 2026-09-12T07:43:06.810 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T07:44:13.325 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T07:44:13.325 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T07:44:13.325 [Cloud] Queued cloud request. 2026-09-12T07:44:13.325 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T07:44:13.325 [Cloud] Dequeued cloud request. 2026-09-12T07:44:13.325 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T07:44:13.513 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DED1F6E3-E23D-9658-9793-F35DFD363C2A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 07:44:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T07:44:14.013 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T07:46:02.950 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T07:47:00.638 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T07:47:00.638 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T07:47:00.638 [Cloud] Queued cloud request. 2026-09-12T07:47:00.638 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T07:47:00.638 [Cloud] Dequeued cloud request. 2026-09-12T07:47:00.638 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T07:47:00.825 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F74661AA-2A5C-CCF3-4857-FDFB71668558} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 07:47:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T07:47:01.341 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T07:51:47.246 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T07:51:47.246 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T07:51:47.246 [Cloud] Queued cloud request. 2026-09-12T07:51:47.246 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T07:51:47.246 [Cloud] Dequeued cloud request. 2026-09-12T07:51:47.246 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T07:51:47.528 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2A1827F6-5BAF-B117-9D45-B39C01E28349} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 07:51:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T07:51:48.043 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T07:55:11.809 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T07:55:11.809 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T07:55:11.809 [Cloud] Queued cloud request. 2026-09-12T07:55:11.809 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T07:55:11.809 [Cloud] Dequeued cloud request. 2026-09-12T07:55:11.809 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T07:55:12.012 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{073535ED-B148-C250-5C02-3AE345FF6298} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 07:55:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T07:55:12.512 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T08:01:07.949 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T08:03:22.824 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T08:03:22.824 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T08:03:22.824 [Cloud] Queued cloud request. 2026-09-12T08:03:22.824 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T08:03:22.824 [Cloud] Dequeued cloud request. 2026-09-12T08:03:22.824 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T08:03:32.965 [Cloud] End of cloud request. 2026-09-12T08:03:33.480 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T08:05:07.512 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T08:05:07.512 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T08:05:07.512 [Cloud] Queued cloud request. 2026-09-12T08:05:07.512 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T08:05:07.512 [Cloud] Dequeued cloud request. 2026-09-12T08:05:07.512 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T08:05:07.699 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ADF89AC4-637F-8F5E-222C-22536A61F06B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 08:05:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T08:05:08.199 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T08:16:12.948 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T08:31:17.947 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T08:31:54.776 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T08:31:54.776 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T08:31:54.776 [Cloud] Queued cloud request. 2026-09-12T08:31:54.791 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T08:31:54.791 [Cloud] Dequeued cloud request. 2026-09-12T08:31:54.791 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T08:31:54.994 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{29EEB6E7-A416-7451-C9AA-93240214BE70} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 08:31:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T08:31:55.494 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T08:46:22.947 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T09:01:18.446 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T09:01:18.446 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T09:01:18.446 [Cloud] Queued cloud request. 2026-09-12T09:01:18.446 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T09:01:18.446 [Cloud] Dequeued cloud request. 2026-09-12T09:01:18.446 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T09:01:18.680 [Cloud] End of cloud request. 2026-09-12T09:01:19.180 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T09:01:27.946 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T09:16:32.945 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T09:28:47.585 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27379, Count: 1588, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-12T09:28:47.585 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 23944, Count: 1123, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-12T09:28:47.585 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 6348, Count: 260, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-12T09:28:47.585 ProcessImageName: powershell.exe, Pid: 8144, TotalTime: 2041, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-12T09:28:47.585 ProcessImageName: AgentShellService.exe, Pid: 6496, TotalTime: 870, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-12T09:28:47.585 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 791, Count: 43, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-12T09:28:47.585 ProcessImageName: WmiPrvSE.exe, Pid: 2028, TotalTime: 737, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-12T09:28:47.585 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 540, Count: 267, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-11f36-0.MAI, EstimatedImpact: 0% 2026-09-12T09:28:47.585 ProcessImageName: WmiPrvSE.exe, Pid: 4664, TotalTime: 470, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 34% 2026-09-12T09:28:47.585 ProcessImageName: powershell.exe, Pid: 5708, TotalTime: 403, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-12T09:28:47.585 ProcessImageName: WmiPrvSE.exe, Pid: 5828, TotalTime: 325, Count: 5, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-12T09:28:47.585 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 217, Count: 4, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-12T09:28:47.585 ProcessImageName: python.exe, Pid: 6548, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-12T09:28:47.585 ProcessImageName: taskhostw.exe, Pid: 4784, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-12T09:28:47.585 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 91, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-12T09:28:47.585 ProcessImageName: DeviceCensus.exe, Pid: 6304, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-12T09:28:47.585 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-12T09:28:47.585 ProcessImageName: cmd.exe, Pid: 6772, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-12T09:28:47.585 ProcessImageName: makecab.exe, Pid: 7332, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\cab_7332_2, EstimatedImpact: 7% 2026-09-12T09:28:47.585 ProcessImageName: mysqldump.exe, Pid: 6232, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 16% 2026-09-12T09:28:47.585 ProcessImageName: ngentask.exe, Pid: 4880, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19% 2026-09-12T09:28:47.585 ProcessImageName: taskhostw.exe, Pid: 6328, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-12T09:28:47.585 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-12T09:28:47.585 ProcessImageName: powershell.exe, Pid: 5548, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-12T09:31:37.945 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T09:39:10.726 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T09:39:10.726 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T09:39:10.726 [Cloud] Queued cloud request. 2026-09-12T09:39:10.726 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T09:39:10.726 [Cloud] Dequeued cloud request. 2026-09-12T09:39:10.726 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T09:39:10.929 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{93D09EFC-00A8-53D6-0F62-68D8432B5FF7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 09:39:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T09:39:11.429 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T09:41:09.851 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T09:41:09.851 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T09:41:09.851 [Cloud] Queued cloud request. 2026-09-12T09:41:09.851 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T09:41:09.851 [Cloud] Dequeued cloud request. 2026-09-12T09:41:09.851 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T09:41:10.038 [Cloud] End of cloud request. 2026-09-12T09:41:10.554 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T09:43:06.101 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T09:43:06.101 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T09:43:06.101 [Cloud] Queued cloud request. 2026-09-12T09:43:06.101 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T09:43:06.101 [Cloud] Dequeued cloud request. 2026-09-12T09:43:06.101 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T09:43:06.288 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C4FE0EA-7CE6-2DFC-102E-4D6CB0DE515F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 09:43:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T09:43:06.788 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T09:44:44.975 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T09:44:44.975 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T09:44:44.975 [Cloud] Queued cloud request. 2026-09-12T09:44:44.975 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T09:44:44.975 [Cloud] Dequeued cloud request. 2026-09-12T09:44:44.975 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T09:44:45.163 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F7FB66C-8C58-C12E-CB13-503B5F624E2C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 09:44:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T09:44:45.663 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T09:46:42.944 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T10:01:47.943 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T10:04:22.896 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T10:04:22.896 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T10:04:22.896 [Cloud] Queued cloud request. 2026-09-12T10:04:22.896 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T10:04:22.896 [Cloud] Dequeued cloud request. 2026-09-12T10:04:22.896 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T10:04:27.240 [Cloud] End of cloud request. 2026-09-12T10:04:27.740 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T10:05:56.021 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T10:05:56.021 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T10:05:56.021 [Cloud] Queued cloud request. 2026-09-12T10:05:56.021 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T10:05:56.021 [Cloud] Dequeued cloud request. 2026-09-12T10:05:56.021 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T10:05:56.178 [Cloud] End of cloud request. 2026-09-12T10:05:56.693 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T10:08:55.084 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T10:08:55.084 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T10:08:55.084 [Cloud] Queued cloud request. 2026-09-12T10:08:55.084 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T10:08:55.084 [Cloud] Dequeued cloud request. 2026-09-12T10:08:55.084 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T10:08:55.240 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D20CA317-BAB1-2882-522E-164C5F84649C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 10:08:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T10:08:55.740 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T10:16:52.943 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T10:18:06.271 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T10:18:06.271 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T10:18:06.271 [Cloud] Queued cloud request. 2026-09-12T10:18:06.271 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T10:18:06.271 [Cloud] Dequeued cloud request. 2026-09-12T10:18:06.286 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T10:18:06.458 [Cloud] End of cloud request. 2026-09-12T10:18:06.958 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T10:25:33.645 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T10:25:33.645 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T10:25:33.645 [Cloud] Queued cloud request. 2026-09-12T10:25:33.645 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T10:25:33.645 [Cloud] Dequeued cloud request. 2026-09-12T10:25:33.645 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T10:25:33.817 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9F6CD26D-0844-AA6F-EB7D-3E3EA243FC67} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 10:25:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T10:25:34.317 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T10:31:57.942 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T10:32:18.598 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T10:32:18.598 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T10:32:18.598 [Cloud] Queued cloud request. 2026-09-12T10:32:18.598 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T10:32:18.598 [Cloud] Dequeued cloud request. 2026-09-12T10:32:18.598 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T10:32:18.801 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{00BBCE27-7E9B-F168-4B63-AE9663FE91AE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 10:32:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T10:32:19.301 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T10:36:58.629 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T10:36:58.629 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T10:36:58.629 [Cloud] Queued cloud request. 2026-09-12T10:36:58.629 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T10:36:58.629 [Cloud] Dequeued cloud request. 2026-09-12T10:36:58.629 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T10:36:58.817 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F46C94FF-0A4C-3C03-50E6-20E5A19882E0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 10:36:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T10:36:59.317 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T10:47:02.941 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T10:50:22.269 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T10:50:22.269 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T10:50:22.269 [Cloud] Queued cloud request. 2026-09-12T10:50:22.269 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T10:50:22.269 [Cloud] Dequeued cloud request. 2026-09-12T10:50:22.269 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T10:50:22.472 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{881D02A0-04BE-CF59-B798-2CB8F6300FF7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 10:50:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T10:50:22.988 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T11:02:07.941 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T11:04:36.003 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T11:04:36.003 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T11:04:36.003 [Cloud] Queued cloud request. 2026-09-12T11:04:36.003 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T11:04:36.003 [Cloud] Dequeued cloud request. 2026-09-12T11:04:36.003 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T11:04:36.206 [Cloud] End of cloud request. 2026-09-12T11:04:36.722 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T11:04:55.831 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T11:04:55.831 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T11:04:55.831 [Cloud] Queued cloud request. 2026-09-12T11:04:55.831 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T11:04:55.831 [Cloud] Dequeued cloud request. 2026-09-12T11:04:55.831 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T11:04:55.941 [Cloud] End of cloud request. 2026-09-12T11:04:56.441 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T11:08:58.362 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T11:08:58.362 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T11:08:58.362 [Cloud] Queued cloud request. 2026-09-12T11:08:58.362 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T11:08:58.362 [Cloud] Dequeued cloud request. 2026-09-12T11:08:58.362 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T11:08:58.612 [Cloud] End of cloud request. 2026-09-12T11:08:59.112 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T11:17:05.597 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T11:17:05.597 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T11:17:05.597 [Cloud] Queued cloud request. 2026-09-12T11:17:05.597 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T11:17:05.597 [Cloud] Dequeued cloud request. 2026-09-12T11:17:05.597 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T11:17:05.800 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FD451E75-62D7-CD19-6F5E-0A4149F65BD6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 11:17:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T11:17:06.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T11:17:12.940 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T11:24:24.237 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T11:24:24.237 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T11:24:24.237 [Cloud] Queued cloud request. 2026-09-12T11:24:24.237 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T11:24:24.237 [Cloud] Dequeued cloud request. 2026-09-12T11:24:24.237 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T11:24:24.424 [Cloud] End of cloud request. 2026-09-12T11:24:24.924 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T11:28:39.596 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T11:28:39.596 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T11:28:39.596 [Cloud] Queued cloud request. 2026-09-12T11:28:39.596 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T11:28:39.596 [Cloud] Dequeued cloud request. 2026-09-12T11:28:39.596 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T11:28:39.784 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25B4F6C3-87A6-664A-46C1-E6BE3AA8428F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 11:28:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T11:28:40.284 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T11:28:47.596 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 28802, Count: 1677, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-12T11:28:47.596 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 27771, Count: 1314, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-12T11:28:47.596 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 6348, Count: 260, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-12T11:28:47.596 ProcessImageName: powershell.exe, Pid: 8144, TotalTime: 2041, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-12T11:28:47.596 ProcessImageName: AgentShellService.exe, Pid: 6496, TotalTime: 870, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-12T11:28:47.596 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 867, Count: 47, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-12T11:28:47.596 ProcessImageName: WmiPrvSE.exe, Pid: 2028, TotalTime: 737, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-12T11:28:47.596 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 540, Count: 267, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-11f36-0.MAI, EstimatedImpact: 0% 2026-09-12T11:28:47.596 ProcessImageName: WmiPrvSE.exe, Pid: 4664, TotalTime: 470, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 34% 2026-09-12T11:28:47.596 ProcessImageName: powershell.exe, Pid: 5708, TotalTime: 403, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-12T11:28:47.596 ProcessImageName: WmiPrvSE.exe, Pid: 5828, TotalTime: 325, Count: 5, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-12T11:28:47.596 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 217, Count: 4, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-12T11:28:47.596 ProcessImageName: python.exe, Pid: 6548, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-12T11:28:47.596 ProcessImageName: taskhostw.exe, Pid: 4784, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-12T11:28:47.596 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 91, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-12T11:28:47.596 ProcessImageName: DeviceCensus.exe, Pid: 6304, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-12T11:28:47.596 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-12T11:28:47.596 ProcessImageName: cmd.exe, Pid: 6772, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-12T11:28:47.596 ProcessImageName: makecab.exe, Pid: 7332, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\cab_7332_2, EstimatedImpact: 7% 2026-09-12T11:28:47.596 ProcessImageName: mysqldump.exe, Pid: 6232, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 16% 2026-09-12T11:28:47.596 ProcessImageName: ngentask.exe, Pid: 4880, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19% 2026-09-12T11:28:47.596 ProcessImageName: taskhostw.exe, Pid: 6328, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-12T11:28:47.596 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-12T11:28:47.596 ProcessImageName: powershell.exe, Pid: 5548, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-12T11:32:17.940 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T11:34:12.628 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T11:34:12.628 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T11:34:12.628 [Cloud] Queued cloud request. 2026-09-12T11:34:12.628 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T11:34:12.628 [Cloud] Dequeued cloud request. 2026-09-12T11:34:12.628 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T11:34:12.815 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FC7AFDB1-16E2-BFA2-F279-5F385B02E7E5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 11:34:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T11:34:13.331 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T11:37:16.596 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T11:37:16.596 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T11:37:16.596 [Cloud] Queued cloud request. 2026-09-12T11:37:16.596 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T11:37:16.596 [Cloud] Dequeued cloud request. 2026-09-12T11:37:16.596 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T11:37:16.783 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E4B054D5-3DC5-9169-A625-4B85F4BC2370} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 11:37:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T11:37:17.299 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T11:42:22.237 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T11:42:22.237 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T11:42:22.237 [Cloud] Queued cloud request. 2026-09-12T11:42:22.237 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T11:42:22.237 [Cloud] Dequeued cloud request. 2026-09-12T11:42:22.237 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T11:42:22.409 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2DC01A68-DCA6-E7ED-042C-6AF6E516257B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 11:42:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T11:42:22.909 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T11:47:22.940 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T11:48:29.424 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T11:48:29.424 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T11:48:29.424 [Cloud] Queued cloud request. 2026-09-12T11:48:29.424 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T11:48:29.424 [Cloud] Dequeued cloud request. 2026-09-12T11:48:29.424 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T11:48:29.611 [Cloud] End of cloud request. 2026-09-12T11:48:30.111 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T11:50:01.189 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T11:50:01.189 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T11:50:01.189 [Cloud] Queued cloud request. 2026-09-12T11:50:01.189 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T11:50:01.189 [Cloud] Dequeued cloud request. 2026-09-12T11:50:01.189 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T11:50:01.346 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EC806D74-DD07-BAC7-6C84-C8E4AFAD3497} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 11:50:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T11:50:01.846 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T11:58:20.892 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T11:58:20.892 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T11:58:20.892 [Cloud] Queued cloud request. 2026-09-12T11:58:20.892 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T11:58:20.892 [Cloud] Dequeued cloud request. 2026-09-12T11:58:20.892 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T11:58:30.705 [Cloud] End of cloud request. 2026-09-12T11:58:31.205 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T12:02:03.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T12:02:03.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T12:02:03.064 [Cloud] Queued cloud request. 2026-09-12T12:02:03.064 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T12:02:03.064 [Cloud] Dequeued cloud request. 2026-09-12T12:02:03.064 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T12:02:03.267 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CC0EAD5B-5635-9975-E5F1-391D458A38EE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 12:02:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T12:02:03.767 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T12:02:27.939 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T12:03:55.658 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T12:03:55.658 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T12:03:55.658 [Cloud] Queued cloud request. 2026-09-12T12:03:55.658 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T12:03:55.658 [Cloud] Dequeued cloud request. 2026-09-12T12:03:55.658 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T12:03:55.845 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4AD0B0F5-63C3-48D9-3582-D72C44307DC5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 12:03:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T12:03:56.346 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T12:10:40.095 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T12:10:40.095 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T12:10:40.095 [Cloud] Queued cloud request. 2026-09-12T12:10:40.095 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T12:10:40.095 [Cloud] Dequeued cloud request. 2026-09-12T12:10:40.095 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T12:10:40.298 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C462AF6C-EC40-B02E-D69C-EAAB14716626} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 12:10:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T12:10:40.798 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T12:17:32.939 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T12:20:20.064 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T12:20:20.064 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T12:20:20.064 [Cloud] Queued cloud request. 2026-09-12T12:20:20.064 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T12:20:20.064 [Cloud] Dequeued cloud request. 2026-09-12T12:20:20.064 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T12:20:20.220 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{284EF29B-0871-D0CD-FC11-5320A68C3532} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 12:20:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T12:20:20.736 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T12:20:21.126 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T12:20:21.126 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T12:20:21.126 [Cloud] Queued cloud request. 2026-09-12T12:20:21.126 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T12:20:21.126 [Cloud] Dequeued cloud request. 2026-09-12T12:20:21.126 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T12:20:21.204 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{35808080-C41E-3D5F-EE95-C4C716AE2AB3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 12:20:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T12:20:21.720 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T12:26:26.017 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T12:26:26.017 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T12:26:26.017 [Cloud] Queued cloud request. 2026-09-12T12:26:26.017 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T12:26:26.017 [Cloud] Dequeued cloud request. 2026-09-12T12:26:26.017 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T12:26:26.188 [Cloud] End of cloud request. 2026-09-12T12:26:26.704 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T12:29:21.704 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T12:29:21.704 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T12:29:21.704 [Cloud] Queued cloud request. 2026-09-12T12:29:21.704 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T12:29:21.704 [Cloud] Dequeued cloud request. 2026-09-12T12:29:21.704 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T12:29:31.798 [Cloud] End of cloud request. 2026-09-12T12:29:32.313 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T12:32:37.938 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T12:35:38.235 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T12:35:38.235 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T12:35:38.235 [Cloud] Queued cloud request. 2026-09-12T12:35:38.235 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T12:35:38.235 [Cloud] Dequeued cloud request. 2026-09-12T12:35:38.235 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T12:35:38.391 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F3B37612-9278-5F05-8937-7EE157913671} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 12:35:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T12:35:38.907 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T12:39:56.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T12:39:56.657 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T12:39:56.657 [Cloud] Queued cloud request. 2026-09-12T12:39:56.657 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T12:39:56.657 [Cloud] Dequeued cloud request. 2026-09-12T12:39:56.673 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T12:40:06.766 [Cloud] End of cloud request. 2026-09-12T12:40:07.266 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T12:47:42.938 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T12:50:23.188 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T12:50:23.188 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T12:50:23.188 [Cloud] Queued cloud request. 2026-09-12T12:50:23.188 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T12:50:23.188 [Cloud] Dequeued cloud request. 2026-09-12T12:50:23.188 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T12:50:24.375 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{728CCDFC-EC85-8D61-FC0A-C47DB8B3D1E5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 12:50:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T12:50:24.875 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T12:53:20.157 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T12:53:20.157 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T12:53:20.157 [Cloud] Queued cloud request. 2026-09-12T12:53:20.157 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T12:53:20.157 [Cloud] Dequeued cloud request. 2026-09-12T12:53:20.157 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T12:53:20.391 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0101BB96-6459-8B93-71CA-26CFF3025670} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 12:53:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T12:53:20.907 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T12:53:27.157 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T12:53:27.157 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T12:53:27.157 [Cloud] Queued cloud request. 2026-09-12T12:53:27.157 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T12:53:27.157 [Cloud] Dequeued cloud request. 2026-09-12T12:53:27.157 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T12:53:27.235 [Cloud] End of cloud request. 2026-09-12T12:53:27.735 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T13:02:47.938 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T13:14:50.375 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T13:14:50.375 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T13:14:50.375 [Cloud] Queued cloud request. 2026-09-12T13:14:50.375 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T13:14:50.375 [Cloud] Dequeued cloud request. 2026-09-12T13:14:50.375 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T13:14:50.578 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F89584A1-8928-1B1B-C0FF-B28707D74C1E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 13:14:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T13:14:51.094 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T13:17:52.937 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T13:27:18.344 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T13:27:18.344 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T13:27:18.344 [Cloud] Queued cloud request. 2026-09-12T13:27:18.344 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T13:27:18.344 [Cloud] Dequeued cloud request. 2026-09-12T13:27:18.344 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T13:27:18.515 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9E965DA5-0030-B4B5-0F15-63CBC785C52F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 13:27:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T13:27:19.015 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T13:28:47.609 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 31598, Count: 1503, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-12T13:28:47.609 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 29124, Count: 1691, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-12T13:28:47.609 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 6348, Count: 260, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-12T13:28:47.609 ProcessImageName: powershell.exe, Pid: 8144, TotalTime: 2041, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-12T13:28:47.609 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 897, Count: 49, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-12T13:28:47.609 ProcessImageName: AgentShellService.exe, Pid: 6496, TotalTime: 870, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-12T13:28:47.609 ProcessImageName: WmiPrvSE.exe, Pid: 2028, TotalTime: 737, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-12T13:28:47.609 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 571, Count: 269, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-132b5-0.MAI, EstimatedImpact: 0% 2026-09-12T13:28:47.609 ProcessImageName: WmiPrvSE.exe, Pid: 4664, TotalTime: 470, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 34% 2026-09-12T13:28:47.609 ProcessImageName: powershell.exe, Pid: 5708, TotalTime: 403, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-12T13:28:47.609 ProcessImageName: WmiPrvSE.exe, Pid: 5828, TotalTime: 325, Count: 5, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-12T13:28:47.609 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 217, Count: 4, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-12T13:28:47.609 ProcessImageName: python.exe, Pid: 6548, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-12T13:28:47.609 ProcessImageName: taskhostw.exe, Pid: 4784, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-12T13:28:47.609 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 91, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-12T13:28:47.609 ProcessImageName: DeviceCensus.exe, Pid: 6304, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-12T13:28:47.609 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-12T13:28:47.609 ProcessImageName: cmd.exe, Pid: 6772, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-12T13:28:47.609 ProcessImageName: makecab.exe, Pid: 7332, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\cab_7332_2, EstimatedImpact: 7% 2026-09-12T13:28:47.609 ProcessImageName: mysqldump.exe, Pid: 6232, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 16% 2026-09-12T13:28:47.609 ProcessImageName: ngentask.exe, Pid: 4880, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19% 2026-09-12T13:28:47.609 ProcessImageName: taskhostw.exe, Pid: 6328, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-12T13:28:47.609 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-12T13:28:47.609 ProcessImageName: powershell.exe, Pid: 5548, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-12T13:32:57.937 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T13:36:27.296 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T13:36:27.296 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T13:36:27.296 [Cloud] Queued cloud request. 2026-09-12T13:36:27.296 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T13:36:27.296 [Cloud] Dequeued cloud request. 2026-09-12T13:36:27.296 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T13:36:27.468 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7B6C79A5-7C35-6527-A55C-E320443C573E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 13:36:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T13:36:27.984 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T13:41:32.093 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T13:41:32.093 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T13:41:32.093 [Cloud] Queued cloud request. 2026-09-12T13:41:32.093 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T13:41:32.093 [Cloud] Dequeued cloud request. 2026-09-12T13:41:32.093 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T13:41:32.296 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E67B914-B5B4-096A-FCEC-4C43F54F36F7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 13:41:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T13:41:32.796 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T13:48:02.937 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T13:49:46.734 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T13:49:46.734 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T13:49:46.734 [Cloud] Queued cloud request. 2026-09-12T13:49:46.734 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T13:49:46.734 [Cloud] Dequeued cloud request. 2026-09-12T13:49:46.734 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T13:49:46.921 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8A2130E5-CE38-30FF-7D56-AA6F1CFEDA3C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 13:49:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T13:49:47.421 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T13:52:45.749 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T13:52:45.749 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T13:52:45.749 [Cloud] Queued cloud request. 2026-09-12T13:52:45.749 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T13:52:45.749 [Cloud] Dequeued cloud request. 2026-09-12T13:52:45.765 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T13:52:45.906 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4883E30D-181D-A5FE-DEED-AAEBC98FBC52} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 13:52:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T13:52:46.421 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T13:57:19.312 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T13:57:19.312 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T13:57:19.312 [Cloud] Queued cloud request. 2026-09-12T13:57:19.312 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T13:57:19.312 [Cloud] Dequeued cloud request. 2026-09-12T13:57:19.312 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T13:57:19.718 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4DEB0506-D6E7-FADF-FF0A-A1F627F70A2F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 13:57:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T13:57:20.218 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T14:03:07.936 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T14:03:29.811 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T14:03:29.811 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T14:03:29.811 [Cloud] Queued cloud request. 2026-09-12T14:03:29.811 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T14:03:29.811 [Cloud] Dequeued cloud request. 2026-09-12T14:03:29.811 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T14:03:29.968 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EF9A8443-FFF3-7179-100A-A6798CDEF903} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 14:03:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T14:03:30.483 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T14:10:30.061 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T14:10:30.061 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T14:10:30.061 [Cloud] Queued cloud request. 2026-09-12T14:10:30.061 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T14:10:30.296 [Cloud] Dequeued cloud request. 2026-09-12T14:10:30.296 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T14:10:30.436 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{72F9CE59-A4B4-9E38-FF36-328B1898DB34} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 14:10:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T14:10:30.952 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T14:18:12.936 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T14:25:18.827 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T14:25:18.827 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T14:25:18.827 [Cloud] Queued cloud request. 2026-09-12T14:25:18.827 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T14:25:18.842 [Cloud] Dequeued cloud request. 2026-09-12T14:25:18.842 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T14:25:19.311 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{634D2A92-FB2A-F1D3-3CC9-4DAC8AC83EC1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 14:25:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T14:25:19.811 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T14:28:19.358 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T14:28:19.358 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T14:28:19.358 [Cloud] Queued cloud request. 2026-09-12T14:28:19.358 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T14:28:19.358 [Cloud] Dequeued cloud request. 2026-09-12T14:28:19.358 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T14:28:19.499 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{310D1AAC-7D55-F4EE-663E-3503EA2E4B1F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 14:28:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T14:28:19.999 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T14:33:17.936 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T14:36:07.998 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T14:36:07.998 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T14:36:07.998 [Cloud] Queued cloud request. 2026-09-12T14:36:07.998 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T14:36:07.998 [Cloud] Dequeued cloud request. 2026-09-12T14:36:07.998 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T14:36:08.201 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7A0F9582-995D-0149-8FA2-E4ADE0565BF0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 14:36:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T14:36:08.717 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T14:36:16.248 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T14:36:16.248 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T14:36:16.248 [Cloud] Queued cloud request. 2026-09-12T14:36:16.248 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T14:36:16.248 [Cloud] Dequeued cloud request. 2026-09-12T14:36:16.248 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T14:36:16.358 [Cloud] End of cloud request. 2026-09-12T14:36:16.873 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T14:48:22.935 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T14:49:45.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T14:49:45.904 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T14:49:45.904 [Cloud] Queued cloud request. 2026-09-12T14:49:45.904 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T14:49:45.904 [Cloud] Dequeued cloud request. 2026-09-12T14:49:45.904 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T14:49:46.107 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FDC1C1A6-DB52-48F1-9B01-7BC67395D0E7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 14:49:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T14:49:46.607 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T14:50:44.154 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T14:50:44.154 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T14:50:44.154 [Cloud] Queued cloud request. 2026-09-12T14:50:44.154 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T14:50:44.154 [Cloud] Dequeued cloud request. 2026-09-12T14:50:44.154 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T14:50:44.232 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{536EB396-2492-C8A7-08E0-C06C886E39DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 14:50:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T14:50:44.748 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T14:51:25.310 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T14:51:25.310 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T14:51:25.310 [Cloud] Queued cloud request. 2026-09-12T14:51:25.310 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T14:51:25.310 [Cloud] Dequeued cloud request. 2026-09-12T14:51:25.310 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T14:51:25.389 [Cloud] End of cloud request. 2026-09-12T14:51:25.904 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T14:56:00.107 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T14:56:00.107 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T14:56:00.107 [Cloud] Queued cloud request. 2026-09-12T14:56:00.107 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T14:56:00.107 [Cloud] Dequeued cloud request. 2026-09-12T14:56:00.107 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T14:56:00.295 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F775A347-640A-CB10-31FF-8AE7113351EE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 14:56:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T14:56:00.795 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T14:59:43.092 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T14:59:43.092 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T14:59:43.092 [Cloud] Queued cloud request. 2026-09-12T14:59:43.092 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T14:59:43.092 [Cloud] Dequeued cloud request. 2026-09-12T14:59:43.092 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T14:59:43.279 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A326B655-7F5D-AE40-3F25-FBBDB92D0982} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 14:59:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T14:59:43.779 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T15:03:27.935 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T15:07:41.279 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T15:07:41.279 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T15:07:41.279 [Cloud] Queued cloud request. 2026-09-12T15:07:41.279 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T15:07:41.279 [Cloud] Dequeued cloud request. 2026-09-12T15:07:41.294 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T15:07:41.451 [Cloud] End of cloud request. 2026-09-12T15:07:41.982 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T15:08:04.998 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T15:08:04.998 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T15:08:04.998 [Cloud] Queued cloud request. 2026-09-12T15:08:04.998 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T15:08:04.998 [Cloud] Dequeued cloud request. 2026-09-12T15:08:04.998 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T15:08:05.091 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A97996AF-528D-BD05-7E0A-9A05A696A0AA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 15:08:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T15:08:05.591 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T15:11:24.029 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T15:11:24.029 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T15:11:24.029 [Cloud] Queued cloud request. 2026-09-12T15:11:24.029 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T15:11:24.029 [Cloud] Dequeued cloud request. 2026-09-12T15:11:24.029 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T15:11:24.279 [Cloud] End of cloud request. 2026-09-12T15:11:24.779 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T15:12:01.294 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T15:12:01.294 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T15:12:01.294 [Cloud] Queued cloud request. 2026-09-12T15:12:01.294 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T15:12:01.294 [Cloud] Dequeued cloud request. 2026-09-12T15:12:01.294 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T15:12:01.388 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6448CD59-A985-F2DC-9590-2D6043D23747} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 15:12:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T15:12:01.904 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T15:15:35.263 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T15:15:35.263 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T15:15:35.263 [Cloud] Queued cloud request. 2026-09-12T15:15:35.263 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T15:15:35.263 [Cloud] Dequeued cloud request. 2026-09-12T15:15:35.279 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T15:15:35.419 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1D17846D-5203-5DF2-64BA-701F80EB8BBA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 15:15:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T15:15:35.919 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T15:18:32.935 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T15:24:36.388 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T15:24:36.388 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T15:24:36.388 [Cloud] Queued cloud request. 2026-09-12T15:24:36.388 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T15:24:36.388 [Cloud] Dequeued cloud request. 2026-09-12T15:24:36.388 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T15:24:36.544 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{60E4D4C4-2A20-E0EE-CBC8-B515E3AA0887} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 15:24:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T15:24:37.060 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T15:27:11.731 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T15:27:11.731 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T15:27:11.731 [Cloud] Queued cloud request. 2026-09-12T15:27:11.731 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T15:27:11.731 [Cloud] Dequeued cloud request. 2026-09-12T15:27:11.731 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T15:27:11.872 [Cloud] End of cloud request. 2026-09-12T15:27:12.388 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T15:28:47.606 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 35245, Count: 1694, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-12T15:28:47.606 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 31633, Count: 1810, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-12T15:28:47.606 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 6348, Count: 260, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-12T15:28:47.606 ProcessImageName: powershell.exe, Pid: 8144, TotalTime: 2041, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-12T15:28:47.606 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1049, Count: 57, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-12T15:28:47.606 ProcessImageName: AgentShellService.exe, Pid: 6496, TotalTime: 870, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-12T15:28:47.606 ProcessImageName: WmiPrvSE.exe, Pid: 2028, TotalTime: 737, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-12T15:28:47.606 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 602, Count: 271, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-132b5-0.MAI, EstimatedImpact: 0% 2026-09-12T15:28:47.606 ProcessImageName: WmiPrvSE.exe, Pid: 4664, TotalTime: 470, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 34% 2026-09-12T15:28:47.606 ProcessImageName: powershell.exe, Pid: 5708, TotalTime: 403, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-12T15:28:47.606 ProcessImageName: WmiPrvSE.exe, Pid: 5828, TotalTime: 325, Count: 5, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-12T15:28:47.606 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 217, Count: 4, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-12T15:28:47.606 ProcessImageName: python.exe, Pid: 6548, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-12T15:28:47.606 ProcessImageName: taskhostw.exe, Pid: 4784, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-12T15:28:47.606 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 91, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-12T15:28:47.606 ProcessImageName: DeviceCensus.exe, Pid: 6304, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-12T15:28:47.606 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-12T15:28:47.606 ProcessImageName: cmd.exe, Pid: 6772, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-12T15:28:47.606 ProcessImageName: makecab.exe, Pid: 7332, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\cab_7332_2, EstimatedImpact: 7% 2026-09-12T15:28:47.606 ProcessImageName: mysqldump.exe, Pid: 6232, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 16% 2026-09-12T15:28:47.606 ProcessImageName: ngentask.exe, Pid: 4880, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19% 2026-09-12T15:28:47.606 ProcessImageName: taskhostw.exe, Pid: 6328, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-12T15:28:47.606 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-12T15:28:47.606 ProcessImageName: powershell.exe, Pid: 5548, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-12T15:33:37.935 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T15:41:49.950 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T15:41:49.950 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T15:41:49.950 [Cloud] Queued cloud request. 2026-09-12T15:41:49.950 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T15:41:49.950 [Cloud] Dequeued cloud request. 2026-09-12T15:41:49.950 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T15:41:50.153 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D30648D2-7B0B-D060-8408-92DC33E0A4CE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 15:41:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T15:41:50.653 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T15:48:42.934 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T15:56:48.965 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T15:56:48.965 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T15:56:48.965 [Cloud] Queued cloud request. 2026-09-12T15:56:48.965 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T15:56:48.965 [Cloud] Dequeued cloud request. 2026-09-12T15:56:48.981 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T15:56:49.138 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D324E2E9-5B3B-A99C-8D0C-AFC89FF44F78} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 15:56:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T15:56:49.653 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T16:03:10.340 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T16:03:10.340 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T16:03:10.340 [Cloud] Queued cloud request. 2026-09-12T16:03:10.340 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T16:03:10.340 [Cloud] Dequeued cloud request. 2026-09-12T16:03:10.340 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T16:03:10.497 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{51EEBEB5-8A72-9AC7-F531-E2A2C57D0A90} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 16:03:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T16:03:10.997 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T16:03:47.934 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T16:06:51.481 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T16:06:51.481 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T16:06:51.481 [Cloud] Queued cloud request. 2026-09-12T16:06:51.481 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T16:06:51.481 [Cloud] Dequeued cloud request. 2026-09-12T16:06:51.481 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T16:06:51.637 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{796A374C-AE9E-9C34-BB72-9916506D5CFD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 16:06:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T16:06:52.153 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T16:08:52.137 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T16:08:52.137 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T16:08:52.137 [Cloud] Queued cloud request. 2026-09-12T16:08:52.137 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T16:08:52.137 [Cloud] Dequeued cloud request. 2026-09-12T16:08:52.137 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T16:08:52.293 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ED413EB7-14F9-C8C6-4724-882B15A5BAEE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 16:08:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T16:08:52.793 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T16:09:55.246 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T16:09:55.246 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T16:09:55.246 [Cloud] Queued cloud request. 2026-09-12T16:09:55.246 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T16:09:55.246 [Cloud] Dequeued cloud request. 2026-09-12T16:09:55.246 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T16:09:55.418 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3970DDD2-82BE-3868-C7AD-06E6C9517463} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 16:09:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T16:09:55.934 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T16:12:18.496 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T16:12:18.496 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T16:12:18.496 [Cloud] Queued cloud request. 2026-09-12T16:12:18.496 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T16:12:18.496 [Cloud] Dequeued cloud request. 2026-09-12T16:12:18.496 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T16:12:18.652 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{960E02D2-7589-F272-C6BF-4B9A6E19E5AA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 16:12:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T16:12:19.153 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T16:18:52.934 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T16:30:59.886 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T16:30:59.886 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T16:30:59.886 [Cloud] Queued cloud request. 2026-09-12T16:30:59.886 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T16:30:59.886 [Cloud] Dequeued cloud request. 2026-09-12T16:30:59.902 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T16:31:00.121 [Cloud] End of cloud request. 2026-09-12T16:31:00.621 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T16:33:57.933 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T16:35:37.699 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T16:35:37.699 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T16:35:37.699 [Cloud] Queued cloud request. 2026-09-12T16:35:37.699 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T16:35:37.699 [Cloud] Dequeued cloud request. 2026-09-12T16:35:37.699 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T16:35:37.886 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7EE9B626-7CA9-0E1D-DAFB-E88A052EB8E3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 16:35:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T16:35:38.386 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T16:36:47.137 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T16:36:47.137 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T16:36:47.137 [Cloud] Queued cloud request. 2026-09-12T16:36:47.137 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T16:36:47.137 [Cloud] Dequeued cloud request. 2026-09-12T16:36:47.137 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T16:36:47.340 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{587BF2CF-5A19-1C28-2236-71202D8DB0F3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 16:36:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T16:36:47.855 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T16:36:54.590 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T16:36:54.590 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T16:36:54.590 [Cloud] Queued cloud request. 2026-09-12T16:36:54.590 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T16:36:54.590 [Cloud] Dequeued cloud request. 2026-09-12T16:36:54.590 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T16:36:54.668 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{707EAA3B-0D23-2D06-E195-3D277CA2CA65} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 16:36:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T16:36:55.168 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T16:41:09.371 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T16:41:09.371 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T16:41:09.371 [Cloud] Queued cloud request. 2026-09-12T16:41:09.371 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T16:41:09.371 [Cloud] Dequeued cloud request. 2026-09-12T16:41:09.371 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T16:41:09.574 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{39B437AE-E518-E7BA-5459-C7F891E465EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 16:41:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T16:41:10.089 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T16:49:02.933 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T16:50:29.058 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T16:50:29.058 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T16:50:29.058 [Cloud] Queued cloud request. 2026-09-12T16:50:29.058 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T16:50:29.058 [Cloud] Dequeued cloud request. 2026-09-12T16:50:29.058 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T16:50:29.246 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FC41B1D6-889D-FC08-95AE-96BB965B348A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 16:50:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T16:50:29.761 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T16:54:18.871 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T16:54:18.871 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T16:54:18.871 [Cloud] Queued cloud request. 2026-09-12T16:54:18.871 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T16:54:18.871 [Cloud] Dequeued cloud request. 2026-09-12T16:54:18.871 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T16:54:19.011 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A4AFD32C-C595-AB69-4231-789DCA5203A6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 16:54:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T16:54:19.527 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T17:04:07.933 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T17:05:00.089 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T17:05:00.089 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T17:05:00.089 [Cloud] Queued cloud request. 2026-09-12T17:05:00.089 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T17:05:00.292 [Cloud] Dequeued cloud request. 2026-09-12T17:05:00.292 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T17:05:00.464 [Cloud] End of cloud request. 2026-09-12T17:05:00.980 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T17:10:20.370 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T17:10:20.370 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T17:10:20.370 [Cloud] Queued cloud request. 2026-09-12T17:10:20.370 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T17:10:20.370 [Cloud] Dequeued cloud request. 2026-09-12T17:10:20.370 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T17:10:20.542 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{38594063-15BC-89E2-C8EC-A5D60F4B6FD7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 17:10:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T17:10:21.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T17:10:21.667 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T17:10:21.667 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T17:10:21.667 [Cloud] Queued cloud request. 2026-09-12T17:10:21.667 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T17:10:21.870 [Cloud] Dequeued cloud request. 2026-09-12T17:10:21.870 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T17:10:21.933 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4FEE9712-8DC6-860C-FD7D-EAC020494D36} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 17:10:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T17:10:22.448 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T17:12:14.636 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T17:12:14.636 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T17:12:14.636 [Cloud] Queued cloud request. 2026-09-12T17:12:14.636 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T17:12:14.636 [Cloud] Dequeued cloud request. 2026-09-12T17:12:14.636 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T17:12:24.729 [Cloud] End of cloud request. 2026-09-12T17:12:25.245 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T17:19:12.932 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T17:27:42.620 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T17:27:42.620 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T17:27:42.620 [Cloud] Queued cloud request. 2026-09-12T17:27:42.620 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T17:27:42.620 [Cloud] Dequeued cloud request. 2026-09-12T17:27:42.620 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T17:27:42.839 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E3AAAFE-2C32-FE94-970E-467F60A3A1FF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 17:27:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T17:27:43.354 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T17:28:47.620 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 38800, Count: 1885, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-12T17:28:47.620 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 33450, Count: 1920, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-12T17:28:47.620 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 6348, Count: 260, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-12T17:28:47.620 ProcessImageName: powershell.exe, Pid: 8144, TotalTime: 2041, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-12T17:28:47.620 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1079, Count: 59, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-12T17:28:47.620 ProcessImageName: AgentShellService.exe, Pid: 6496, TotalTime: 870, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-12T17:28:47.620 ProcessImageName: WmiPrvSE.exe, Pid: 2028, TotalTime: 737, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-12T17:28:47.620 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 617, Count: 273, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-132b5-0.MAI, EstimatedImpact: 0% 2026-09-12T17:28:47.620 ProcessImageName: WmiPrvSE.exe, Pid: 4664, TotalTime: 470, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 34% 2026-09-12T17:28:47.620 ProcessImageName: powershell.exe, Pid: 5708, TotalTime: 403, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-12T17:28:47.620 ProcessImageName: WmiPrvSE.exe, Pid: 5828, TotalTime: 325, Count: 5, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-12T17:28:47.620 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 217, Count: 4, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-12T17:28:47.620 ProcessImageName: python.exe, Pid: 6548, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-12T17:28:47.620 ProcessImageName: taskhostw.exe, Pid: 4784, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-12T17:28:47.620 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 91, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-12T17:28:47.620 ProcessImageName: DeviceCensus.exe, Pid: 6304, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-12T17:28:47.620 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-12T17:28:47.620 ProcessImageName: cmd.exe, Pid: 6772, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-12T17:28:47.620 ProcessImageName: makecab.exe, Pid: 7332, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Temp\cab_7332_2, EstimatedImpact: 7% 2026-09-12T17:28:47.620 ProcessImageName: mysqldump.exe, Pid: 6232, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 16% 2026-09-12T17:28:47.620 ProcessImageName: ngentask.exe, Pid: 4880, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 19% 2026-09-12T17:28:47.620 ProcessImageName: taskhostw.exe, Pid: 6328, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-12T17:28:47.620 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-12T17:28:47.620 ProcessImageName: powershell.exe, Pid: 5548, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-12T17:34:17.932 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T17:40:41.323 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T17:40:41.323 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T17:40:41.323 [Cloud] Queued cloud request. 2026-09-12T17:40:41.323 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T17:40:41.323 [Cloud] Dequeued cloud request. 2026-09-12T17:40:41.323 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T17:40:41.479 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1D4C328D-8A2E-68C6-B53C-3B15869AFCD5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 17:40:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T17:40:41.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T17:46:27.916 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T17:46:27.916 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T17:46:27.916 [Cloud] Queued cloud request. 2026-09-12T17:46:27.916 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T17:46:28.088 [Cloud] Dequeued cloud request. 2026-09-12T17:46:28.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T17:46:28.229 [Cloud] End of cloud request. 2026-09-12T17:46:28.729 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T17:48:57.182 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T17:48:57.182 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T17:48:57.182 [Cloud] Queued cloud request. 2026-09-12T17:48:57.182 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T17:48:57.182 [Cloud] Dequeued cloud request. 2026-09-12T17:48:57.182 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T17:49:03.338 [Cloud] End of cloud request. 2026-09-12T17:49:03.838 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T17:49:22.932 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T17:52:01.416 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T17:52:01.416 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T17:52:01.416 [Cloud] Queued cloud request. 2026-09-12T17:52:01.416 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T17:52:01.416 [Cloud] Dequeued cloud request. 2026-09-12T17:52:01.416 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T17:52:01.588 [Cloud] End of cloud request. 2026-09-12T17:52:02.088 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T17:56:44.494 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T17:56:44.494 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T17:56:44.494 [Cloud] Queued cloud request. 2026-09-12T17:56:44.494 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T17:56:44.494 [Cloud] Dequeued cloud request. 2026-09-12T17:56:44.494 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T17:56:44.635 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{78F862ED-A234-E2B1-6418-813E19426B32} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 17:56:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T17:56:45.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T17:59:20.791 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T17:59:20.791 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T17:59:20.791 [Cloud] Queued cloud request. 2026-09-12T17:59:20.791 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T17:59:20.791 [Cloud] Dequeued cloud request. 2026-09-12T17:59:20.791 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T17:59:20.932 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CCA2EBA2-CCBD-4525-402C-4447F39EAA1D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 17:59:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T17:59:21.447 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T18:04:27.932 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T18:07:01.728 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T18:07:01.728 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T18:07:01.728 [Cloud] Queued cloud request. 2026-09-12T18:07:01.728 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T18:07:01.728 [Cloud] Dequeued cloud request. 2026-09-12T18:07:01.744 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T18:07:01.931 [Cloud] End of cloud request. 2026-09-12T18:07:02.431 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T18:10:27.712 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T18:10:27.712 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T18:10:27.712 [Cloud] Queued cloud request. 2026-09-12T18:10:27.712 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T18:10:27.712 [Cloud] Dequeued cloud request. 2026-09-12T18:10:27.728 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T18:10:27.900 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{96E918E1-77E0-4529-AA53-5D22DAEDF98A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 18:10:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T18:10:28.400 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T18:13:24.853 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T18:13:24.853 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T18:13:24.853 [Cloud] Queued cloud request. 2026-09-12T18:13:24.853 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T18:13:24.853 [Cloud] Dequeued cloud request. 2026-09-12T18:13:24.853 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T18:13:25.056 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9F8DEDB0-693E-F22B-767B-2AEEE1818CCB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 18:13:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T18:13:25.572 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T18:16:12.790 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T18:16:12.790 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T18:16:12.790 [Cloud] Queued cloud request. 2026-09-12T18:16:12.790 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T18:16:12.790 [Cloud] Dequeued cloud request. 2026-09-12T18:16:12.790 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T18:16:12.978 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8263ACF4-B58D-F448-9F67-901C67989ECC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 18:16:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T18:16:13.494 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T18:17:16.228 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T18:17:16.228 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T18:17:16.228 [Cloud] Queued cloud request. 2026-09-12T18:17:16.228 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T18:17:16.228 [Cloud] Dequeued cloud request. 2026-09-12T18:17:16.228 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T18:17:16.415 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DBF380B8-95BB-D826-2218-B5C96590BB36} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 18:17:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T18:17:16.915 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T18:19:32.931 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T18:20:41.915 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T18:20:41.915 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T18:20:41.915 [Cloud] Queued cloud request. 2026-09-12T18:20:41.915 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T18:20:41.915 [Cloud] Dequeued cloud request. 2026-09-12T18:20:41.915 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T18:20:42.103 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{27D0D4C9-CB89-A894-F538-2D6A32C9261A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 18:20:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T18:20:42.618 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T18:29:16.993 ExpensiveFile:Scan time for `\Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\153.0.4234.32\msedge.dll` is 5203 units 2026-09-12T18:29:49.978 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #4877970, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T18:29:52.009 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #4878052, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T18:29:52.118 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #4878054, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T18:29:53.572 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #4878063, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T18:31:13.759 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T18:31:13.759 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T18:31:13.759 [Cloud] Queued cloud request. 2026-09-12T18:31:13.759 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T18:31:13.759 [Cloud] Dequeued cloud request. 2026-09-12T18:31:13.775 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T18:31:13.915 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0ECBE6E3-21A4-D911-6BA4-620EF6FC3D29} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 18:31:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T18:31:14.431 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T18:34:37.931 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T18:49:42.930 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T18:59:08.571 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T18:59:08.571 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T18:59:08.571 [Cloud] Queued cloud request. 2026-09-12T18:59:08.571 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T18:59:08.571 [Cloud] Dequeued cloud request. 2026-09-12T18:59:08.571 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T18:59:08.774 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3EB51E84-5584-AB2A-0A2F-2B50599476A3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 18:59:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T18:59:09.274 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:02:29.649 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T19:02:29.649 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T19:02:29.649 [Cloud] Queued cloud request. 2026-09-12T19:02:29.649 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T19:02:29.649 [Cloud] Dequeued cloud request. 2026-09-12T19:02:29.649 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T19:02:29.836 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{147C6DC0-4D63-90DB-F94B-9BD6E2C109AA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 19:02:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T19:02:30.336 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:04:47.930 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T19:10:44.399 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T19:10:44.399 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T19:10:44.399 [Cloud] Queued cloud request. 2026-09-12T19:10:44.399 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T19:10:44.399 [Cloud] Dequeued cloud request. 2026-09-12T19:10:44.399 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T19:10:44.602 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0DF38DFA-840B-31FE-C400-1B52E4781BF2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 19:10:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T19:10:45.102 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:19:52.930 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T19:20:40.539 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T19:20:40.539 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T19:20:40.539 [Cloud] Queued cloud request. 2026-09-12T19:20:40.539 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T19:20:40.539 [Cloud] Dequeued cloud request. 2026-09-12T19:20:40.539 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T19:20:40.726 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{01393F43-4DDF-9090-A46D-C72CE84C4766} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 19:20:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T19:20:41.242 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:22:57.101 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T19:22:57.101 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T19:22:57.101 [Cloud] Queued cloud request. 2026-09-12T19:22:57.101 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T19:22:57.101 [Cloud] Dequeued cloud request. 2026-09-12T19:22:57.101 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T19:22:57.304 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{04FF5D15-1D6E-7070-8538-E0D047510CD5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 19:22:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T19:22:57.804 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:23:24.711 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T19:23:24.711 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T19:23:24.711 [Cloud] Queued cloud request. 2026-09-12T19:23:24.711 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T19:23:24.711 [Cloud] Dequeued cloud request. 2026-09-12T19:23:24.711 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T19:23:24.789 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EBFD21CE-6BAF-5FDC-DF47-D0F3C7D0FD92} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 19:23:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T19:23:25.304 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:28:17.929 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-12T19:28:17.961 Job Notification: New process added to job (4104) 2026-09-12T19:28:17.976 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-12T19:28:17.976 Aggressive catchup quick scan threshold: 692444744581 / 25920000000000 2026-09-12T19:28:17.976 Job Notification: New process added to job (3392) 2026-09-12T19:28:18.007 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:4104] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:3392]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-12T19:28:18.226 Job Notification: New process added to job (5476) 2026-09-12T19:28:18.226 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-12T19:28:18.226 Job Notification: New process added to job (6968) 2026-09-12T19:28:18.303 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:5476] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:6968]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-12T19:28:18.336 Job Notification: New process added to job (7224) 2026-09-12T19:28:18.336 Task(GetDeviceTicket -AccessKey AFEFAB81-F171-E580-5776-C93FF4605959 ) launched as network service 2026-09-12T19:28:18.492 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-12T19:28:18.492 [RTP] Duplicating the current plugin configuration object... 2026-09-12T19:28:18.492 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-12T19:28:18.492 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-12T19:28:18.492 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-12T19:28:18.492 [RTP] No config change detected. Not updating plugin configuration. 2026-09-12T19:28:18.492 [RTP] No config changes found. No configuration switch. 2026-09-12T19:28:18.492 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-12T19:28:18.976 Job Notification: Process exited from job (7224) 2026-09-12T19:28:19.117 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-12T19:28:19.117 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T19:28:19.117 [Cloud] Queued cloud request. 2026-09-12T19:28:19.117 [Cloud] Dequeued cloud request. 2026-09-12T19:28:19.117 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T19:28:19.320 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-12T19:28:19.320 [Cloud] End of cloud request. 2026-09-12T19:28:19.617 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:28:31.445 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\931DEB71-36AC-4981-8F47-F0BAACBDC43D1578.1dd42ece3993ab3 2026-09-12T19:28:31.507 Verifying engine and signature files (source: 0) ... 2026-09-12T19:28:31.507 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E}\mpengine.dll] due to PPL. 2026-09-12T19:28:31.507 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E}\mpasbase.vdm]. File not in cache (0x1) 2026-09-12T19:28:32.539 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E}\mpasbase.vdm] 2026-09-12T19:28:32.539 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-12T19:28:32.570 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E}\mpasdlta.vdm] 2026-09-12T19:28:32.570 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E}\mpavbase.vdm]. File not in cache (0x1) 2026-09-12T19:28:32.992 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E}\mpavbase.vdm] 2026-09-12T19:28:32.992 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-12T19:28:33.007 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E}\mpavdlta.vdm] 2026-09-12T19:28:33.195 [Engine] IsHybridMode: 0 2026-09-12T19:28:33.195 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-12T19:28:33.211 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-29AF95B235833D6EBA15FB00078F5505EDACBCCC.bin): 0x00000002 2026-09-12T19:28:33.211 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-29AF95B235833D6EBA15FB00078F5505EDACBCCC.bin) 2026-09-12T19:28:33.211 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-12T19:28:33.211 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-12T19:28:33.211 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-12T19:28:33.211 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-12T19:28:45.554 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-12T19:28:45.554 [AutoExclusion] Applied roles from cache. 2026-09-12T19:28:45.554 [AutoExclusion] Started roles monitoring. 2026-09-12T19:28:45.679 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF68AB020, lRefCount: 6, hr=0 2026-09-12T19:28:45.679 [Engine] New active engine 00007FFCF4ABB020 replacing engine 00007FFCF68AB020. Number of active engines: 2 2026-09-12T19:28:45.711 EngineInit:Global ASOC is enabled 2026-09-12T19:28:45.711 EngineInit:ASOO is enabled for developer volumes 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.820 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-12T19:28:45.851 MpWriteUupSignatureVersion 1.459.178.0, hr = 0 2026-09-12T19:28:45.851 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-12T19:28:45.882 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-12T19:28:45.882 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-12T19:28:45.882 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-12T19:28:45.882 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-12T19:28:45.914 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-12T19:28:45.914 [Plugin] Initializing RTP plugin state... 2026-09-12T19:28:45.914 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-12T19:28:45.914 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎11‎-‎2026 21:28:48 Last Perf:‎09‎-‎11‎-‎2026 21:28:47 First RTP Scan:‎09‎-‎11‎-‎2026 21:28:48 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1918 Misses:8343 BM Queue:0,178,0 Proc:0,33,0 File:0,178,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,0,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:4897676 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:-1468946974 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:16276 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:749066 TotalHits:22220780 InstanceCacheInserts:452821 InstanceCacheUpdates:0 InstanceCacheDeletes:68349 InstanceCacheHits:16663 InstanceCacheMisses:794329 InstanceCacheOverflows:367691 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:6ms (9192/1485) Success: 1485, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-12T19:28:45.914 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E} 2026-09-12T19:28:45.914 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82}\mpasbase.vdm in use, hr=0x80070020 2026-09-12T19:28:45.914 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{65E74D79-50C2-4B63-9A9E-70B484676931} removed 2026-09-12T19:28:45.914 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-12T19:28:45.914 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-12T19:28:45.914 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-12T19:28:45.914 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-12T19:28:45.914 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-12T19:28:45.914 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-12-2026 19:28:45 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-12-2026 19:28:45 2026-09-12T19:28:45.914 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-12T19:28:45.914 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-12T19:28:45.929 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-12T19:28:45.929 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-12T19:28:45.929 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:28:45.929 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-12T19:28:45.929 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-12T19:28:45.929 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-12T19:28:45.929 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-12T19:28:45.929 MdCoreSvc is supported in this platform and OS Signature updated on 09-12-2026 19:28:45 Product Version: 4.18.26080.3 Service Version: 4.18.26080.3 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.178.0 AV Signature Version: 1.459.178.0 ************************************************************ 2026-09-12T19:28:45.945 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-12T19:28:45.945 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\931DEB71-36AC-4981-8F47-F0BAACBDC43D1578.1dd42ece3993ab3 2026-09-12T19:28:45.976 Process scan (postsignatureupdatescan) started. 2026-09-12T19:28:45.992 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-12T19:28:45.992 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-12-2026 19:28:46 ************************************************************ 2026-09-12T19:28:46.117 Job Notification: Process exited from job (5476) 2026-09-12T19:28:46.132 Job Notification: Process exited from job (6968) 2026-09-12T19:28:46.148 Job Notification: Process exited from job (4104) 2026-09-12T19:28:46.148 Job Notification: Process exited from job (3392) 2026-09-12T19:28:46.257 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-12T19:28:46.257 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-12T19:28:46.257 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-12T19:28:46.257 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-12T19:28:46.257 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-12T19:28:46.273 [Engine] Engine 00007FFCF68AB020 no longer in use. Number of active engines: 1 2026-09-12T19:28:46.273 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-12T19:28:46.273 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-12T19:28:46.367 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-12T19:28:46.367 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-12T19:28:46.367 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-12T19:28:46.664 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 42493, Count: 2083, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-12T19:28:46.664 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 35164, Count: 2018, MaxTime: 515, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-12T19:28:46.664 ProcessImageName: setup.exe, Pid: 6936, TotalTime: 12803, Count: 537, MaxTime: 5203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\153.0.4234.32\msedge.dll, EstimatedImpact: 14% 2026-09-12T19:28:46.664 ProcessImageName: AgentShell.exe, Pid: 3548, TotalTime: 6348, Count: 260, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-12T19:28:46.664 ProcessImageName: powershell.exe, Pid: 8144, TotalTime: 2041, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-12T19:28:46.664 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1186, Count: 67, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-12T19:28:46.664 ProcessImageName: AgentShellService.exe, Pid: 6496, TotalTime: 870, Count: 24, MaxTime: 250, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-12T19:28:46.664 ProcessImageName: WmiPrvSE.exe, Pid: 2028, TotalTime: 737, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-12T19:28:46.664 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 647, Count: 277, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-132b5-0.MAI, EstimatedImpact: 0% 2026-09-12T19:28:46.664 ProcessImageName: WmiPrvSE.exe, Pid: 4664, TotalTime: 470, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 34% 2026-09-12T19:28:46.664 ProcessImageName: powershell.exe, Pid: 5708, TotalTime: 403, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-12T19:28:46.664 ProcessImageName: WmiPrvSE.exe, Pid: 5828, TotalTime: 325, Count: 5, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-12T19:28:46.664 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 217, Count: 4, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-12T19:28:46.664 ProcessImageName: MicrosoftEdge_X64_153.0.4234.32_152.0.4191.66.exe, Pid: 2632, TotalTime: 171, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{47BEC9E5-6B37-4465-8DCF-37BC270E072D}\EDGEMITMP_E0D6A.tmp\setup.exe, EstimatedImpact: 64% 2026-09-12T19:28:46.757 [Engine] RSIG_UNLOADENGINE, 00007FFCF68AB020, err=0x0 2026-09-12T19:28:46.773 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{386B1CAB-CC09-4B7A-8ECA-722C58CD1C82} removed 2026-09-12T19:29:00.429 Process scan (postsignatureupdatescan) completed. 2026-09-12T19:33:45.742 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-12T19:34:57.929 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T19:42:24.382 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T19:42:24.382 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T19:42:24.382 [Cloud] Queued cloud request. 2026-09-12T19:42:24.382 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T19:42:24.382 [Cloud] Dequeued cloud request. 2026-09-12T19:42:24.382 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T19:42:24.601 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{778DD480-CC9F-80E5-9109-F1C6CE5168AA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 19:42:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T19:42:25.116 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:44:40.101 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T19:44:40.101 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T19:44:40.101 [Cloud] Queued cloud request. 2026-09-12T19:44:40.101 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T19:44:40.101 [Cloud] Dequeued cloud request. 2026-09-12T19:44:40.101 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T19:44:40.351 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B80BB5FE-4B10-8677-EEB5-9A510B0A30C1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 19:44:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T19:44:40.866 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:46:50.570 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T19:46:50.570 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T19:46:50.570 [Cloud] Queued cloud request. 2026-09-12T19:46:50.570 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T19:46:50.570 [Cloud] Dequeued cloud request. 2026-09-12T19:46:50.570 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T19:46:50.757 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9E48AA16-26A2-E432-53CF-F77B65DBDF8B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 19:46:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T19:46:51.257 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:47:50.944 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T19:47:50.944 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T19:47:50.944 [Cloud] Queued cloud request. 2026-09-12T19:47:50.944 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T19:47:50.944 [Cloud] Dequeued cloud request. 2026-09-12T19:47:50.944 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T19:47:51.148 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{53683608-4580-3A88-144E-4A799BAF585A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 19:47:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T19:47:51.663 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:50:02.929 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T19:54:20.897 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T19:54:20.897 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T19:54:20.897 [Cloud] Queued cloud request. 2026-09-12T19:54:20.897 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T19:54:20.897 [Cloud] Dequeued cloud request. 2026-09-12T19:54:20.913 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T19:54:21.100 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0DF32273-69A0-1824-8319-AB10440C5768} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 19:54:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T19:54:21.616 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T19:56:23.897 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T19:56:23.897 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T19:56:23.897 [Cloud] Queued cloud request. 2026-09-12T19:56:23.897 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T19:56:23.897 [Cloud] Dequeued cloud request. 2026-09-12T19:56:23.897 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T19:56:24.085 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2C09F453-8372-4B59-47CD-493535320CCD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 19:56:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T19:56:24.585 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T20:05:07.928 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T20:09:01.100 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T20:09:01.100 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T20:09:01.100 [Cloud] Queued cloud request. 2026-09-12T20:09:01.100 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T20:09:01.303 [Cloud] Dequeued cloud request. 2026-09-12T20:09:01.303 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T20:09:01.491 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EAE25628-7FD8-0F60-17E3-A8CB2A4ECA9E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 20:09:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T20:09:01.991 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T20:11:24.740 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T20:11:24.740 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T20:11:24.740 [Cloud] Queued cloud request. 2026-09-12T20:11:24.740 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T20:11:24.740 [Cloud] Dequeued cloud request. 2026-09-12T20:11:24.740 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T20:11:24.928 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{26D0B25D-38EE-B256-B241-FC64F8632B32} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 20:11:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T20:11:25.444 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T20:12:30.678 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T20:12:30.678 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T20:12:30.678 [Cloud] Queued cloud request. 2026-09-12T20:12:30.678 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T20:12:30.678 [Cloud] Dequeued cloud request. 2026-09-12T20:12:30.678 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T20:12:30.928 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{83B063ED-DA3B-1C15-7628-AB068FD2BB3D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 20:12:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T20:12:31.444 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T20:14:24.897 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T20:14:24.897 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T20:14:24.897 [Cloud] Queued cloud request. 2026-09-12T20:14:24.897 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T20:14:24.897 [Cloud] Dequeued cloud request. 2026-09-12T20:14:24.897 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T20:14:25.100 [Cloud] End of cloud request. 2026-09-12T20:14:25.600 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T20:16:12.397 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T20:16:12.397 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T20:16:12.397 [Cloud] Queued cloud request. 2026-09-12T20:16:12.397 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T20:16:12.397 [Cloud] Dequeued cloud request. 2026-09-12T20:16:12.397 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T20:16:12.600 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8FF904E8-6E5F-3F2E-CC9C-C50042D03D87} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 20:16:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T20:16:13.100 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T20:16:22.928 Engine:Process 3420 will be fully monitored because of injection from C:\Program Files\Certbot\Python\python.exe 2026-09-12T20:16:22.928 Engine:Process 5648 will be fully monitored because of injection from C:\Program Files\Certbot\Python\python.exe 2026-09-12T20:16:22.928 Engine:Process 5648 will be fully monitored because of injection from C:\Program Files\Certbot\Python\python.exe 2026-09-12T20:16:22.928 Engine:Process 3420 will be fully monitored because of injection from C:\Program Files\Certbot\Python\python.exe 2026-09-12T20:16:22.928 Engine:Process 1496 will be fully monitored because of injection from C:\Program Files\Certbot\Python\python.exe 2026-09-12T20:16:22.928 Engine:Process 1496 will be fully monitored because of injection from C:\Program Files\Certbot\Python\python.exe 2026-09-12T20:16:22.959 Engine:Process 5648 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-12T20:16:22.959 Engine:Process 3420 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-12T20:16:22.959 Engine:Process 1496 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-12T20:16:22.959 Engine:Process 1496 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-12T20:16:22.959 Engine:Process 5648 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-12T20:16:22.959 Engine:Process 3420 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-12T20:16:22.959 Engine:Process 3420 will be fully monitored because of injection from C:\Program Files\Certbot\bin\certbot.exe 2026-09-12T20:16:22.959 Engine:Process 5648 will be fully monitored because of injection from C:\Program Files\Certbot\bin\certbot.exe 2026-09-12T20:16:22.959 Engine:Process 1496 will be fully monitored because of injection from C:\Program Files\Certbot\bin\certbot.exe 2026-09-12T20:16:22.959 Engine:Process 1496 will be fully monitored because of injection from C:\Program Files\Certbot\bin\certbot.exe 2026-09-12T20:16:22.959 Engine:Process 5648 will be fully monitored because of injection from C:\Program Files\Certbot\bin\certbot.exe 2026-09-12T20:16:22.959 Engine:Process 3420 will be fully monitored because of injection from C:\Program Files\Certbot\bin\certbot.exe 2026-09-12T20:16:22.959 Engine:Process 3420 will be fully monitored because of injection from C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2026-09-12T20:16:22.959 Engine:Process 1496 will be fully monitored because of injection from C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2026-09-12T20:16:22.959 Engine:Process 3420 will be fully monitored because of injection from C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2026-09-12T20:16:22.959 Engine:Process 5648 will be fully monitored because of injection from C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2026-09-12T20:16:22.959 Engine:Process 5648 will be fully monitored because of injection from C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2026-09-12T20:16:22.959 Engine:Process 1496 will be fully monitored because of injection from C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2026-09-12T20:16:22.959 Engine:Process 3420 will be fully monitored because of injection from C:\Windows\System32\svchost.exe 2026-09-12T20:16:22.959 Engine:Process 3420 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-12T20:16:22.959 Engine:Process 3420 will be fully monitored because of injection from C:\Windows\System32\svchost.exe 2026-09-12T20:16:22.959 Engine:Process 1496 will be fully monitored because of injection from C:\Windows\System32\svchost.exe 2026-09-12T20:16:22.959 Engine:Process 3420 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-12T20:16:22.959 Engine:Process 1496 will be fully monitored because of injection from C:\Windows\System32\svchost.exe 2026-09-12T20:16:22.959 Engine:Process 1496 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-12T20:16:22.959 Engine:Process 1496 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-12T20:20:12.928 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T20:22:01.521 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T20:22:01.521 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T20:22:01.521 [Cloud] Queued cloud request. 2026-09-12T20:22:01.521 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T20:22:01.521 [Cloud] Dequeued cloud request. 2026-09-12T20:22:01.521 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T20:22:01.709 [Cloud] End of cloud request. 2026-09-12T20:22:02.224 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T20:24:07.802 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T20:24:07.802 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T20:24:07.802 [Cloud] Queued cloud request. 2026-09-12T20:24:07.802 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T20:24:07.802 [Cloud] Dequeued cloud request. 2026-09-12T20:24:07.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T20:24:08.006 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5D29887E-25D5-7ABF-5A11-33DA43001530} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 20:24:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T20:24:08.506 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T20:27:27.490 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T20:27:27.490 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T20:27:27.490 [Cloud] Queued cloud request. 2026-09-12T20:27:27.490 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T20:27:27.490 [Cloud] Dequeued cloud request. 2026-09-12T20:27:27.490 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T20:27:27.677 [Cloud] End of cloud request. 2026-09-12T20:27:28.193 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T20:28:30.349 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T20:28:30.349 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T20:28:30.349 [Cloud] Queued cloud request. 2026-09-12T20:28:30.349 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T20:28:30.349 [Cloud] Dequeued cloud request. 2026-09-12T20:28:30.349 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T20:28:30.552 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E24A13E9-6AB6-EB60-F31A-F4AB576D8314} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 20:28:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T20:28:31.052 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T20:35:17.927 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T20:43:43.911 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T20:43:43.911 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T20:43:43.911 [Cloud] Queued cloud request. 2026-09-12T20:43:43.911 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T20:43:44.068 [Cloud] Dequeued cloud request. 2026-09-12T20:43:44.255 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T20:43:44.443 [Cloud] End of cloud request. 2026-09-12T20:43:44.943 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T20:45:31.161 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\$Extend\$Deleted\0013000000009ECD2023A647. Process: \Device\HarddiskVolume2\Windows\System32\svchost.exe, Status: 0xc0000001, State: 0, ScanRequest #4923820, FileId: 0x13000000009ecd, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x2000, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T20:50:22.927 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T20:51:20.255 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T20:51:20.255 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T20:51:20.255 [Cloud] Queued cloud request. 2026-09-12T20:51:20.255 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T20:51:20.255 [Cloud] Dequeued cloud request. 2026-09-12T20:51:20.255 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T20:51:20.442 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{90C7BDD3-9194-134A-3C12-DC1140F877C9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 20:51:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T20:51:20.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T21:00:41.958 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T21:00:41.958 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T21:00:41.958 [Cloud] Queued cloud request. 2026-09-12T21:00:41.958 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T21:00:41.958 [Cloud] Dequeued cloud request. 2026-09-12T21:00:41.958 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T21:00:42.177 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DED057CD-49B3-1CFB-8D2A-FDEB12D5A246} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 21:00:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T21:00:42.677 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T21:05:27.926 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T21:10:46.911 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T21:10:46.911 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T21:10:46.911 [Cloud] Queued cloud request. 2026-09-12T21:10:46.911 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T21:10:46.911 [Cloud] Dequeued cloud request. 2026-09-12T21:10:46.911 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T21:10:47.114 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{98C279F0-2903-33C3-B919-FF4A39D2B237} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 21:10:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T21:10:47.614 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T21:19:40.176 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T21:19:40.176 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T21:19:40.176 [Cloud] Queued cloud request. 2026-09-12T21:19:40.176 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T21:19:40.176 [Cloud] Dequeued cloud request. 2026-09-12T21:19:40.176 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T21:19:40.332 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E7DE5212-3CD0-7B8B-E9ED-F8AA10D047C5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 21:19:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T21:19:40.832 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T21:19:59.614 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T21:19:59.614 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T21:19:59.614 [Cloud] Queued cloud request. 2026-09-12T21:19:59.614 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T21:19:59.614 [Cloud] Dequeued cloud request. 2026-09-12T21:19:59.614 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T21:19:59.692 [Cloud] End of cloud request. 2026-09-12T21:20:00.192 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T21:20:32.926 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T21:20:36.067 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-133bc-7c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4935827, FileId: 0x1800000001618b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T21:20:36.067 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-133bc-7c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4935828, FileId: 0x14000000015848, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T21:20:36.754 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-133bc-7d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4935843, FileId: 0x1900000001618b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T21:20:36.754 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-133bc-7d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4935844, FileId: 0x15000000015848, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-12T21:23:28.082 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T21:23:28.082 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T21:23:28.082 [Cloud] Queued cloud request. 2026-09-12T21:23:28.082 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T21:23:28.348 [Cloud] Dequeued cloud request. 2026-09-12T21:23:28.348 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T21:23:28.504 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8953EA05-D824-29D7-AE68-128BCB3D5E91} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 21:23:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T21:23:29.004 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T21:25:43.879 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T21:25:43.879 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T21:25:43.879 [Cloud] Queued cloud request. 2026-09-12T21:25:43.879 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T21:25:43.879 [Cloud] Dequeued cloud request. 2026-09-12T21:25:44.129 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T21:25:44.301 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B6345E0D-ECD0-576A-1209-730C083A6B97} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 21:25:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T21:25:44.816 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T21:28:45.676 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 13393, Count: 1054, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\running\index.html, EstimatedImpact: 0% 2026-09-12T21:28:45.676 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 3789, Count: 200, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-12T21:28:45.676 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-12T21:28:45.676 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-12T21:28:45.676 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-12T21:28:45.676 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 213, Count: 12, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-12T21:28:45.676 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-12T21:28:45.676 ProcessImageName: taskhostw.exe, Pid: 5764, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-12T21:28:45.676 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-12T21:28:45.676 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-133bc-7c.MAI, EstimatedImpact: 0% 2026-09-12T21:28:45.676 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-12T21:28:45.676 ProcessImageName: ngentask.exe, Pid: 1468, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-12T21:35:37.926 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T21:47:36.034 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T21:47:36.034 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T21:47:36.034 [Cloud] Queued cloud request. 2026-09-12T21:47:36.034 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T21:47:36.034 [Cloud] Dequeued cloud request. 2026-09-12T21:47:36.034 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T21:47:36.206 [Cloud] End of cloud request. 2026-09-12T21:47:36.706 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T21:50:42.925 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T21:52:02.847 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T21:52:02.847 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T21:52:02.847 [Cloud] Queued cloud request. 2026-09-12T21:52:02.847 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T21:52:02.847 [Cloud] Dequeued cloud request. 2026-09-12T21:52:02.847 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T21:52:03.003 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0DA22C77-7C19-EC91-27AE-DBDB090C3B48} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 21:52:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T21:52:03.503 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T21:59:04.300 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T21:59:04.300 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T21:59:04.300 [Cloud] Queued cloud request. 2026-09-12T21:59:04.300 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T21:59:04.300 [Cloud] Dequeued cloud request. 2026-09-12T21:59:04.315 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T21:59:04.456 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9D70A19E-8CDC-8276-1D17-6CB26DFE760E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 21:59:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T21:59:04.956 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T22:05:47.925 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T22:05:56.159 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T22:05:56.159 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T22:05:56.159 [Cloud] Queued cloud request. 2026-09-12T22:05:56.159 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T22:05:56.362 [Cloud] Dequeued cloud request. 2026-09-12T22:05:56.362 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T22:05:56.518 [Cloud] End of cloud request. 2026-09-12T22:05:57.034 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T22:11:49.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T22:11:49.643 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T22:11:49.643 [Cloud] Queued cloud request. 2026-09-12T22:11:49.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T22:11:49.643 [Cloud] Dequeued cloud request. 2026-09-12T22:11:49.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T22:11:49.831 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F418153-F674-ACCD-5E67-E761B8658957} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 22:11:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T22:11:50.331 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T22:12:49.440 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T22:12:49.440 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T22:12:49.440 [Cloud] Queued cloud request. 2026-09-12T22:12:49.440 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T22:12:49.440 [Cloud] Dequeued cloud request. 2026-09-12T22:12:49.440 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T22:12:49.534 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DFAE6AB8-4E6C-5B98-27E6-D48629647A73} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 22:12:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T22:12:50.034 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T22:20:26.971 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T22:20:26.971 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T22:20:26.971 [Cloud] Queued cloud request. 2026-09-12T22:20:26.971 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T22:20:26.971 [Cloud] Dequeued cloud request. 2026-09-12T22:20:26.971 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T22:20:27.158 [Cloud] End of cloud request. 2026-09-12T22:20:27.658 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T22:20:52.924 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T22:31:56.846 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T22:31:56.846 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T22:31:56.846 [Cloud] Queued cloud request. 2026-09-12T22:31:56.846 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T22:31:56.846 [Cloud] Dequeued cloud request. 2026-09-12T22:31:56.846 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T22:31:57.049 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{144152E4-7FEB-8BAD-94EF-53D9E87C1238} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 22:31:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T22:31:57.564 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T22:35:24.580 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T22:35:24.580 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T22:35:24.580 [Cloud] Queued cloud request. 2026-09-12T22:35:24.580 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T22:35:24.580 [Cloud] Dequeued cloud request. 2026-09-12T22:35:24.580 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T22:35:24.767 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B8D2D673-F830-5181-E08E-58F45F1B2FFD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 22:35:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T22:35:25.283 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T22:35:57.861 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T22:35:57.861 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T22:35:57.861 [Cloud] Queued cloud request. 2026-09-12T22:35:57.861 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T22:35:57.861 [Cloud] Dequeued cloud request. 2026-09-12T22:35:57.861 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T22:35:57.924 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T22:35:57.955 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E020D9BA-55C4-BECB-81F6-0CE4FADC9677} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 22:35:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T22:35:58.455 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T22:37:35.142 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T22:37:35.142 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T22:37:35.142 [Cloud] Queued cloud request. 2026-09-12T22:37:35.142 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T22:37:35.142 [Cloud] Dequeued cloud request. 2026-09-12T22:37:35.142 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T22:37:35.377 [Cloud] End of cloud request. 2026-09-12T22:37:35.877 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T22:37:56.220 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T22:37:56.220 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T22:37:56.220 [Cloud] Queued cloud request. 2026-09-12T22:37:56.220 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T22:37:56.220 [Cloud] Dequeued cloud request. 2026-09-12T22:37:56.220 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{483DBA77-8C79-3239-D319-56E80EE904B7} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 22:38:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T22:38:06.252 [Cloud] End of cloud request. 2026-09-12T22:38:06.752 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T22:51:02.923 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T22:55:11.220 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T22:55:11.220 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T22:55:11.220 [Cloud] Queued cloud request. 2026-09-12T22:55:11.220 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T22:55:11.220 [Cloud] Dequeued cloud request. 2026-09-12T22:55:11.220 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T22:55:11.423 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7AFD3164-0964-9562-FFAF-B82E0A1FF6D0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 22:55:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T22:55:11.923 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T23:04:49.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T23:04:49.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T23:04:49.297 [Cloud] Queued cloud request. 2026-09-12T23:04:49.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T23:04:49.297 [Cloud] Dequeued cloud request. 2026-09-12T23:04:49.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T23:04:49.501 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A06D326A-9019-9F65-7E44-1E992B5296B7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 23:04:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T23:04:50.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T23:06:07.922 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T23:07:53.485 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T23:07:53.485 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T23:07:53.485 [Cloud] Queued cloud request. 2026-09-12T23:07:53.485 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T23:07:53.656 [Cloud] Dequeued cloud request. 2026-09-12T23:07:53.828 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T23:07:54.016 [Cloud] End of cloud request. 2026-09-12T23:07:54.516 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T23:11:08.734 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T23:11:08.734 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T23:11:08.734 [Cloud] Queued cloud request. 2026-09-12T23:11:08.734 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T23:11:08.734 [Cloud] Dequeued cloud request. 2026-09-12T23:11:08.734 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T23:11:08.922 [Cloud] End of cloud request. 2026-09-12T23:11:09.422 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T23:21:12.922 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T23:26:12.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T23:26:12.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T23:26:12.297 [Cloud] Queued cloud request. 2026-09-12T23:26:12.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T23:26:12.297 [Cloud] Dequeued cloud request. 2026-09-12T23:26:12.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T23:26:12.500 [Cloud] End of cloud request. 2026-09-12T23:26:13.000 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T23:28:45.687 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 16904, Count: 1195, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\netspot\mambots\editors\tinymce\jscripts\tiny_mce\tiny_mce.js, EstimatedImpact: 0% 2026-09-12T23:28:45.687 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 7258, Count: 406, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-12T23:28:45.687 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-12T23:28:45.687 ProcessImageName: WmiPrvSE.exe, Pid: 3240, TotalTime: 738, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-12T23:28:45.687 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-12T23:28:45.687 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 259, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-12T23:28:45.687 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-12T23:28:45.687 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-12T23:28:45.687 ProcessImageName: taskhostw.exe, Pid: 5764, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-12T23:28:45.687 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-12T23:28:45.687 ProcessImageName: powershell.exe, Pid: 4628, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-12T23:28:45.687 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-133bc-7c.MAI, EstimatedImpact: 0% 2026-09-12T23:28:45.687 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-12T23:28:45.687 ProcessImageName: ngentask.exe, Pid: 1468, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-12T23:36:17.921 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T23:37:40.186 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T23:37:40.186 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T23:37:40.186 [Cloud] Queued cloud request. 2026-09-12T23:37:40.186 [Cloud] Dequeued cloud request. 2026-09-12T23:37:40.186 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T23:37:40.186 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T23:37:41.843 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{98C8A0B0-1F86-5E4E-F8DA-195719318909} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 23:37:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T23:37:42.343 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T23:42:53.561 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T23:42:53.561 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T23:42:53.561 [Cloud] Queued cloud request. 2026-09-12T23:42:53.561 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T23:42:53.561 [Cloud] Dequeued cloud request. 2026-09-12T23:42:53.561 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T23:42:53.718 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EC5A307F-4504-CCAC-4B6A-5DBCFA178939} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 23:42:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T23:42:54.233 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T23:50:50.311 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T23:50:50.311 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T23:50:50.311 [Cloud] Queued cloud request. 2026-09-12T23:50:50.311 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T23:50:50.311 [Cloud] Dequeued cloud request. 2026-09-12T23:50:50.311 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T23:50:50.467 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D728ADEB-B943-2BD3-D5D7-22C04FFD3877} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 23:50:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T23:50:50.983 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-12T23:51:22.920 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-12T23:57:50.639 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-12T23:57:50.639 [Cloud] Start of cloud request. Passive mode: 0 2026-09-12T23:57:50.639 [Cloud] Queued cloud request. 2026-09-12T23:57:50.639 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-12T23:57:50.639 [Cloud] Dequeued cloud request. 2026-09-12T23:57:50.639 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-12T23:57:50.811 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{18B2C564-530C-25C0-4414-80EFE35D0903} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-12-2026 23:57:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-12T23:57:51.311 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T00:06:27.920 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T00:08:42.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T00:08:42.904 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T00:08:42.904 [Cloud] Queued cloud request. 2026-09-13T00:08:42.904 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T00:08:42.904 [Cloud] Dequeued cloud request. 2026-09-13T00:08:42.904 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T00:08:52.998 [Cloud] End of cloud request. 2026-09-13T00:08:53.513 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T00:12:14.748 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T00:12:14.748 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T00:12:14.748 [Cloud] Queued cloud request. 2026-09-13T00:12:14.748 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T00:12:14.748 [Cloud] Dequeued cloud request. 2026-09-13T00:12:14.748 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T00:12:14.904 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{37F971E5-6E57-DD6F-35F7-F629E2DB9D06} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 00:12:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T00:12:15.419 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T00:14:13.513 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:CDB9B4BE-1D3E-4E7C-AAE8-1CFADA90CBFA, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-13T00:14:13.513 Scheduled scan with Id CDB9B4BE-1D3E-4E7C-AAE8-1CFADA90CBFA configured CPU priority: normal (LowCpuPriority: 0) 2026-09-13T00:14:13.513 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-13T00:14:13.513 [SFC] System file cache build is not needed (already completed) 2026-09-13T00:14:37.654 Engine:Triggered AR EMS scan 2026-09-13T00:14:37.654 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.685 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.701 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.701 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.701 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.716 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.732 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.732 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.747 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.747 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.747 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.763 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.763 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.763 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.779 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.779 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.794 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.810 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.810 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.826 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.826 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.826 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.841 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.841 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.841 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.841 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.857 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.872 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.888 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.888 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.888 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.904 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.904 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.919 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.935 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.935 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.951 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.951 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.966 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.966 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.966 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.982 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.982 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.982 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:37.997 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.013 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.013 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.029 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.029 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.044 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.044 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.060 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.076 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.091 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.107 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.122 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.138 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.138 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.154 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.169 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:14:38.169 Engine:EMS scan for process: svchost pid: 7796, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-13T00:15:12.185 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T00:15:12.185 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T00:15:12.185 [Cloud] Queued cloud request. 2026-09-13T00:15:12.185 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T00:15:12.185 [Cloud] Dequeued cloud request. 2026-09-13T00:15:12.185 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T00:15:12.341 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D052425F-8FAB-E19A-B0DB-5A78E970D48A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 00:15:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T00:15:12.857 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T00:15:19.529 QuickScan:ScanID:CDB9B4BE-1D3E-4E7C-AAE8-1CFADA90CBFA: Quick scan finished with error 0 2026-09-13T00:15:20.044 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-13T00:15:20.044 [RTP] Duplicating the current plugin configuration object... 2026-09-13T00:15:20.044 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-13T00:15:20.044 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-13T00:15:20.044 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-13T00:15:20.044 [RTP] No config change detected. Not updating plugin configuration. 2026-09-13T00:15:20.044 [RTP] No config changes found. No configuration switch. 2026-09-13T00:15:20.044 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-13T00:21:32.919 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T00:26:13.810 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T00:26:13.810 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T00:26:13.810 [Cloud] Queued cloud request. 2026-09-13T00:26:13.810 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T00:26:13.810 [Cloud] Dequeued cloud request. 2026-09-13T00:26:13.825 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T00:26:13.966 [Cloud] End of cloud request. 2026-09-13T00:26:14.482 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T00:27:15.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T00:27:15.700 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T00:27:15.700 [Cloud] Queued cloud request. 2026-09-13T00:27:15.700 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T00:27:15.700 [Cloud] Dequeued cloud request. 2026-09-13T00:27:15.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T00:27:15.841 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D2D6A822-AA31-1D0E-1318-C25131B55F9D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 00:27:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T00:27:16.357 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T00:30:46.528 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T00:30:46.528 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T00:30:46.528 [Cloud] Queued cloud request. 2026-09-13T00:30:46.528 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T00:30:46.544 [Cloud] Dequeued cloud request. 2026-09-13T00:30:46.544 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T00:30:46.684 [Cloud] End of cloud request. 2026-09-13T00:30:47.200 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T00:32:15.372 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T00:32:15.372 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T00:32:15.372 [Cloud] Queued cloud request. 2026-09-13T00:32:15.372 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T00:32:15.372 [Cloud] Dequeued cloud request. 2026-09-13T00:32:15.372 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T00:32:15.528 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{42181E81-3A5E-BD6F-7615-92F8B9BFC164} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 00:32:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T00:32:16.028 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T00:33:46.997 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T00:33:46.997 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T00:33:46.997 [Cloud] Queued cloud request. 2026-09-13T00:33:46.997 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T00:33:46.997 [Cloud] Dequeued cloud request. 2026-09-13T00:33:46.997 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T00:33:47.138 [Cloud] End of cloud request. 2026-09-13T00:33:47.653 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T00:36:37.919 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T00:39:03.856 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T00:39:03.856 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T00:39:03.856 [Cloud] Queued cloud request. 2026-09-13T00:39:03.856 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T00:39:03.856 [Cloud] Dequeued cloud request. 2026-09-13T00:39:03.871 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T00:39:04.028 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D2C4521F-CC1B-29D7-B409-789AA2728410} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 00:39:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T00:39:04.528 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T00:51:42.918 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T01:00:01.745 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009883, FileId: 0x18000000037b5a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.745 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009884, FileId: 0x1c000000037a90, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.777 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009890, FileId: 0x1e000000037a90, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.777 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009889, FileId: 0x1a000000037b5a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.792 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009896, FileId: 0x20000000037a90, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.792 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009895, FileId: 0x1c000000037b5a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.808 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009901, FileId: 0x1e000000037b5a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.808 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009902, FileId: 0x22000000037a90, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.824 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009908, FileId: 0x24000000037a90, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.824 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009909, FileId: 0x20000000037b5a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.839 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009915, FileId: 0x26000000037a90, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.839 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009914, FileId: 0x22000000037b5a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.855 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009920, FileId: 0x24000000037b5a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.855 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009921, FileId: 0x28000000037a90, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.870 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009927, FileId: 0x2a000000037a90, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.870 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009926, FileId: 0x26000000037b5a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.886 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009932, FileId: 0x28000000037b5a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.886 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009933, FileId: 0x2c000000037a90, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.903 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009938, FileId: 0x2a000000037b5a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.903 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009939, FileId: 0x2e000000037a90, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.917 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009944, FileId: 0x30000000037a90, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.917 [RTP] [Mini-filter] Unsuccessful scan status(#27): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009945, FileId: 0x2c000000037b5a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.949 [RTP] [Mini-filter] Unsuccessful scan status(#29): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009951, FileId: 0x32000000037a90, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:00:01.949 [RTP] [Mini-filter] Unsuccessful scan status(#28): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1400c-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5009950, FileId: 0x2e000000037b5a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T01:06:47.917 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T01:07:35.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:07:35.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:07:35.604 [Cloud] Queued cloud request. 2026-09-13T01:07:35.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:07:35.604 [Cloud] Dequeued cloud request. 2026-09-13T01:07:35.620 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:07:35.776 [Cloud] End of cloud request. 2026-09-13T01:07:36.276 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:10:43.354 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:10:43.354 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:10:43.354 [Cloud] Queued cloud request. 2026-09-13T01:10:43.354 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:10:43.354 [Cloud] Dequeued cloud request. 2026-09-13T01:10:43.354 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:10:43.511 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1161D315-E760-8578-13D0-E1EC3D304488} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 01:10:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T01:10:44.026 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:10:51.917 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:10:51.917 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:10:51.917 [Cloud] Queued cloud request. 2026-09-13T01:10:51.917 [Cloud] Dequeued cloud request. 2026-09-13T01:10:51.917 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:10:51.917 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:10:51.995 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{362088C5-FB2C-7A7E-43B9-F8074724E9B9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 01:10:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T01:10:52.511 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:21:52.917 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T01:26:48.104 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:26:48.104 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:26:48.104 [Cloud] Queued cloud request. 2026-09-13T01:26:48.104 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:26:48.104 [Cloud] Dequeued cloud request. 2026-09-13T01:26:48.104 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:26:48.307 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7952A670-752E-637A-CB9B-3339EDCB0D68} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 01:26:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T01:26:48.823 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:28:05.182 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:28:05.182 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:28:05.182 [Cloud] Queued cloud request. 2026-09-13T01:28:05.182 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:28:05.182 [Cloud] Dequeued cloud request. 2026-09-13T01:28:05.197 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:28:05.369 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{22230881-87D0-DC8F-B571-0C97B9ACA27A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 01:28:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T01:28:05.885 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:28:45.697 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 20361, Count: 1436, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\netspot\mambots\editors\tinymce\jscripts\tiny_mce\tiny_mce.js, EstimatedImpact: 0% 2026-09-13T01:28:45.697 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 10316, Count: 574, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T01:28:45.697 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 1525, Count: 70, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-13T01:28:45.697 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-13T01:28:45.697 ProcessImageName: AgentShellService.exe, Pid: 6296, TotalTime: 822, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-13T01:28:45.697 ProcessImageName: WmiPrvSE.exe, Pid: 3240, TotalTime: 738, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-13T01:28:45.697 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 486, Count: 29, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-13T01:28:45.697 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-13T01:28:45.697 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T01:28:45.697 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-13T01:28:45.697 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 62, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-133bc-7c.MAI, EstimatedImpact: 0% 2026-09-13T01:28:45.697 ProcessImageName: taskhostw.exe, Pid: 5764, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-13T01:28:45.697 ProcessImageName: DeviceCensus.exe, Pid: 5920, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-13T01:28:45.697 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 61, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T01:28:45.697 ProcessImageName: powershell.exe, Pid: 4628, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-13T01:28:45.697 ProcessImageName: mysqldump.exe, Pid: 3412, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 9% 2026-09-13T01:28:45.697 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-13T01:28:45.697 ProcessImageName: powershell.exe, Pid: 4620, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpA408.tmp, EstimatedImpact: 0% 2026-09-13T01:28:45.697 ProcessImageName: ngentask.exe, Pid: 1468, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-13T01:30:13.635 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:30:13.635 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:30:13.635 [Cloud] Queued cloud request. 2026-09-13T01:30:13.635 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:30:13.635 [Cloud] Dequeued cloud request. 2026-09-13T01:30:13.635 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:30:13.822 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3E8B95DB-AB20-BD28-A49F-04E5933C3DDE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 01:30:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T01:30:14.338 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:36:21.025 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:36:21.025 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:36:21.025 [Cloud] Queued cloud request. 2026-09-13T01:36:21.025 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:36:21.025 [Cloud] Dequeued cloud request. 2026-09-13T01:36:21.025 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:36:21.213 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8F5743AF-4AFC-BF37-921A-CC8035163E34} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 01:36:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T01:36:21.713 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:36:57.916 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T01:39:43.697 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:39:43.697 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:39:43.697 [Cloud] Queued cloud request. 2026-09-13T01:39:43.697 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:39:43.697 [Cloud] Dequeued cloud request. 2026-09-13T01:39:43.697 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:39:43.853 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{99C32883-76B3-2002-DF69-988A36D06350} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 01:39:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T01:39:44.369 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:45:15.041 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:45:15.041 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:45:15.041 [Cloud] Queued cloud request. 2026-09-13T01:45:15.041 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:45:15.041 [Cloud] Dequeued cloud request. 2026-09-13T01:45:15.056 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:45:15.228 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CE58F6C7-4E51-51FC-7967-D7EE2FE11783} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 01:45:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T01:45:15.744 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:51:24.321 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:51:24.321 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:51:24.321 [Cloud] Queued cloud request. 2026-09-13T01:51:24.321 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:51:24.321 [Cloud] Dequeued cloud request. 2026-09-13T01:51:24.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:51:24.478 [Cloud] End of cloud request. 2026-09-13T01:51:24.978 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:52:02.915 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T01:52:21.197 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:52:21.197 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:52:21.197 [Cloud] Queued cloud request. 2026-09-13T01:52:21.197 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:52:21.197 [Cloud] Dequeued cloud request. 2026-09-13T01:52:21.197 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:52:21.275 [Cloud] End of cloud request. 2026-09-13T01:52:21.775 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:54:38.571 [AutoPurge] Cleanup Routine tasks have started. 2026-09-13T01:54:38.571 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-13T01:54:38.571 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-13T01:54:38.571 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-13T01:54:38.571 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-13T01:54:38.571 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-13T01:54:38.571 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-13T01:54:38.603 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-13T01:54:38.603 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-13T01:54:38.603 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-13-2026 01:54:38 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-13-2026 01:54:38 2026-09-13T01:54:38.603 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-13T01:54:38.603 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-13T01:54:38.603 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-13T01:54:38.603 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-13T01:54:38.603 [AutoPurge] Verification Routine tasks have started. 2026-09-13T01:54:38.603 [AutoPurge] Cleanup Routine tasks have ended.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-13T01:54:38.728 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-13T01:54:38.743 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-13T01:54:38.759 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-13T01:54:38.759 [AutoPurge] Removing expired default signature package ... 2026-09-13T01:54:39.024 Job Notification: New process added to job (1116) 2026-09-13T01:54:39.837 Job Notification: Process exited from job (1116) 2026-09-13T01:54:39.884 [AutoPurge] Verification Routine tasks have ended. 2026-09-13T01:55:46.603 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:55:46.603 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:55:46.603 [Cloud] Queued cloud request. 2026-09-13T01:55:46.603 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:55:46.603 [Cloud] Dequeued cloud request. 2026-09-13T01:55:46.603 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:55:46.743 [Cloud] End of cloud request. 2026-09-13T01:55:47.259 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-13T01:55:47.274 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:55:47.290 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-13T01:55:47.290 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-13T01:55:47.290 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-13T01:55:47.290 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-13T01:55:47.290 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-13T01:55:47.290 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-13T01:55:47.290 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-13T01:55:47.290 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-13T01:55:47.290 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-13T01:55:47.290 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-13T01:55:47.290 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-13T01:55:47.290 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-13T01:55:47.290 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-13T01:55:47.290 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-13T01:55:47.290 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-13T01:55:47.290 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-13T01:55:47.290 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-13T01:55:47.290 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-13T01:55:47.290 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-13T01:55:47.290 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-13T01:55:47.290 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:55:47.290 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:55:47.290 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:55:47.290 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:55:49.868 [RTP] Duplicating the current plugin configuration object... 2026-09-13T01:55:49.868 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-13T01:55:49.868 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-13T01:55:49.868 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-13T01:55:49.868 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-13T01:55:49.868 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-13T01:57:47.181 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:57:47.181 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:57:47.181 [Cloud] Queued cloud request. 2026-09-13T01:57:47.181 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:57:47.181 [Cloud] Dequeued cloud request. 2026-09-13T01:57:47.181 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:57:47.321 [Cloud] End of cloud request. 2026-09-13T01:57:47.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T01:59:45.446 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T01:59:45.446 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T01:59:45.446 [Cloud] Queued cloud request. 2026-09-13T01:59:45.446 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T01:59:45.446 [Cloud] Dequeued cloud request. 2026-09-13T01:59:45.446 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T01:59:45.587 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{384B55B4-8574-5C67-A1A6-B3D1EA80E964} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 01:59:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T01:59:46.087 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T02:02:07.243 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T02:02:07.243 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T02:02:07.243 [Cloud] Queued cloud request. 2026-09-13T02:02:07.243 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T02:02:07.243 [Cloud] Dequeued cloud request. 2026-09-13T02:02:07.243 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T02:02:07.399 [Cloud] End of cloud request. 2026-09-13T02:02:07.899 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T02:06:13.743 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T02:06:13.743 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T02:06:13.743 [Cloud] Queued cloud request. 2026-09-13T02:06:13.743 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T02:06:13.743 [Cloud] Dequeued cloud request. 2026-09-13T02:06:13.743 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T02:06:13.899 [Cloud] End of cloud request. 2026-09-13T02:06:14.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T02:06:53.602 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T02:06:53.602 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T02:06:53.602 [Cloud] Queued cloud request. 2026-09-13T02:06:53.602 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T02:06:53.602 [Cloud] Dequeued cloud request. 2026-09-13T02:06:53.602 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T02:06:53.696 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2149CDF7-703E-0DBF-38C6-9FF1150A1DD9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 02:06:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T02:06:54.212 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T02:07:07.915 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T02:17:58.430 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T02:17:58.430 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T02:17:58.430 [Cloud] Queued cloud request. 2026-09-13T02:17:58.430 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T02:17:58.430 [Cloud] Dequeued cloud request. 2026-09-13T02:17:58.430 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T02:17:58.586 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{50B0138E-8424-58F6-64DE-9BF404271690} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 02:17:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T02:17:59.102 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T02:21:21.633 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T02:21:21.633 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T02:21:21.633 [Cloud] Queued cloud request. 2026-09-13T02:21:21.633 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T02:21:21.633 [Cloud] Dequeued cloud request. 2026-09-13T02:21:21.633 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T02:21:21.789 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E9F5397B-088E-5CBA-ED31-E790118A4E7C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 02:21:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T02:21:22.289 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T02:22:12.914 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T02:24:40.211 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T02:24:40.211 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T02:24:40.211 [Cloud] Queued cloud request. 2026-09-13T02:24:40.211 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T02:24:40.211 [Cloud] Dequeued cloud request. 2026-09-13T02:24:40.211 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T02:24:40.367 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6C3FC68C-06E4-1104-4510-C593AAB38AFF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 02:24:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T02:24:40.883 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T02:37:17.913 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T02:41:22.147 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T02:41:22.147 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T02:41:22.147 [Cloud] Queued cloud request. 2026-09-13T02:41:22.147 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T02:41:22.319 [Cloud] Dequeued cloud request. 2026-09-13T02:41:22.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T02:41:22.632 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{90D9C1DC-7DCB-4FA5-70B6-575F6B259E84} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 02:41:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T02:41:23.132 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T02:52:22.913 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T02:59:07.537 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T02:59:07.537 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T02:59:07.537 [Cloud] Queued cloud request. 2026-09-13T02:59:07.537 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T02:59:07.537 [Cloud] Dequeued cloud request. 2026-09-13T02:59:07.537 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T02:59:07.709 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B0052FA0-A306-8BC7-B4DC-F371670CB23E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 02:59:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T02:59:08.209 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T03:00:29.756 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T03:00:29.756 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T03:00:29.756 [Cloud] Queued cloud request. 2026-09-13T03:00:29.756 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T03:00:29.756 [Cloud] Dequeued cloud request. 2026-09-13T03:00:29.756 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T03:00:29.896 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B2DFD71D-A229-4EE8-CD59-C3B5AC43562C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 03:00:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T03:00:30.412 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T03:02:31.756 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T03:02:31.756 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T03:02:31.756 [Cloud] Queued cloud request. 2026-09-13T03:02:31.756 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T03:02:31.756 [Cloud] Dequeued cloud request. 2026-09-13T03:02:31.756 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T03:02:31.896 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{01D5DFD4-A2D3-F96C-A5C7-DA54F90AEEB7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 03:02:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T03:02:32.412 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T03:07:27.912 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T03:22:32.911 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T03:26:48.676 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T03:26:48.676 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T03:26:48.676 [Cloud] Queued cloud request. 2026-09-13T03:26:48.676 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T03:26:48.676 [Cloud] Dequeued cloud request. 2026-09-13T03:26:48.676 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T03:26:48.833 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C8D1CC24-8ACA-A962-8BF6-9990A6D2E4A5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 03:26:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T03:26:49.333 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T03:28:43.786 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T03:28:43.786 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T03:28:43.786 [Cloud] Queued cloud request. 2026-09-13T03:28:43.786 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T03:28:43.786 [Cloud] Dequeued cloud request. 2026-09-13T03:28:43.786 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T03:28:43.942 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{69E0B606-0BD5-02AF-0AAD-BD21DCF620FE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 03:28:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T03:28:44.442 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T03:28:45.708 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 24794, Count: 1767, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\netspot\mambots\editors\tinymce\jscripts\tiny_mce\tiny_mce.js, EstimatedImpact: 0% 2026-09-13T03:28:45.708 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 10316, Count: 574, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T03:28:45.708 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 5306, Count: 270, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-13T03:28:45.708 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-13T03:28:45.708 ProcessImageName: AgentShellService.exe, Pid: 6296, TotalTime: 822, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-13T03:28:45.708 ProcessImageName: WmiPrvSE.exe, Pid: 3240, TotalTime: 738, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-13T03:28:45.708 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 486, Count: 29, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-13T03:28:45.708 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-13T03:28:45.708 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T03:28:45.708 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-13T03:28:45.708 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 62, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-133bc-7c.MAI, EstimatedImpact: 0% 2026-09-13T03:28:45.708 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T03:28:45.708 ProcessImageName: taskhostw.exe, Pid: 5764, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-13T03:28:45.708 ProcessImageName: DeviceCensus.exe, Pid: 5920, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-13T03:28:45.708 ProcessImageName: powershell.exe, Pid: 4628, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-13T03:28:45.708 ProcessImageName: cmd.exe, Pid: 7724, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-13T03:28:45.708 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-13T03:28:45.708 ProcessImageName: mysqldump.exe, Pid: 3412, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 9% 2026-09-13T03:28:45.708 ProcessImageName: powershell.exe, Pid: 4620, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpA408.tmp, EstimatedImpact: 0% 2026-09-13T03:28:45.708 ProcessImageName: ngentask.exe, Pid: 1468, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-13T03:28:45.708 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-13T03:37:37.910 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T03:46:55.426 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T03:46:55.426 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T03:46:55.426 [Cloud] Queued cloud request. 2026-09-13T03:46:55.426 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T03:46:55.426 [Cloud] Dequeued cloud request. 2026-09-13T03:46:55.426 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T03:46:55.582 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{978242EC-20EC-1D5F-3B0C-CEC34370D45E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 03:46:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T03:46:56.082 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T03:49:51.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T03:49:51.097 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T03:49:51.097 [Cloud] Queued cloud request. 2026-09-13T03:49:51.097 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T03:49:51.097 [Cloud] Dequeued cloud request. 2026-09-13T03:49:51.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T03:49:51.269 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E3706C57-11F0-ADE4-28EB-E760A14D0498} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 03:49:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T03:49:51.769 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T03:52:04.363 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T03:52:04.363 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T03:52:04.363 [Cloud] Queued cloud request. 2026-09-13T03:52:04.363 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T03:52:04.363 [Cloud] Dequeued cloud request. 2026-09-13T03:52:04.363 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T03:52:04.519 [Cloud] End of cloud request. 2026-09-13T03:52:05.019 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T03:52:42.910 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{1253FAF0-3E6A-6762-30A6-A7AA5B15791B} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-13-2026 04:01:24 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T04:01:25.831 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T04:01:25.831 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T04:01:25.831 [Cloud] Queued cloud request. 2026-09-13T04:01:25.831 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T04:01:25.831 [Cloud] Dequeued cloud request. 2026-09-13T04:01:25.831 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T04:01:26.144 [Cloud] End of cloud request. 2026-09-13T04:01:26.659 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T04:04:58.519 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T04:04:58.519 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T04:04:58.519 [Cloud] Queued cloud request. 2026-09-13T04:04:58.519 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T04:04:58.519 [Cloud] Dequeued cloud request. 2026-09-13T04:04:58.519 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T04:04:58.659 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1B8EA3C7-B8AA-60FD-3F89-8ECEAD3FE428} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 04:04:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T04:04:59.159 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T04:07:47.909 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T04:10:31.143 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T04:10:31.143 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T04:10:31.143 [Cloud] Queued cloud request. 2026-09-13T04:10:31.143 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T04:10:31.143 [Cloud] Dequeued cloud request. 2026-09-13T04:10:31.143 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T04:10:31.300 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1E8824A1-65B0-1D82-D3D4-98F81318C097} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 04:10:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T04:10:31.815 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T04:22:52.909 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T04:24:48.065 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T04:24:48.065 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T04:24:48.065 [Cloud] Queued cloud request. 2026-09-13T04:24:48.065 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T04:24:48.080 [Cloud] Dequeued cloud request. 2026-09-13T04:24:48.080 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T04:24:48.268 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{53A0D732-57CD-CF2E-AEB2-82CCE217AD67} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 04:24:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T04:24:48.768 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T04:30:19.267 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T04:30:19.267 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T04:30:19.267 [Cloud] Queued cloud request. 2026-09-13T04:30:19.267 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T04:30:19.267 [Cloud] Dequeued cloud request. 2026-09-13T04:30:19.267 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T04:30:19.455 [Cloud] End of cloud request. 2026-09-13T04:30:19.970 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T04:30:46.548 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T04:30:46.548 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T04:30:46.548 [Cloud] Queued cloud request. 2026-09-13T04:30:46.548 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T04:30:46.548 [Cloud] Dequeued cloud request. 2026-09-13T04:30:46.564 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T04:30:46.642 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0637F2DA-BC8A-2045-B37A-3992768405D1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 04:30:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T04:30:47.142 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T04:31:58.970 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T04:31:58.970 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T04:31:58.970 [Cloud] Queued cloud request. 2026-09-13T04:31:58.970 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T04:31:58.986 [Cloud] Dequeued cloud request. 2026-09-13T04:31:58.986 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T04:31:59.158 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5B721D56-9781-4AAE-5D8F-03FF3FE6E8AA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 04:31:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T04:31:59.673 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T04:37:57.907 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T04:41:16.407 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T04:41:16.407 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T04:41:16.407 [Cloud] Queued cloud request. 2026-09-13T04:41:16.407 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T04:41:16.407 [Cloud] Dequeued cloud request. 2026-09-13T04:41:16.407 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T04:41:16.563 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C4E9D570-2559-D59E-19A7-E7CA00ED009F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 04:41:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T04:41:17.079 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T04:45:45.001 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T04:45:45.001 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T04:45:45.001 [Cloud] Queued cloud request. 2026-09-13T04:45:45.001 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T04:45:45.001 [Cloud] Dequeued cloud request. 2026-09-13T04:45:45.017 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T04:45:48.204 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B0C9D654-6845-8756-FE22-693B20145393} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 04:45:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T04:45:48.720 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T04:53:02.907 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T04:59:59.891 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T04:59:59.891 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T04:59:59.891 [Cloud] Queued cloud request. 2026-09-13T04:59:59.891 [Cloud] Dequeued cloud request. 2026-09-13T04:59:59.891 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T04:59:59.891 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T05:00:00.156 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E056D039-376A-B4F9-3052-8C3ABF2F4E72} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 05:00:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T05:00:00.672 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T05:06:39.453 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T05:06:39.453 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T05:06:39.453 [Cloud] Queued cloud request. 2026-09-13T05:06:39.453 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T05:06:39.578 [Cloud] Dequeued cloud request. 2026-09-13T05:06:39.656 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T05:06:49.734 [Cloud] End of cloud request. 2026-09-13T05:06:50.250 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T05:08:07.906 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T05:10:59.421 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T05:10:59.421 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T05:10:59.421 [Cloud] Queued cloud request. 2026-09-13T05:10:59.421 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T05:10:59.421 [Cloud] Dequeued cloud request. 2026-09-13T05:10:59.421 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T05:11:03.078 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EB0C385D-7FEB-466F-31C1-4DAD2203B9A2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 05:11:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T05:11:03.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T05:23:12.905 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T05:28:45.717 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 28660, Count: 2001, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-13T05:28:45.717 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 10316, Count: 574, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T05:28:45.717 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 9164, Count: 470, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-13T05:28:45.717 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-13T05:28:45.717 ProcessImageName: AgentShellService.exe, Pid: 6296, TotalTime: 822, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-13T05:28:45.717 ProcessImageName: WmiPrvSE.exe, Pid: 3240, TotalTime: 738, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-13T05:28:45.717 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 532, Count: 31, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-13T05:28:45.717 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-13T05:28:45.717 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T05:28:45.717 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-13T05:28:45.717 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 62, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-133bc-7c.MAI, EstimatedImpact: 0% 2026-09-13T05:28:45.717 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T05:28:45.717 ProcessImageName: taskhostw.exe, Pid: 5764, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-13T05:28:45.717 ProcessImageName: DeviceCensus.exe, Pid: 5920, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-13T05:28:45.717 ProcessImageName: powershell.exe, Pid: 4628, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-13T05:28:45.717 ProcessImageName: cmd.exe, Pid: 7724, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-13T05:28:45.717 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-13T05:28:45.717 ProcessImageName: mysqldump.exe, Pid: 3412, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 9% 2026-09-13T05:28:45.717 ProcessImageName: powershell.exe, Pid: 4620, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpA408.tmp, EstimatedImpact: 0% 2026-09-13T05:28:45.717 ProcessImageName: ngentask.exe, Pid: 1468, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-13T05:28:45.717 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-13T05:29:00.655 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T05:29:00.655 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T05:29:00.655 [Cloud] Queued cloud request. 2026-09-13T05:29:00.655 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T05:29:00.655 [Cloud] Dequeued cloud request. 2026-09-13T05:29:00.671 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T05:29:00.811 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B29298AF-6B0A-8A29-E8A9-C5AAE15BF59E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 05:29:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T05:29:01.311 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T05:31:28.733 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T05:31:28.733 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T05:31:28.733 [Cloud] Queued cloud request. 2026-09-13T05:31:28.733 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T05:31:28.733 [Cloud] Dequeued cloud request. 2026-09-13T05:31:28.733 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T05:31:28.889 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{694777D9-41B7-F52D-8FE1-4A19187BD42C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 05:31:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T05:31:29.405 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T05:38:17.904 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T05:38:38.483 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T05:38:38.483 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T05:38:38.483 [Cloud] Queued cloud request. 2026-09-13T05:38:38.483 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T05:38:38.483 [Cloud] Dequeued cloud request. 2026-09-13T05:38:38.483 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T05:38:38.623 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4CAD4579-F1D9-40BB-981B-0DC340F194E7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 05:38:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T05:38:39.139 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T05:42:01.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T05:42:01.904 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T05:42:01.904 [Cloud] Queued cloud request. 2026-09-13T05:42:01.904 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T05:42:01.904 [Cloud] Dequeued cloud request. 2026-09-13T05:42:01.920 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T05:42:02.076 [Cloud] End of cloud request. 2026-09-13T05:42:02.576 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T05:43:33.076 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T05:43:33.076 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T05:43:33.076 [Cloud] Queued cloud request. 2026-09-13T05:43:33.076 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T05:43:33.076 [Cloud] Dequeued cloud request. 2026-09-13T05:43:33.311 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T05:43:43.311 [Cloud] End of cloud request. 2026-09-13T05:43:43.842 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T05:53:22.904 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T05:56:05.482 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T05:56:05.482 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T05:56:05.482 [Cloud] Queued cloud request. 2026-09-13T05:56:05.482 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T05:56:05.482 [Cloud] Dequeued cloud request. 2026-09-13T05:56:05.482 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T05:56:05.638 [Cloud] End of cloud request. 2026-09-13T05:56:06.154 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T06:03:14.591 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T06:03:14.591 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T06:03:14.591 [Cloud] Queued cloud request. 2026-09-13T06:03:14.591 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T06:03:14.591 [Cloud] Dequeued cloud request. 2026-09-13T06:03:14.591 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T06:03:24.684 [Cloud] End of cloud request. 2026-09-13T06:03:25.184 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T06:08:27.903 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T06:18:29.699 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T06:18:29.699 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T06:18:29.699 [Cloud] Queued cloud request. 2026-09-13T06:18:29.699 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T06:18:29.699 [Cloud] Dequeued cloud request. 2026-09-13T06:18:29.699 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T06:18:29.871 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8B458749-4551-C175-D998-3C796F1693A2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 06:18:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T06:18:30.371 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T06:23:32.902 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T06:26:33.152 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T06:26:33.152 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T06:26:33.152 [Cloud] Queued cloud request. 2026-09-13T06:26:33.152 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T06:26:33.152 [Cloud] Dequeued cloud request. 2026-09-13T06:26:33.152 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T06:26:33.293 [Cloud] End of cloud request. 2026-09-13T06:26:33.793 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T06:30:04.136 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T06:30:04.136 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T06:30:04.136 [Cloud] Queued cloud request. 2026-09-13T06:30:04.136 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T06:30:04.136 [Cloud] Dequeued cloud request. 2026-09-13T06:30:04.136 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T06:30:04.292 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1B9AE47A-84A3-4207-11EB-34B614A423FD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 06:30:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T06:30:04.808 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T06:31:38.073 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T06:31:38.073 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T06:31:38.073 [Cloud] Queued cloud request. 2026-09-13T06:31:38.073 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T06:31:38.073 [Cloud] Dequeued cloud request. 2026-09-13T06:31:38.073 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T06:31:38.214 [Cloud] End of cloud request. 2026-09-13T06:31:38.714 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T06:32:48.730 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T06:32:48.730 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T06:32:48.745 [Cloud] Queued cloud request. 2026-09-13T06:32:48.745 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T06:32:48.745 [Cloud] Dequeued cloud request. 2026-09-13T06:32:48.745 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T06:32:48.870 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{701C82E9-F456-8C40-9430-62ACE9444C7E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 06:32:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T06:32:49.370 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T06:34:43.730 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T06:34:43.730 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T06:34:43.730 [Cloud] Queued cloud request. 2026-09-13T06:34:43.730 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T06:34:43.730 [Cloud] Dequeued cloud request. 2026-09-13T06:34:43.730 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T06:34:43.886 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C6D7314F-D83C-CEDF-A92F-C9F6E06403B1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 06:34:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T06:34:44.386 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T06:35:46.933 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T06:35:46.933 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T06:35:46.933 [Cloud] Queued cloud request. 2026-09-13T06:35:46.933 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T06:35:46.933 [Cloud] Dequeued cloud request. 2026-09-13T06:35:46.933 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T06:35:47.089 [Cloud] End of cloud request. 2026-09-13T06:35:47.605 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T06:38:37.901 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T06:41:22.307 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T06:41:22.307 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T06:41:22.307 [Cloud] Queued cloud request. 2026-09-13T06:41:22.307 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T06:41:22.307 [Cloud] Dequeued cloud request. 2026-09-13T06:41:22.307 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T06:41:22.510 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1175951D-D4D6-D32E-CFA2-14C63148CB84} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 06:41:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T06:41:23.026 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T06:53:42.901 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T07:02:31.306 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T07:02:31.306 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T07:02:31.306 [Cloud] Queued cloud request. 2026-09-13T07:02:31.306 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T07:02:31.306 [Cloud] Dequeued cloud request. 2026-09-13T07:02:31.306 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T07:02:31.462 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{230B587F-193E-DD80-C275-FBCB387FE42D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 07:02:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T07:02:31.962 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T07:03:28.931 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T07:03:28.931 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T07:03:28.931 [Cloud] Queued cloud request. 2026-09-13T07:03:28.931 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T07:03:28.931 [Cloud] Dequeued cloud request. 2026-09-13T07:03:28.931 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T07:03:29.009 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{95ECF356-9732-825A-2F07-E55B97829A17} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 07:03:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T07:03:29.509 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T07:08:47.900 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T07:09:06.775 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T07:09:06.775 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T07:09:06.775 [Cloud] Queued cloud request. 2026-09-13T07:09:06.775 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T07:09:06.790 [Cloud] Dequeued cloud request. 2026-09-13T07:09:06.790 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T07:09:06.931 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9F4205CF-4C1A-673F-EDAE-BF2AB8F28FE5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 07:09:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T07:09:07.431 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T07:10:47.321 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T07:10:47.321 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T07:10:47.321 [Cloud] Queued cloud request. 2026-09-13T07:10:47.321 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T07:10:47.321 [Cloud] Dequeued cloud request. 2026-09-13T07:10:47.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T07:10:47.462 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A82E501D-E899-B7B8-543C-F6861562AD7F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 07:10:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T07:10:47.962 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T07:15:38.774 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T07:15:38.774 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T07:15:38.774 [Cloud] Queued cloud request. 2026-09-13T07:15:38.774 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T07:15:38.931 [Cloud] Dequeued cloud request. 2026-09-13T07:15:38.931 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T07:15:39.103 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{773C2438-AEA4-4229-638A-E8A370AAE8E4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 07:15:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T07:15:39.618 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T07:16:42.118 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T07:16:42.118 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T07:16:42.118 [Cloud] Queued cloud request. 2026-09-13T07:16:42.118 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T07:16:42.118 [Cloud] Dequeued cloud request. 2026-09-13T07:16:42.118 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T07:16:42.305 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{333540F0-B818-BC5A-063E-0DCFEBAA36C2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 07:16:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T07:16:42.821 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T07:23:52.899 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T07:28:45.711 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 32744, Count: 2242, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-13T07:28:45.711 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 12793, Count: 670, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-13T07:28:45.711 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 10316, Count: 574, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T07:28:45.711 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-13T07:28:45.711 ProcessImageName: AgentShellService.exe, Pid: 6296, TotalTime: 822, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-13T07:28:45.711 ProcessImageName: WmiPrvSE.exe, Pid: 3240, TotalTime: 738, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-13T07:28:45.711 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 562, Count: 33, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-13T07:28:45.711 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-13T07:28:45.711 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T07:28:45.711 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-13T07:28:45.711 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 62, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-133bc-7c.MAI, EstimatedImpact: 0% 2026-09-13T07:28:45.711 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T07:28:45.711 ProcessImageName: taskhostw.exe, Pid: 5764, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-13T07:28:45.711 ProcessImageName: DeviceCensus.exe, Pid: 5920, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-13T07:28:45.711 ProcessImageName: powershell.exe, Pid: 4628, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-13T07:28:45.711 ProcessImageName: cmd.exe, Pid: 7724, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-13T07:28:45.711 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-13T07:28:45.711 ProcessImageName: mysqldump.exe, Pid: 3412, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 9% 2026-09-13T07:28:45.711 ProcessImageName: powershell.exe, Pid: 4620, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpA408.tmp, EstimatedImpact: 0% 2026-09-13T07:28:45.711 ProcessImageName: ngentask.exe, Pid: 1468, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-13T07:28:45.711 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-13T07:37:42.195 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T07:37:42.195 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T07:37:42.195 [Cloud] Queued cloud request. 2026-09-13T07:37:42.195 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T07:37:42.195 [Cloud] Dequeued cloud request. 2026-09-13T07:37:42.195 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T07:37:42.398 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7A7DDEDB-D8DA-7C1B-9F2C-07FFC5571680} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 07:37:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T07:37:42.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T07:38:57.898 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T07:43:24.429 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T07:43:24.429 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T07:43:24.429 [Cloud] Queued cloud request. 2026-09-13T07:43:24.429 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T07:43:24.429 [Cloud] Dequeued cloud request. 2026-09-13T07:43:24.429 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T07:43:24.617 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3959C165-99D4-4081-91F7-12AC7C73846F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 07:43:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T07:43:25.117 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T07:47:01.694 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T07:47:01.694 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T07:47:01.694 [Cloud] Queued cloud request. 2026-09-13T07:47:01.694 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T07:47:01.694 [Cloud] Dequeued cloud request. 2026-09-13T07:47:01.694 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T07:47:01.882 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3C4E1134-A11A-16D5-ACA6-2AF3E709E955} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 07:47:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T07:47:02.398 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T07:54:02.897 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T08:00:01.038 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T08:00:01.038 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T08:00:01.038 [Cloud] Queued cloud request. 2026-09-13T08:00:01.038 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T08:00:01.038 [Cloud] Dequeued cloud request. 2026-09-13T08:00:01.038 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T08:00:11.131 [Cloud] End of cloud request. 2026-09-13T08:00:11.647 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T08:09:07.897 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T08:21:04.990 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T08:21:04.990 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T08:21:04.990 [Cloud] Queued cloud request. 2026-09-13T08:21:04.990 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T08:21:04.990 [Cloud] Dequeued cloud request. 2026-09-13T08:21:04.990 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T08:21:05.193 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0ED46544-6686-197B-AD7D-DAE5186AA2D2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 08:21:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T08:21:05.693 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T08:24:12.896 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T08:39:17.895 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T08:42:12.785 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T08:42:12.785 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T08:42:12.785 [Cloud] Queued cloud request. 2026-09-13T08:42:12.785 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T08:42:12.785 [Cloud] Dequeued cloud request. 2026-09-13T08:42:12.785 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T08:42:12.973 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C96B533D-729F-84FE-FFD2-BF644B9B567D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 08:42:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T08:42:13.473 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T08:54:22.894 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T09:05:56.238 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T09:05:56.238 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T09:05:56.238 [Cloud] Queued cloud request. 2026-09-13T09:05:56.238 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T09:05:56.253 [Cloud] Dequeued cloud request. 2026-09-13T09:05:56.253 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T09:05:56.409 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1FC471EA-B6C1-8321-D906-F665CFD1F9FA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 09:05:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T09:05:56.909 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T09:09:27.894 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T09:10:02.440 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T09:10:02.440 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T09:10:02.440 [Cloud] Queued cloud request. 2026-09-13T09:10:02.440 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T09:10:02.440 [Cloud] Dequeued cloud request. 2026-09-13T09:10:02.440 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T09:10:02.644 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C8BBB057-F6DA-9F3F-24F5-0C6EEABA4FB1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 09:10:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T09:10:03.144 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T09:13:43.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T09:13:43.097 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T09:13:43.097 [Cloud] Queued cloud request. 2026-09-13T09:13:43.097 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T09:13:43.097 [Cloud] Dequeued cloud request. 2026-09-13T09:13:43.112 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T09:13:43.269 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3A87CD76-B9F4-32CE-8700-08E9E2C8730B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 09:13:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T09:13:43.769 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T09:24:32.893 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T09:28:45.721 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 33745, Count: 2281, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-13T09:28:45.721 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 16440, Count: 870, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-13T09:28:45.721 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 10316, Count: 574, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T09:28:45.721 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-13T09:28:45.721 ProcessImageName: AgentShellService.exe, Pid: 6296, TotalTime: 822, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-13T09:28:45.721 ProcessImageName: WmiPrvSE.exe, Pid: 3240, TotalTime: 738, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-13T09:28:45.721 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 654, Count: 37, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-13T09:28:45.721 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-13T09:28:45.721 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T09:28:45.721 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-13T09:28:45.721 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 62, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-133bc-7c.MAI, EstimatedImpact: 0% 2026-09-13T09:28:45.721 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T09:28:45.721 ProcessImageName: taskhostw.exe, Pid: 5764, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-13T09:28:45.721 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-13T09:28:45.721 ProcessImageName: DeviceCensus.exe, Pid: 5920, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-13T09:28:45.721 ProcessImageName: powershell.exe, Pid: 4628, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-13T09:28:45.721 ProcessImageName: cmd.exe, Pid: 7724, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-13T09:28:45.721 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-13T09:28:45.721 ProcessImageName: mysqldump.exe, Pid: 3412, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 9% 2026-09-13T09:28:45.721 ProcessImageName: powershell.exe, Pid: 4620, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpA408.tmp, EstimatedImpact: 0% 2026-09-13T09:28:45.721 ProcessImageName: ngentask.exe, Pid: 1468, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-13T09:28:45.721 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-13T09:30:45.799 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T09:30:45.799 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T09:30:45.799 [Cloud] Queued cloud request. 2026-09-13T09:30:45.799 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T09:30:45.799 [Cloud] Dequeued cloud request. 2026-09-13T09:30:45.799 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T09:30:45.955 [Cloud] End of cloud request. 2026-09-13T09:30:46.455 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T09:39:37.892 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T09:44:23.907 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T09:44:23.907 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T09:44:23.907 [Cloud] Queued cloud request. 2026-09-13T09:44:23.907 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T09:44:23.907 [Cloud] Dequeued cloud request. 2026-09-13T09:44:23.907 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T09:44:24.064 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25B2A462-B4D5-1641-7C2F-160A6F68A13D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 09:44:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T09:44:24.579 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T09:46:08.892 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T09:46:08.892 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T09:46:08.892 [Cloud] Queued cloud request. 2026-09-13T09:46:08.892 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T09:46:08.892 [Cloud] Dequeued cloud request. 2026-09-13T09:46:08.892 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T09:46:09.048 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F10BB950-AE74-A162-AF2C-F5DE3E53C8E5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 09:46:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T09:46:09.564 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T09:54:42.892 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T10:09:47.891 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T10:10:01.563 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T10:10:01.563 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T10:10:01.563 [Cloud] Queued cloud request. 2026-09-13T10:10:01.563 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T10:10:01.563 [Cloud] Dequeued cloud request. 2026-09-13T10:10:01.563 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T10:10:01.766 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C9648771-69F2-22F8-0D9F-351A6ED1EAFC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 10:10:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T10:10:02.266 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T10:24:52.890 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T10:28:38.530 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T10:28:38.530 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T10:28:38.530 [Cloud] Queued cloud request. 2026-09-13T10:28:38.530 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T10:28:38.530 [Cloud] Dequeued cloud request. 2026-09-13T10:28:38.530 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T10:28:38.734 [Cloud] End of cloud request. 2026-09-13T10:28:39.234 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T10:35:50.015 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T10:35:50.015 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T10:35:50.015 [Cloud] Queued cloud request. 2026-09-13T10:35:50.015 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T10:35:50.015 [Cloud] Dequeued cloud request. 2026-09-13T10:35:50.015 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T10:35:50.202 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9E8617A5-DB08-3311-D89A-719D0FDA5ACD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 10:35:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T10:35:50.718 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T10:39:57.889 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T10:41:17.702 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T10:41:17.702 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T10:41:17.702 [Cloud] Queued cloud request. 2026-09-13T10:41:17.702 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T10:41:17.702 [Cloud] Dequeued cloud request. 2026-09-13T10:41:17.702 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T10:41:17.874 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DBE73655-1DBA-CEFF-9704-A4A9C4F90DDE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 10:41:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T10:41:18.374 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T10:55:02.889 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T11:10:07.888 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T11:25:12.887 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T11:28:01.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T11:28:01.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T11:28:01.387 [Cloud] Queued cloud request. 2026-09-13T11:28:01.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T11:28:01.387 [Cloud] Dequeued cloud request. 2026-09-13T11:28:01.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T11:28:11.497 [Cloud] End of cloud request. 2026-09-13T11:28:11.997 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T11:28:45.715 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 37623, Count: 2535, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-13T11:28:45.715 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 20037, Count: 1070, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-13T11:28:45.715 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 10316, Count: 574, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T11:28:45.715 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-13T11:28:45.715 ProcessImageName: AgentShellService.exe, Pid: 6296, TotalTime: 822, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-13T11:28:45.715 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 807, Count: 43, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-13T11:28:45.715 ProcessImageName: WmiPrvSE.exe, Pid: 3240, TotalTime: 738, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-13T11:28:45.715 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-13T11:28:45.715 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T11:28:45.715 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-13T11:28:45.715 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 150, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-133bc-7c.MAI, EstimatedImpact: 0% 2026-09-13T11:28:45.715 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T11:28:45.715 ProcessImageName: taskhostw.exe, Pid: 5764, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-13T11:28:45.715 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-13T11:28:45.715 ProcessImageName: DeviceCensus.exe, Pid: 5920, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-13T11:28:45.715 ProcessImageName: powershell.exe, Pid: 4628, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-13T11:28:45.715 ProcessImageName: cmd.exe, Pid: 7724, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-13T11:28:45.715 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-13T11:28:45.715 ProcessImageName: mysqldump.exe, Pid: 3412, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 9% 2026-09-13T11:28:45.715 ProcessImageName: powershell.exe, Pid: 4620, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpA408.tmp, EstimatedImpact: 0% 2026-09-13T11:28:45.715 ProcessImageName: ngentask.exe, Pid: 1468, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-13T11:28:45.715 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-13T11:30:24.012 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T11:30:24.012 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T11:30:24.012 [Cloud] Queued cloud request. 2026-09-13T11:30:24.012 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T11:30:24.200 [Cloud] Dequeued cloud request. 2026-09-13T11:30:24.200 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T11:30:24.340 [Cloud] End of cloud request. 2026-09-13T11:30:24.840 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T11:31:17.637 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T11:31:17.637 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T11:31:17.637 [Cloud] Queued cloud request. 2026-09-13T11:31:17.637 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T11:31:17.637 [Cloud] Dequeued cloud request. 2026-09-13T11:31:17.637 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T11:31:17.731 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{02A20DF2-10A4-2233-2109-2CA192A8FF4E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 11:31:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T11:31:18.231 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T11:33:24.903 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T11:33:24.903 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T11:33:24.903 [Cloud] Queued cloud request. 2026-09-13T11:33:24.903 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T11:33:24.903 [Cloud] Dequeued cloud request. 2026-09-13T11:33:24.903 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T11:33:25.059 [Cloud] End of cloud request. 2026-09-13T11:33:25.559 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T11:40:17.887 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T11:45:50.027 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T11:45:50.027 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T11:45:50.027 [Cloud] Queued cloud request. 2026-09-13T11:45:50.027 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T11:45:50.027 [Cloud] Dequeued cloud request. 2026-09-13T11:45:50.262 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T11:45:50.465 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{260CC6F4-0AAF-A3C3-251A-CF4DE51E845C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 11:45:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T11:45:50.965 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T11:49:03.480 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T11:49:03.480 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T11:49:03.480 [Cloud] Queued cloud request. 2026-09-13T11:49:03.480 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T11:49:03.480 [Cloud] Dequeued cloud request. 2026-09-13T11:49:03.480 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T11:49:03.668 [Cloud] End of cloud request. 2026-09-13T11:49:04.168 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T11:55:01.089 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T11:55:01.089 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T11:55:01.089 [Cloud] Queued cloud request. 2026-09-13T11:55:01.089 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T11:55:01.089 [Cloud] Dequeued cloud request. 2026-09-13T11:55:01.089 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T11:55:01.277 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8EE06799-F21F-2DBF-2803-EBF884CA7BAF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 11:55:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T11:55:01.777 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T11:55:22.886 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T12:03:36.448 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T12:03:36.448 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T12:03:36.448 [Cloud] Queued cloud request. 2026-09-13T12:03:36.448 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T12:03:36.448 [Cloud] Dequeued cloud request. 2026-09-13T12:03:36.448 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T12:03:36.667 [Cloud] End of cloud request. 2026-09-13T12:03:37.167 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T12:06:37.120 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T12:06:37.120 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T12:06:37.120 [Cloud] Queued cloud request. 2026-09-13T12:06:37.120 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T12:06:37.120 [Cloud] Dequeued cloud request. 2026-09-13T12:06:37.120 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T12:06:37.308 [Cloud] End of cloud request. 2026-09-13T12:06:37.823 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T12:10:27.886 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T12:21:38.323 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T12:21:38.323 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T12:21:38.323 [Cloud] Queued cloud request. 2026-09-13T12:21:38.323 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T12:21:38.323 [Cloud] Dequeued cloud request. 2026-09-13T12:21:38.323 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T12:21:38.541 [Cloud] End of cloud request. 2026-09-13T12:21:39.041 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T12:22:53.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T12:22:53.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T12:22:53.604 [Cloud] Queued cloud request. 2026-09-13T12:22:53.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T12:22:53.713 [Cloud] Dequeued cloud request. 2026-09-13T12:22:53.713 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T12:22:53.885 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B16C690B-6B38-658B-25DE-9659D4B34B74} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 12:22:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T12:22:54.385 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T12:24:22.041 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T12:24:22.041 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T12:24:22.041 [Cloud] Queued cloud request. 2026-09-13T12:24:22.041 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T12:24:22.041 [Cloud] Dequeued cloud request. 2026-09-13T12:24:22.041 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T12:24:22.245 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5FF97374-A8B5-783F-0D1F-425008A39FB8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 12:24:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T12:24:22.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T12:25:32.885 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T12:29:22.291 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T12:29:22.291 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T12:29:22.291 [Cloud] Queued cloud request. 2026-09-13T12:29:22.291 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T12:29:22.291 [Cloud] Dequeued cloud request. 2026-09-13T12:29:22.291 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T12:29:22.494 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{493DE4BC-373D-0376-C8D5-8866AB8EAA88} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 12:29:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T12:29:22.994 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T12:33:13.400 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T12:33:13.400 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T12:33:13.400 [Cloud] Queued cloud request. 2026-09-13T12:33:13.400 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T12:33:13.400 [Cloud] Dequeued cloud request. 2026-09-13T12:33:13.400 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T12:33:13.572 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{67AA90A2-B8FE-7E6D-5D64-31D1BFD0E3D3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 12:33:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T12:33:14.088 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T12:40:37.884 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T12:50:32.103 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T12:50:32.103 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T12:50:32.103 [Cloud] Queued cloud request. 2026-09-13T12:50:32.103 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T12:50:32.103 [Cloud] Dequeued cloud request. 2026-09-13T12:50:32.103 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T12:50:32.306 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C891EDBD-D4FE-46D0-6E33-47C5F9E134DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 12:50:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T12:50:32.806 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T12:55:42.884 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T13:10:47.883 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T13:18:43.133 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T13:18:43.133 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T13:18:43.133 [Cloud] Queued cloud request. 2026-09-13T13:18:43.133 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T13:18:43.133 [Cloud] Dequeued cloud request. 2026-09-13T13:18:43.133 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T13:18:43.336 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1A26831D-A8E4-23BC-3E70-BDD1438AD4DF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 13:18:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T13:18:43.836 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T13:25:52.883 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T13:28:45.727 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 37777, Count: 2541, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-13T13:28:45.727 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 23619, Count: 1270, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-13T13:28:45.727 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 10316, Count: 574, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T13:28:45.727 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-13T13:28:45.727 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 913, Count: 49, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-13T13:28:45.727 ProcessImageName: AgentShellService.exe, Pid: 6296, TotalTime: 822, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-13T13:28:45.727 ProcessImageName: WmiPrvSE.exe, Pid: 3240, TotalTime: 738, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-13T13:28:45.727 ProcessImageName: WmiPrvSE.exe, Pid: 6476, TotalTime: 361, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-13T13:28:45.727 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-13T13:28:45.727 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T13:28:45.727 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 181, Count: 66, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14186-0.MAI, EstimatedImpact: 0% 2026-09-13T13:28:45.727 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-13T13:28:45.727 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T13:28:45.727 ProcessImageName: taskhostw.exe, Pid: 5764, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-13T13:28:45.727 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-13T13:28:45.727 ProcessImageName: DeviceCensus.exe, Pid: 5920, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-13T13:28:45.727 ProcessImageName: powershell.exe, Pid: 4628, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-13T13:28:45.727 ProcessImageName: cmd.exe, Pid: 7724, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-13T13:28:45.727 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-13T13:28:45.727 ProcessImageName: mysqldump.exe, Pid: 3412, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 9% 2026-09-13T13:28:45.727 ProcessImageName: powershell.exe, Pid: 4620, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpA408.tmp, EstimatedImpact: 0% 2026-09-13T13:28:45.727 ProcessImageName: ngentask.exe, Pid: 1468, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-13T13:28:45.727 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-13T13:40:57.883 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T13:56:02.882 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T13:59:45.788 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T13:59:45.788 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T13:59:45.788 [Cloud] Queued cloud request. 2026-09-13T13:59:45.788 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T13:59:45.788 [Cloud] Dequeued cloud request. 2026-09-13T13:59:45.788 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T13:59:45.991 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B36E2F52-BAC1-C948-D06F-E902D3D01C4C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 13:59:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T13:59:46.491 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T14:04:48.444 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T14:04:48.444 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T14:04:48.444 [Cloud] Queued cloud request. 2026-09-13T14:04:48.444 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T14:04:48.444 [Cloud] Dequeued cloud request. 2026-09-13T14:04:48.444 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T14:04:48.632 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{27440017-5447-0389-FD59-C7A59E8CE430} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 14:04:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T14:04:49.148 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T14:11:07.882 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T14:16:35.100 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T14:16:35.100 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T14:16:35.100 [Cloud] Queued cloud request. 2026-09-13T14:16:35.100 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T14:16:35.100 [Cloud] Dequeued cloud request. 2026-09-13T14:16:35.100 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T14:16:35.413 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FCCAAAE7-3F8F-36F4-1005-65BFF2336765} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 14:16:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T14:16:35.913 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T14:26:07.131 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T14:26:07.131 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T14:26:07.131 [Cloud] Queued cloud request. 2026-09-13T14:26:07.131 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T14:26:07.131 [Cloud] Dequeued cloud request. 2026-09-13T14:26:07.131 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T14:26:07.319 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DB287DAC-8FCE-9869-D431-3F7E53235FDB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 14:26:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T14:26:07.819 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T14:26:12.881 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T14:34:43.178 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T14:34:43.178 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T14:34:43.178 [Cloud] Queued cloud request. 2026-09-13T14:34:43.178 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T14:34:43.178 [Cloud] Dequeued cloud request. 2026-09-13T14:34:43.178 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T14:34:43.381 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{139C5908-649E-CDB4-B82B-A9BAB86ED571} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 14:34:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T14:34:43.881 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T14:41:17.881 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T14:44:45.850 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T14:44:45.850 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T14:44:45.850 [Cloud] Queued cloud request. 2026-09-13T14:44:45.850 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T14:44:45.850 [Cloud] Dequeued cloud request. 2026-09-13T14:44:45.850 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T14:44:46.037 [Cloud] End of cloud request. 2026-09-13T14:44:46.553 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T14:44:57.084 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T14:44:57.084 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T14:44:57.084 [Cloud] Queued cloud request. 2026-09-13T14:44:57.084 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T14:44:57.084 [Cloud] Dequeued cloud request. 2026-09-13T14:44:57.084 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T14:44:57.178 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E3FE8696-C854-64E0-89BB-AB10CF63A1A1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 14:44:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T14:44:57.678 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T14:45:10.678 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T14:45:10.678 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T14:45:10.678 [Cloud] Queued cloud request. 2026-09-13T14:45:10.678 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T14:45:10.678 [Cloud] Dequeued cloud request. 2026-09-13T14:45:10.678 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T14:45:10.756 [Cloud] End of cloud request. 2026-09-13T14:45:11.272 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T14:54:13.740 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T14:54:13.740 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T14:54:13.740 [Cloud] Queued cloud request. 2026-09-13T14:54:13.740 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T14:54:13.740 [Cloud] Dequeued cloud request. 2026-09-13T14:54:13.740 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T14:54:13.928 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5DE1FD72-F66B-647F-7101-8D571ADBD0D7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 14:54:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T14:54:14.428 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T14:56:22.881 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T14:58:42.443 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T14:58:42.443 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T14:58:42.443 [Cloud] Queued cloud request. 2026-09-13T14:58:42.443 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T14:58:42.443 [Cloud] Dequeued cloud request. 2026-09-13T14:58:42.443 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T14:58:42.630 [Cloud] End of cloud request. 2026-09-13T14:58:43.146 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T15:11:27.880 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T15:11:58.146 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T15:11:58.146 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T15:11:58.146 [Cloud] Queued cloud request. 2026-09-13T15:11:58.146 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T15:11:58.146 [Cloud] Dequeued cloud request. 2026-09-13T15:11:58.146 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T15:11:58.287 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8F64427C-DA50-A9DE-77A6-49A9E06A3E75} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 15:11:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T15:11:58.802 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T15:12:49.052 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T15:12:49.052 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T15:12:49.052 [Cloud] Queued cloud request. 2026-09-13T15:12:49.052 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T15:12:49.052 [Cloud] Dequeued cloud request. 2026-09-13T15:12:49.052 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T15:12:49.130 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A16F0894-2A0F-5236-F03F-9F1E0E9E19C8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 15:12:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T15:12:49.646 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T15:18:50.146 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T15:18:50.146 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T15:18:50.146 [Cloud] Queued cloud request. 2026-09-13T15:18:50.146 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T15:18:50.146 [Cloud] Dequeued cloud request. 2026-09-13T15:18:50.146 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T15:18:50.286 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CB59809E-02D1-CAA5-0106-55A9E42EAA39} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 15:18:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T15:18:50.786 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T15:21:15.130 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T15:21:15.130 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T15:21:15.130 [Cloud] Queued cloud request. 2026-09-13T15:21:15.130 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T15:21:15.380 [Cloud] Dequeued cloud request. 2026-09-13T15:21:15.380 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{2159FBBD-A026-CD1E-E6C4-D191EDF1D705} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 15:21:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T15:21:15.521 [Cloud] End of cloud request. 2026-09-13T15:21:16.021 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T15:21:48.286 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T15:21:48.286 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T15:21:48.286 [Cloud] Queued cloud request. 2026-09-13T15:21:48.286 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T15:21:48.286 [Cloud] Dequeued cloud request. 2026-09-13T15:21:48.286 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T15:21:48.380 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{31E3DCB3-FC4D-95A5-9904-673D326EB564} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 15:21:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T15:21:48.880 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T15:26:32.880 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T15:27:42.989 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T15:27:42.989 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T15:27:42.989 [Cloud] Queued cloud request. 2026-09-13T15:27:42.989 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T15:27:42.989 [Cloud] Dequeued cloud request. 2026-09-13T15:27:42.989 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T15:27:43.177 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1358247A-5542-6C95-6D28-159BCAE14CDE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 15:27:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T15:27:43.677 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T15:28:45.724 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 42353, Count: 2776, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-13T15:28:45.724 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 27604, Count: 1469, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-13T15:28:45.724 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 10316, Count: 574, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T15:28:45.724 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-13T15:28:45.724 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 989, Count: 53, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-13T15:28:45.724 ProcessImageName: AgentShellService.exe, Pid: 6296, TotalTime: 822, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-13T15:28:45.724 ProcessImageName: WmiPrvSE.exe, Pid: 3240, TotalTime: 738, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-13T15:28:45.724 ProcessImageName: WmiPrvSE.exe, Pid: 6476, TotalTime: 361, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-13T15:28:45.724 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-13T15:28:45.724 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T15:28:45.724 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 226, Count: 72, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14186-0.MAI, EstimatedImpact: 0% 2026-09-13T15:28:45.724 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-13T15:28:45.724 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T15:28:45.724 ProcessImageName: taskhostw.exe, Pid: 5764, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-13T15:28:45.724 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-13T15:28:45.724 ProcessImageName: DeviceCensus.exe, Pid: 5920, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-13T15:28:45.724 ProcessImageName: powershell.exe, Pid: 4628, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-13T15:28:45.724 ProcessImageName: cmd.exe, Pid: 7724, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-13T15:28:45.724 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-13T15:28:45.724 ProcessImageName: mysqldump.exe, Pid: 3412, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 9% 2026-09-13T15:28:45.724 ProcessImageName: powershell.exe, Pid: 4620, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpA408.tmp, EstimatedImpact: 0% 2026-09-13T15:28:45.724 ProcessImageName: ngentask.exe, Pid: 1468, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-13T15:28:45.724 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-13T15:41:37.880 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T15:43:19.551 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T15:43:19.551 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T15:43:19.551 [Cloud] Queued cloud request. 2026-09-13T15:43:19.551 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T15:43:19.551 [Cloud] Dequeued cloud request. 2026-09-13T15:43:19.551 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T15:43:19.739 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D93F97C6-FE5B-F35B-6E20-057EB43F1A89} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 15:43:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T15:43:20.239 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T15:53:52.911 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T15:53:52.911 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T15:53:52.911 [Cloud] Queued cloud request. 2026-09-13T15:53:52.911 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T15:53:52.911 [Cloud] Dequeued cloud request. 2026-09-13T15:53:52.911 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T15:53:53.129 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B86E1C82-9400-8DF5-E99B-980A41A11768} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 15:53:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T15:53:53.645 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T15:55:42.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T15:55:42.145 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T15:55:42.145 [Cloud] Queued cloud request. 2026-09-13T15:55:42.145 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T15:55:42.145 [Cloud] Dequeued cloud request. 2026-09-13T15:55:42.145 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T15:55:42.332 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E2D03333-BB37-2C42-21FA-BE17231585BE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 15:55:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T15:55:42.832 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T15:56:42.879 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T16:04:31.457 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14228-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5310991, FileId: 0x200000000391f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T16:04:31.473 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14228-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5310990, FileId: 0x1d00000003920e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T16:08:56.067 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T16:08:56.067 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T16:08:56.067 [Cloud] Queued cloud request. 2026-09-13T16:08:56.067 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T16:08:56.067 [Cloud] Dequeued cloud request. 2026-09-13T16:08:56.067 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T16:09:06.160 [Cloud] End of cloud request. 2026-09-13T16:09:06.660 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T16:11:47.879 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T16:13:14.379 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T16:13:14.379 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T16:13:14.379 [Cloud] Queued cloud request. 2026-09-13T16:13:14.379 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T16:13:14.379 [Cloud] Dequeued cloud request. 2026-09-13T16:13:14.379 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T16:13:14.582 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2A80499C-9824-86A7-4249-3BD548B92C68} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 16:13:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T16:13:15.082 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T16:26:52.879 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T16:31:17.176 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T16:31:17.176 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T16:31:17.176 [Cloud] Queued cloud request. 2026-09-13T16:31:17.176 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T16:31:17.176 [Cloud] Dequeued cloud request. 2026-09-13T16:31:17.176 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T16:31:17.316 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{22C69D75-24BA-DF93-9DEC-393702AE4CE6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 16:31:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T16:31:17.832 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T16:32:51.457 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T16:32:51.457 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T16:32:51.457 [Cloud] Queued cloud request. 2026-09-13T16:32:51.457 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T16:32:51.457 [Cloud] Dequeued cloud request. 2026-09-13T16:32:51.457 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T16:32:51.597 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{48FF6857-8C83-9E1B-2D2C-B8627F41E2E7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 16:32:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T16:32:52.097 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T16:37:56.878 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T16:37:56.878 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T16:37:56.878 [Cloud] Queued cloud request. 2026-09-13T16:37:56.878 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T16:37:56.878 [Cloud] Dequeued cloud request. 2026-09-13T16:37:56.878 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T16:37:57.035 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F1920BB6-EF68-82F8-93C2-833ECFEB2E88} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 16:37:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T16:37:57.535 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T16:41:57.878 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T16:53:38.581 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T16:53:38.581 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T16:53:38.581 [Cloud] Queued cloud request. 2026-09-13T16:53:38.581 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T16:53:38.581 [Cloud] Dequeued cloud request. 2026-09-13T16:53:38.581 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T16:53:38.753 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6FCF76C7-54B8-3DD7-3EF0-9CEE574171B6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 16:53:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T16:53:39.269 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T16:57:02.878 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T16:59:00.347 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14144-112.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5329206, FileId: 0x3a000000039220, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T16:59:00.347 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14144-112.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5329207, FileId: 0x2500000003753c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T16:59:00.956 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14144-113.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5329223, FileId: 0x3b000000039220, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T16:59:00.956 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14144-113.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5329224, FileId: 0x2600000003753c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T16:59:03.987 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14144-11f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5329251, FileId: 0x2700000003753c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T16:59:03.987 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14144-11f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5329250, FileId: 0x3c000000039220, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T16:59:04.003 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14144-120.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5329254, FileId: 0x3d000000039220, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T16:59:04.003 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14144-120.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5329255, FileId: 0x2800000003753c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-13T17:06:28.550 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T17:06:28.550 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T17:06:28.550 [Cloud] Queued cloud request. 2026-09-13T17:06:28.550 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T17:06:28.550 [Cloud] Dequeued cloud request. 2026-09-13T17:06:28.550 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T17:06:28.722 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{07F15E43-714F-30CD-35A3-8E9FFD83BFFA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 17:06:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T17:06:29.222 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T17:11:52.956 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T17:11:52.956 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T17:11:52.956 [Cloud] Queued cloud request. 2026-09-13T17:11:52.956 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T17:11:52.956 [Cloud] Dequeued cloud request. 2026-09-13T17:11:52.972 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T17:11:53.112 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F8AD5BE8-3076-2293-FB4A-8F578200F609} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 17:11:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T17:11:53.628 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T17:12:07.878 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T17:18:20.799 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T17:18:20.799 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T17:18:20.799 [Cloud] Queued cloud request. 2026-09-13T17:18:20.799 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T17:18:21.065 [Cloud] Dequeued cloud request. 2026-09-13T17:18:21.331 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T17:18:21.549 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{50DB48CE-4FBD-6079-AD46-66D142D0DC86} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 17:18:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T17:18:22.049 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T17:27:12.877 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T17:28:39.455 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T17:28:39.455 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T17:28:39.455 [Cloud] Queued cloud request. 2026-09-13T17:28:39.455 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T17:28:39.455 [Cloud] Dequeued cloud request. 2026-09-13T17:28:39.455 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T17:28:39.658 [Cloud] End of cloud request. 2026-09-13T17:28:40.174 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T17:28:45.737 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 49101, Count: 3448, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-13T17:28:45.737 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 31770, Count: 1669, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-13T17:28:45.737 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 10316, Count: 574, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T17:28:45.737 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-13T17:28:45.737 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1035, Count: 55, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-13T17:28:45.737 ProcessImageName: AgentShellService.exe, Pid: 6296, TotalTime: 822, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-13T17:28:45.737 ProcessImageName: WmiPrvSE.exe, Pid: 3240, TotalTime: 738, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-13T17:28:45.737 ProcessImageName: WmiPrvSE.exe, Pid: 6476, TotalTime: 361, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-13T17:28:45.737 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-13T17:28:45.737 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 272, Count: 84, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14186-0.MAI, EstimatedImpact: 0% 2026-09-13T17:28:45.737 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T17:28:45.737 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-13T17:28:45.737 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T17:28:45.737 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 106, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-13T17:28:45.737 ProcessImageName: taskhostw.exe, Pid: 5764, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-13T17:28:45.737 ProcessImageName: DeviceCensus.exe, Pid: 5920, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-13T17:28:45.737 ProcessImageName: powershell.exe, Pid: 4628, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-13T17:28:45.737 ProcessImageName: cmd.exe, Pid: 7724, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-13T17:28:45.737 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-13T17:28:45.737 ProcessImageName: mysqldump.exe, Pid: 3412, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 9% 2026-09-13T17:28:45.737 ProcessImageName: powershell.exe, Pid: 4620, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpA408.tmp, EstimatedImpact: 0% 2026-09-13T17:28:45.737 ProcessImageName: ngentask.exe, Pid: 1468, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-13T17:28:45.737 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-13T17:42:17.877 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T17:42:51.689 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T17:42:51.689 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T17:42:51.689 [Cloud] Queued cloud request. 2026-09-13T17:42:51.689 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T17:42:51.689 [Cloud] Dequeued cloud request. 2026-09-13T17:42:51.689 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T17:42:51.861 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AE453FBA-221D-9743-37B3-DC14D2A55B3B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 17:42:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T17:42:52.361 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T17:45:52.751 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T17:45:52.751 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T17:45:52.751 [Cloud] Queued cloud request. 2026-09-13T17:45:52.751 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T17:45:52.751 [Cloud] Dequeued cloud request. 2026-09-13T17:45:52.751 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T17:45:52.892 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{109B92CA-43A8-4584-C2EB-35B84B88EDAC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 17:45:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T17:45:53.392 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T17:57:22.876 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T18:07:37.313 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T18:07:37.313 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T18:07:37.313 [Cloud] Queued cloud request. 2026-09-13T18:07:37.313 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T18:07:37.313 [Cloud] Dequeued cloud request. 2026-09-13T18:07:37.313 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T18:07:37.485 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8A4052DF-F10B-22F5-8D4C-C34D4A3364A3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 18:07:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T18:07:37.985 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T18:12:27.875 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T18:27:32.874 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T18:32:05.234 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T18:32:05.234 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T18:32:05.234 [Cloud] Queued cloud request. 2026-09-13T18:32:05.234 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T18:32:05.234 [Cloud] Dequeued cloud request. 2026-09-13T18:32:05.249 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T18:32:05.421 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F5292296-FD16-87A6-2E0C-A427E5A15AAA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 18:32:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T18:32:05.921 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T18:38:27.686 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T18:38:27.686 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T18:38:27.686 [Cloud] Queued cloud request. 2026-09-13T18:38:27.686 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T18:38:27.874 [Cloud] Dequeued cloud request. 2026-09-13T18:38:27.874 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T18:38:28.046 [Cloud] End of cloud request. 2026-09-13T18:38:28.546 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T18:41:28.733 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T18:41:28.733 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T18:41:28.733 [Cloud] Queued cloud request. 2026-09-13T18:41:28.733 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T18:41:28.733 [Cloud] Dequeued cloud request. 2026-09-13T18:41:28.733 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T18:41:28.921 [Cloud] End of cloud request. 2026-09-13T18:41:29.421 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T18:42:37.874 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T18:50:53.889 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T18:50:53.889 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T18:50:53.889 [Cloud] Queued cloud request. 2026-09-13T18:50:53.889 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T18:50:53.889 [Cloud] Dequeued cloud request. 2026-09-13T18:50:54.061 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T18:50:54.248 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E027BE9B-738B-7691-A207-3FAB9158D942} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 18:50:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T18:50:54.764 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T18:51:06.092 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T18:51:06.092 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T18:51:06.092 [Cloud] Queued cloud request. 2026-09-13T18:51:06.092 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T18:51:06.092 [Cloud] Dequeued cloud request. 2026-09-13T18:51:06.092 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T18:51:06.170 [Cloud] End of cloud request. 2026-09-13T18:51:06.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T18:56:29.201 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T18:56:29.201 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T18:56:29.201 [Cloud] Queued cloud request. 2026-09-13T18:56:29.201 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T18:56:29.201 [Cloud] Dequeued cloud request. 2026-09-13T18:56:29.201 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T18:56:29.389 [Cloud] End of cloud request. 2026-09-13T18:56:29.889 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T18:57:42.873 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T19:00:22.170 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:00:22.170 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:00:22.170 [Cloud] Queued cloud request. 2026-09-13T19:00:22.170 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:00:22.170 [Cloud] Dequeued cloud request. 2026-09-13T19:00:22.170 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:00:22.357 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5E500A5A-7409-159F-C1BB-46EBD9E8C73E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:00:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:00:22.857 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:00:47.014 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:00:47.014 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:00:47.014 [Cloud] Queued cloud request. 2026-09-13T19:00:47.014 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:00:47.014 [Cloud] Dequeued cloud request. 2026-09-13T19:00:47.014 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:00:47.107 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F297CCF-77FC-93E5-93A7-216F1C5DAA43} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:00:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:00:47.623 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:04:41.732 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:04:41.732 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:04:41.732 [Cloud] Queued cloud request. 2026-09-13T19:04:41.732 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:04:41.732 [Cloud] Dequeued cloud request. 2026-09-13T19:04:41.732 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:04:41.920 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{573998CA-58BB-202A-D166-B1537FAC6A45} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:04:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:04:42.420 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:05:02.451 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:05:02.451 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:05:02.451 [Cloud] Queued cloud request. 2026-09-13T19:05:02.451 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:05:02.451 [Cloud] Dequeued cloud request. 2026-09-13T19:05:02.451 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:05:02.529 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{499321DB-3D50-90B6-072B-C26F5A8ECDB0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:05:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:05:03.029 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:10:19.513 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:10:19.513 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:10:19.513 [Cloud] Queued cloud request. 2026-09-13T19:10:19.513 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:10:19.513 [Cloud] Dequeued cloud request. 2026-09-13T19:10:19.513 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:10:19.685 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C3CE8CCC-9EFA-DA60-712C-053E9F3EA3A5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:10:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:10:20.201 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:12:47.873 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T19:23:00.810 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:23:00.810 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:23:00.810 [Cloud] Queued cloud request. 2026-09-13T19:23:00.810 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:23:00.810 [Cloud] Dequeued cloud request. 2026-09-13T19:23:00.810 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:23:00.997 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{453EFE4F-6804-F1B6-DA61-34CEEFE20D71} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:23:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:23:01.497 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:26:42.684 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:26:42.684 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:26:42.684 [Cloud] Queued cloud request. 2026-09-13T19:26:42.684 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:26:42.684 [Cloud] Dequeued cloud request. 2026-09-13T19:26:42.684 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:26:42.872 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9047954B-A71A-5666-6E9E-20B2C2C7747A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:26:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:26:43.372 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:27:52.872 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T19:28:17.872 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-13T19:28:17.903 Job Notification: New process added to job (7388) 2026-09-13T19:28:17.919 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-13T19:28:17.919 Aggressive catchup quick scan threshold: 692444146255 / 25920000000000 2026-09-13T19:28:17.919 Job Notification: New process added to job (7748) 2026-09-13T19:28:17.934 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:7388] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7748]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-13T19:28:18.090 Job Notification: New process added to job (6504) 2026-09-13T19:28:18.090 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-13T19:28:18.090 Job Notification: New process added to job (1840) 2026-09-13T19:28:18.137 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:6504] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:1840]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-13T19:28:18.262 Job Notification: New process added to job (3348) 2026-09-13T19:28:18.278 Task(GetDeviceTicket -AccessKey B536FF45-1683-87B3-08CD-0E5C7F5B6B41 ) launched as network service 2026-09-13T19:28:18.434 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-13T19:28:18.434 [RTP] Duplicating the current plugin configuration object... 2026-09-13T19:28:18.434 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-13T19:28:18.434 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-13T19:28:18.434 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-13T19:28:18.434 [RTP] No config change detected. Not updating plugin configuration. 2026-09-13T19:28:18.434 [RTP] No config changes found. No configuration switch. 2026-09-13T19:28:18.434 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-13T19:28:18.934 Job Notification: Process exited from job (3348) 2026-09-13T19:28:19.075 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-13T19:28:19.075 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:28:19.075 [Cloud] Queued cloud request. 2026-09-13T19:28:19.075 [Cloud] Dequeued cloud request. 2026-09-13T19:28:19.075 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:28:19.262 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-13T19:28:19.262 [Cloud] End of cloud request. 2026-09-13T19:28:19.590 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:28:33.106 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\E459084A-5A7C-4267-8CE6-D7DDC4C812DF860.1dd43b60f2160f2 2026-09-13T19:28:33.184 Verifying engine and signature files (source: 0) ... 2026-09-13T19:28:33.184 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D}\mpengine.dll] due to PPL. 2026-09-13T19:28:33.184 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D}\mpasbase.vdm]. File not in cache (0x1) 2026-09-13T19:28:34.169 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D}\mpasbase.vdm] 2026-09-13T19:28:34.184 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-13T19:28:34.184 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D}\mpasdlta.vdm] 2026-09-13T19:28:34.184 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D}\mpavbase.vdm]. File not in cache (0x1) 2026-09-13T19:28:34.622 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D}\mpavbase.vdm] 2026-09-13T19:28:34.622 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-13T19:28:34.637 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D}\mpavdlta.vdm] 2026-09-13T19:28:34.825 [Engine] IsHybridMode: 0 2026-09-13T19:28:34.825 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-13T19:28:34.840 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-BA26B2847B57C1EB51C00399AA85FC5A20F452B1.bin): 0x00000002 2026-09-13T19:28:34.840 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-BA26B2847B57C1EB51C00399AA85FC5A20F452B1.bin) 2026-09-13T19:28:34.840 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-13T19:28:34.840 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-13T19:28:34.840 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-13T19:28:34.840 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff 2026-09-13T19:28:45.747 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 49780, Count: 3469, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-13T19:28:45.747 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 35710, Count: 1869, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-13T19:28:45.747 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 10316, Count: 574, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T19:28:45.747 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-13T19:28:45.747 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1157, Count: 62, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-13T19:28:45.747 ProcessImageName: AgentShellService.exe, Pid: 6296, TotalTime: 822, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-13T19:28:45.747 ProcessImageName: WmiPrvSE.exe, Pid: 3240, TotalTime: 738, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-13T19:28:45.747 ProcessImageName: WmiPrvSE.exe, Pid: 6476, TotalTime: 361, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-13T19:28:45.747 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 287, Count: 86, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14186-0.MAI, EstimatedImpact: 0% 2026-09-13T19:28:45.747 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-13T19:28:45.747 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T19:28:45.747 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-13T19:28:45.747 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T19:28:45.747 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 106, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-13T19:28:45.747 ProcessImageName: taskhostw.exe, Pid: 5764, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-13T19:28:45.747 ProcessImageName: DeviceCensus.exe, Pid: 5920, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-13T19:28:45.747 ProcessImageName: powershell.exe, Pid: 4628, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-13T19:28:45.747 ProcessImageName: cmd.exe, Pid: 7724, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-13T19:28:45.747 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-13T19:28:45.747 ProcessImageName: mysqldump.exe, Pid: 3412, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 9% 2026-09-13T19:28:45.747 ProcessImageName: powershell.exe, Pid: 4620, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpA408.tmp, EstimatedImpact: 0% 2026-09-13T19:28:45.747 ProcessImageName: ngentask.exe, Pid: 1468, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-13T19:28:45.747 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-13T19:28:46.793 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-13T19:28:46.793 [AutoExclusion] Applied roles from cache. 2026-09-13T19:28:46.793 [AutoExclusion] Started roles monitoring. 2026-09-13T19:28:46.887 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF4ABB020, lRefCount: 6, hr=0 2026-09-13T19:28:46.887 [Engine] New active engine 00007FFCF68AB020 replacing engine 00007FFCF4ABB020. Number of active engines: 2 2026-09-13T19:28:46.903 EngineInit:Global ASOC is enabled 2026-09-13T19:28:46.903 EngineInit:ASOO is enabled for developer volumes 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.012 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-13T19:28:47.028 MpWriteUupSignatureVersion 1.459.193.0, hr = 0 2026-09-13T19:28:47.028 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-13T19:28:47.059 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-13T19:28:47.059 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-13T19:28:47.059 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-13T19:28:47.059 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-13T19:28:47.075 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-13T19:28:47.075 [Plugin] Initializing RTP plugin state... 2026-09-13T19:28:47.075 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-13T19:28:47.075 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎12‎-‎2026 21:28:46 Last Perf:‎09‎-‎12‎-‎2026 21:28:45 First RTP Scan:‎09‎-‎12‎-‎2026 21:28:46 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1519 Misses:9336 BM Queue:0,33,0 Proc:0,31,0 File:0,19,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:5378858 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:-1383297124 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:16975 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:766933 TotalHits:22471163 InstanceCacheInserts:453198 InstanceCacheUpdates:0 InstanceCacheDeletes:68574 InstanceCacheHits:16808 InstanceCacheMisses:801250 InstanceCacheOverflows:367691 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:5ms (8325/1482) Success: 1482, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-13T19:28:47.075 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D} 2026-09-13T19:28:47.075 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E}\mpasbase.vdm in use, hr=0x80070020 2026-09-13T19:28:47.075 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{39941C69-70E9-4030-AE52-6F574F0848EB} removed 2026-09-13T19:28:47.075 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-13T19:28:47.075 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-13T19:28:47.075 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-13T19:28:47.075 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-13T19:28:47.075 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-13T19:28:47.075 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-13-2026 19:28:47 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-13-2026 19:28:47 2026-09-13T19:28:47.090 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-13T19:28:47.090 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-13T19:28:47.090 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-13T19:28:47.090 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-13T19:28:47.090 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:28:47.090 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-13T19:28:47.090 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-13T19:28:47.090 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-13T19:28:47.090 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-13T19:28:47.090 MdCoreSvc is supported in this platform and OS Signature updated on 09-13-2026 19:28:47 Product Version: 4.18.26080.3 Service Version: 4.18.26080.3 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.193.0 AV Signature Version: 1.459.193.0 ************************************************************ 2026-09-13T19:28:47.106 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-13T19:28:47.106 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\E459084A-5A7C-4267-8CE6-D7DDC4C812DF860.1dd43b60f2160f2 2026-09-13T19:28:47.137 Process scan (postsignatureupdatescan) started. 2026-09-13T19:28:47.168 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-13T19:28:47.168 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-13-2026 19:28:47 ************************************************************ 2026-09-13T19:28:47.405 Job Notification: Process exited from job (6504) 2026-09-13T19:28:47.405 Job Notification: Process exited from job (1840) 2026-09-13T19:28:47.418 Job Notification: Process exited from job (7388) 2026-09-13T19:28:47.418 Job Notification: Process exited from job (7748) 2026-09-13T19:28:47.481 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-13T19:28:47.481 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-13T19:28:47.481 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-13T19:28:47.481 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-13T19:28:47.481 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-13T19:28:47.481 [Engine] Engine 00007FFCF4ABB020 no longer in use. Number of active engines: 1 2026-09-13T19:28:47.481 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-13T19:28:47.481 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-13T19:28:47.543 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-13T19:28:47.543 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-13T19:28:47.543 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-13T19:28:47.905 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 49780, Count: 3469, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-13T19:28:47.905 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 35710, Count: 1869, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-13T19:28:47.905 ProcessImageName: AgentShell.exe, Pid: 7872, TotalTime: 10316, Count: 574, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T19:28:47.905 ProcessImageName: powershell.exe, Pid: 4000, TotalTime: 1415, Count: 91, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 38% 2026-09-13T19:28:47.905 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1157, Count: 62, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-13T19:28:47.905 ProcessImageName: AgentShellService.exe, Pid: 6296, TotalTime: 822, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-13T19:28:47.905 ProcessImageName: WmiPrvSE.exe, Pid: 3240, TotalTime: 738, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-13T19:28:47.905 ProcessImageName: WmiPrvSE.exe, Pid: 6476, TotalTime: 361, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-13T19:28:47.905 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 287, Count: 86, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14186-0.MAI, EstimatedImpact: 0% 2026-09-13T19:28:47.905 ProcessImageName: powershell.exe, Pid: 7156, TotalTime: 278, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-13T19:28:47.905 ProcessImageName: WmiPrvSE.exe, Pid: 5080, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T19:28:47.905 ProcessImageName: python.exe, Pid: 4904, TotalTime: 181, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Certbot\renewal\gridtip.net.conf, EstimatedImpact: 6% 2026-09-13T19:28:47.905 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T19:28:47.905 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 106, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-13T19:28:47.965 [Engine] RSIG_UNLOADENGINE, 00007FFCF4ABB020, err=0x0 2026-09-13T19:28:48.012 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14D646BE-F29C-4459-9A0D-956EB683456E} removed 2026-09-13T19:28:53.028 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:28:53.028 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:28:53.028 [Cloud] Queued cloud request. 2026-09-13T19:28:53.028 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:28:53.028 [Cloud] Dequeued cloud request. 2026-09-13T19:28:53.028 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:28:53.122 [Cloud] End of cloud request. 2026-09-13T19:28:53.637 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:29:01.840 Process scan (postsignatureupdatescan) completed. 2026-09-13T19:33:46.965 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-13T19:34:54.684 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:34:54.684 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:34:54.684 [Cloud] Queued cloud request. 2026-09-13T19:34:54.684 [Cloud] Dequeued cloud request. 2026-09-13T19:34:54.684 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:34:54.699 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:34:57.606 [Cloud] End of cloud request. 2026-09-13T19:34:58.121 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:41:00.090 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:41:00.090 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:41:00.090 [Cloud] Queued cloud request. 2026-09-13T19:41:00.090 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:41:00.090 [Cloud] Dequeued cloud request. 2026-09-13T19:41:00.090 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:41:00.309 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{286F82DD-03DB-4403-3231-67BC6A729802} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:41:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:41:00.824 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:42:57.871 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T19:45:08.621 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:45:08.621 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:45:08.621 [Cloud] Queued cloud request. 2026-09-13T19:45:08.621 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:45:08.621 [Cloud] Dequeued cloud request. 2026-09-13T19:45:08.637 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:45:08.824 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CCF36AF6-181C-D410-9B92-8D3A5B19FB19} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:45:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:45:09.340 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:48:31.308 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:48:31.308 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:48:31.308 [Cloud] Queued cloud request. 2026-09-13T19:48:31.308 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:48:31.308 [Cloud] Dequeued cloud request. 2026-09-13T19:48:31.308 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:48:31.496 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FE2118AA-60D2-5D60-2785-2120C727C7BC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:48:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:48:31.996 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:50:06.589 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:50:06.589 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:50:06.589 [Cloud] Queued cloud request. 2026-09-13T19:50:06.589 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:50:06.589 [Cloud] Dequeued cloud request. 2026-09-13T19:50:06.589 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:50:06.777 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3C4A1B8A-FA57-3D45-B6B8-779F99CEA59E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:50:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:50:07.277 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:53:01.371 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:53:01.371 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:53:01.371 [Cloud] Queued cloud request. 2026-09-13T19:53:01.371 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:53:01.371 [Cloud] Dequeued cloud request. 2026-09-13T19:53:01.371 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:53:01.558 [Cloud] End of cloud request. 2026-09-13T19:53:02.074 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:54:44.558 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:54:44.558 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:54:44.558 [Cloud] Queued cloud request. 2026-09-13T19:54:44.558 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:54:44.558 [Cloud] Dequeued cloud request. 2026-09-13T19:54:44.558 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:54:44.730 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B2417997-3379-5DD1-B8F4-83A030C46354} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:54:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:54:45.246 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:55:35.886 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T19:55:35.886 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T19:55:35.886 [Cloud] Queued cloud request. 2026-09-13T19:55:35.886 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T19:55:35.886 [Cloud] Dequeued cloud request. 2026-09-13T19:55:35.886 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T19:55:35.964 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E226F979-1956-381D-9F78-9BA60740DE2B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 19:55:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T19:55:36.480 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T19:58:02.870 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T20:02:26.464 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T20:02:26.464 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T20:02:26.464 [Cloud] Queued cloud request. 2026-09-13T20:02:26.464 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T20:02:26.464 [Cloud] Dequeued cloud request. 2026-09-13T20:02:26.464 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T20:02:26.620 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F0390AD-817B-CE80-FE74-7D39FF5493D4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 20:02:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T20:02:27.120 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T20:06:06.838 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T20:06:06.838 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T20:06:06.838 [Cloud] Queued cloud request. 2026-09-13T20:06:06.838 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T20:06:06.838 [Cloud] Dequeued cloud request. 2026-09-13T20:06:06.838 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{206A1BAF-7C8F-F0C7-300C-2A6FFBC05AA9} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 20:06:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T20:06:16.948 [Cloud] End of cloud request. 2026-09-13T20:06:17.448 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T20:10:24.885 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T20:10:24.885 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T20:10:24.885 [Cloud] Queued cloud request. 2026-09-13T20:10:24.885 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T20:10:24.885 [Cloud] Dequeued cloud request. 2026-09-13T20:10:24.901 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T20:10:25.041 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{23CDC7C3-EAD4-0D67-19C3-C57409664119} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 20:10:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T20:10:25.557 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T20:12:40.729 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T20:12:40.729 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T20:12:40.729 [Cloud] Queued cloud request. 2026-09-13T20:12:40.729 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T20:12:40.729 [Cloud] Dequeued cloud request. 2026-09-13T20:12:40.729 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T20:12:40.885 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CA3B0C20-A0ED-4D3B-425F-E1B120615C0B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 20:12:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T20:12:41.401 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T20:13:07.870 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T20:17:02.948 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T20:17:02.948 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T20:17:02.948 [Cloud] Queued cloud request. 2026-09-13T20:17:02.948 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T20:17:02.948 [Cloud] Dequeued cloud request. 2026-09-13T20:17:02.948 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T20:17:03.151 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FA76AFE3-B8B6-05F8-FC61-AEFB217C52A1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 20:17:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T20:17:03.651 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T20:27:49.103 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T20:27:49.103 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T20:27:49.103 [Cloud] Queued cloud request. 2026-09-13T20:27:49.103 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T20:27:49.103 [Cloud] Dequeued cloud request. 2026-09-13T20:27:49.119 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T20:27:49.291 [Cloud] End of cloud request. 2026-09-13T20:27:49.806 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T20:28:12.869 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T20:36:22.181 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T20:36:22.181 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T20:36:22.181 [Cloud] Queued cloud request. 2026-09-13T20:36:22.181 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T20:36:22.181 [Cloud] Dequeued cloud request. 2026-09-13T20:36:22.181 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T20:36:22.337 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7DA42EB6-8E6E-BCFA-AB47-DFF5EB764A5D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 20:36:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T20:36:22.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T20:43:17.868 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T20:48:04.790 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T20:48:04.790 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T20:48:04.790 [Cloud] Queued cloud request. 2026-09-13T20:48:04.790 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T20:48:04.790 [Cloud] Dequeued cloud request. 2026-09-13T20:48:04.805 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T20:48:04.962 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B098A250-5DEB-F1C8-3808-B57AB8AA7B9F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 20:48:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T20:48:05.462 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T20:53:45.258 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T20:53:45.258 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T20:53:45.258 [Cloud] Queued cloud request. 2026-09-13T20:53:45.258 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T20:53:45.258 [Cloud] Dequeued cloud request. 2026-09-13T20:53:45.258 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T20:53:52.493 [Cloud] End of cloud request. 2026-09-13T20:53:52.993 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T20:56:43.055 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T20:56:43.071 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T20:56:43.071 [Cloud] Queued cloud request. 2026-09-13T20:56:43.071 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T20:56:43.071 [Cloud] Dequeued cloud request. 2026-09-13T20:56:43.071 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T20:56:43.243 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B89E72ED-07ED-C3B8-3CEB-CA57E0817F6C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 20:56:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T20:56:43.758 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T20:58:22.868 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T20:59:53.289 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T20:59:53.289 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T20:59:53.289 [Cloud] Queued cloud request. 2026-09-13T20:59:53.289 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T20:59:53.289 [Cloud] Dequeued cloud request. 2026-09-13T20:59:53.289 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T20:59:53.493 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{44435D14-8635-720A-8AE6-8795050F1B60} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 20:59:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T20:59:53.993 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T21:12:23.461 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T21:12:23.461 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T21:12:23.461 [Cloud] Queued cloud request. 2026-09-13T21:12:23.461 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T21:12:23.461 [Cloud] Dequeued cloud request. 2026-09-13T21:12:23.461 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T21:12:23.601 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{408E4BFA-AFA6-4198-C767-60DBB614111C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 21:12:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T21:12:24.101 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T21:13:27.867 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T21:15:04.836 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T21:15:04.836 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T21:15:04.836 [Cloud] Queued cloud request. 2026-09-13T21:15:04.836 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T21:15:04.836 [Cloud] Dequeued cloud request. 2026-09-13T21:15:04.836 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T21:15:04.976 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{74B3C2E7-387F-D780-3F4D-70BD49874587} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 21:15:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T21:15:05.492 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T21:19:37.476 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T21:19:37.476 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T21:19:37.476 [Cloud] Queued cloud request. 2026-09-13T21:19:37.476 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T21:19:37.492 [Cloud] Dequeued cloud request. 2026-09-13T21:19:37.492 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T21:19:37.648 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A34921BB-870B-918D-9A74-989F12EE96BE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 21:19:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T21:19:38.148 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T21:25:49.366 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T21:25:49.366 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T21:25:49.366 [Cloud] Queued cloud request. 2026-09-13T21:25:49.366 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T21:25:49.366 [Cloud] Dequeued cloud request. 2026-09-13T21:25:49.366 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T21:25:49.523 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{272524AE-697B-3C0A-F7EB-01B0CF5A5B08} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 21:25:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T21:25:50.038 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T21:27:46.757 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T21:27:46.757 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T21:27:46.757 [Cloud] Queued cloud request. 2026-09-13T21:27:46.757 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T21:27:46.757 [Cloud] Dequeued cloud request. 2026-09-13T21:27:46.757 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T21:27:46.913 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2BDDE5BC-AD56-F3D6-6859-F33EBA3858E7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 21:27:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T21:27:47.429 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T21:28:32.866 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T21:28:46.882 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 3825, Count: 200, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T21:28:46.882 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 1862, Count: 98, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\online-radios\KEXP\radio.php, EstimatedImpact: 0% 2026-09-13T21:28:46.882 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-13T21:28:46.882 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-13T21:28:46.882 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T21:28:46.882 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-13T21:28:46.882 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-13T21:28:46.882 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 90, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-13T21:28:46.882 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T21:28:46.882 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-13T21:29:23.710 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T21:29:23.710 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T21:29:23.710 [Cloud] Queued cloud request. 2026-09-13T21:29:23.710 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T21:29:23.866 [Cloud] Dequeued cloud request. 2026-09-13T21:29:24.069 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T21:29:24.210 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F55CF1E1-6992-59E0-1E38-0E11E902AC93} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 21:29:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T21:29:24.726 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T21:40:10.038 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T21:40:10.038 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T21:40:10.038 [Cloud] Queued cloud request. 2026-09-13T21:40:10.038 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T21:40:10.038 [Cloud] Dequeued cloud request. 2026-09-13T21:40:10.038 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T21:40:10.194 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DF704998-255D-F531-9BD1-F846A58224E0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 21:40:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T21:40:10.694 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T21:43:37.866 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T21:50:36.818 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T21:50:36.818 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T21:50:36.818 [Cloud] Queued cloud request. 2026-09-13T21:50:36.818 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T21:50:36.818 [Cloud] Dequeued cloud request. 2026-09-13T21:50:36.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T21:50:37.022 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{535E8F48-04A9-D062-176C-7A5FA2D16331} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 21:50:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T21:50:37.522 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T21:58:42.865 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T21:59:05.052 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T21:59:05.052 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T21:59:05.052 [Cloud] Queued cloud request. 2026-09-13T21:59:05.052 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T21:59:05.052 [Cloud] Dequeued cloud request. 2026-09-13T21:59:05.052 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T21:59:05.318 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3E7EFF6D-1BCE-D182-70B0-33665C0CB08E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 21:59:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T21:59:05.818 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T22:03:37.302 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T22:03:37.302 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T22:03:37.302 [Cloud] Queued cloud request. 2026-09-13T22:03:37.302 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T22:03:37.302 [Cloud] Dequeued cloud request. 2026-09-13T22:03:37.302 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T22:03:37.474 [Cloud] End of cloud request. 2026-09-13T22:03:37.974 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T22:10:08.818 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T22:10:08.818 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T22:10:08.818 [Cloud] Queued cloud request. 2026-09-13T22:10:08.818 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T22:10:08.818 [Cloud] Dequeued cloud request. 2026-09-13T22:10:08.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T22:10:08.958 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AEB0A169-0BF7-D0B1-B2FC-F983F858921D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 22:10:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T22:10:09.458 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T22:13:47.864 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T22:13:49.614 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T22:13:49.614 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T22:13:49.614 [Cloud] Queued cloud request. 2026-09-13T22:13:49.614 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T22:13:49.614 [Cloud] Dequeued cloud request. 2026-09-13T22:13:49.630 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T22:13:49.802 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{975D50DA-3717-3B52-A4FD-0B46CB56FC69} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 22:13:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T22:13:50.302 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T22:23:34.504 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T22:23:34.504 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T22:23:34.504 [Cloud] Queued cloud request. 2026-09-13T22:23:34.504 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T22:23:34.504 [Cloud] Dequeued cloud request. 2026-09-13T22:23:34.504 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T22:23:34.708 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1EE08633-A3E2-9ED5-83BF-3E42AF2F63F1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 22:23:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T22:23:35.208 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T22:26:38.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T22:26:38.145 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T22:26:38.145 [Cloud] Queued cloud request. 2026-09-13T22:26:38.145 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T22:26:38.145 [Cloud] Dequeued cloud request. 2026-09-13T22:26:38.145 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T22:26:38.333 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{176AB875-D02D-F8FA-CA36-680B3EDDF788} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 22:26:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T22:26:38.848 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T22:28:52.863 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T22:37:06.395 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T22:37:06.395 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T22:37:06.395 [Cloud] Queued cloud request. 2026-09-13T22:37:06.395 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T22:37:06.395 [Cloud] Dequeued cloud request. 2026-09-13T22:37:06.395 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T22:37:06.598 [Cloud] End of cloud request. 2026-09-13T22:37:07.098 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T22:43:57.863 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T22:45:22.441 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T22:45:22.441 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T22:45:22.441 [Cloud] Queued cloud request. 2026-09-13T22:45:22.441 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T22:45:22.441 [Cloud] Dequeued cloud request. 2026-09-13T22:45:22.441 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{08BDDC0A-C346-B134-0F37-C2CA5F8328BF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 22:45:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T22:45:22.582 [Cloud] End of cloud request. 2026-09-13T22:45:23.082 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T22:46:01.472 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T22:46:01.472 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T22:46:01.472 [Cloud] Queued cloud request. 2026-09-13T22:46:01.472 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T22:46:01.472 [Cloud] Dequeued cloud request. 2026-09-13T22:46:01.472 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T22:46:01.550 [Cloud] End of cloud request. 2026-09-13T22:46:02.050 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T22:59:02.862 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T23:03:53.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T23:03:53.643 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T23:03:53.643 [Cloud] Queued cloud request. 2026-09-13T23:03:53.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T23:03:53.643 [Cloud] Dequeued cloud request. 2026-09-13T23:03:53.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T23:03:53.847 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{03D154C2-4EA6-C853-C30B-B795E117860D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 23:03:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T23:03:54.362 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T23:10:04.080 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T23:10:04.096 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T23:10:04.096 [Cloud] Queued cloud request. 2026-09-13T23:10:04.096 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T23:10:04.096 [Cloud] Dequeued cloud request. 2026-09-13T23:10:04.096 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T23:10:04.283 [Cloud] End of cloud request. 2026-09-13T23:10:04.783 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T23:14:07.861 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T23:26:15.720 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T23:26:15.720 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T23:26:15.720 [Cloud] Queued cloud request. 2026-09-13T23:26:15.720 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T23:26:15.720 [Cloud] Dequeued cloud request. 2026-09-13T23:26:15.720 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T23:26:15.939 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E3A774B8-4EFE-DB2F-CF09-DEE8AA941E10} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 23:26:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T23:26:16.439 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T23:28:46.876 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 7929, Count: 400, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-13T23:28:46.876 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 3931, Count: 178, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mamCAL\config.inc.php, EstimatedImpact: 0% 2026-09-13T23:28:46.876 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-13T23:28:46.876 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-13T23:28:46.876 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 257, Count: 16, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-13T23:28:46.876 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-13T23:28:46.876 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-13T23:28:46.876 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-13T23:28:46.876 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-13T23:28:46.876 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-13T23:29:12.861 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T23:40:40.126 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T23:40:40.126 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T23:40:40.126 [Cloud] Queued cloud request. 2026-09-13T23:40:40.126 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T23:40:40.126 [Cloud] Dequeued cloud request. 2026-09-13T23:40:40.126 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T23:40:40.282 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F7ED1B18-1E62-4721-CBDB-6175E9D1A4FE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 23:40:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T23:40:40.782 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T23:44:17.860 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-13T23:56:30.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T23:56:30.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T23:56:30.297 [Cloud] Queued cloud request. 2026-09-13T23:56:30.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T23:56:30.297 [Cloud] Dequeued cloud request. 2026-09-13T23:56:30.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T23:56:30.500 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8029442F-2D30-E825-5C41-B2F557EE9B58} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-13-2026 23:56:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-13T23:56:31.000 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T23:57:54.391 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-13T23:57:54.391 [Cloud] Start of cloud request. Passive mode: 0 2026-09-13T23:57:54.391 [Cloud] Queued cloud request. 2026-09-13T23:57:54.391 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-13T23:57:54.391 [Cloud] Dequeued cloud request. 2026-09-13T23:57:54.391 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-13T23:57:54.594 [Cloud] End of cloud request. 2026-09-13T23:57:55.094 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-13T23:59:22.859 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T00:04:44.922 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T00:04:44.922 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T00:04:44.922 [Cloud] Queued cloud request. 2026-09-14T00:04:44.922 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T00:04:44.922 [Cloud] Dequeued cloud request. 2026-09-14T00:04:44.937 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T00:04:45.109 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F7C3F23-4BDB-7CAF-1980-D136945D89BD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 00:04:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T00:04:45.609 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T00:06:08.453 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T00:06:08.453 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T00:06:08.453 [Cloud] Queued cloud request. 2026-09-14T00:06:08.453 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T00:06:08.453 [Cloud] Dequeued cloud request. 2026-09-14T00:06:08.453 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T00:06:08.640 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5B7D6E13-CD17-FEF0-9700-72BC1145C6C2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 00:06:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T00:06:09.140 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T00:14:13.281 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:D8492033-9A9D-4E89-95DB-B65E3FFED46D, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-14T00:14:13.281 Scheduled scan with Id D8492033-9A9D-4E89-95DB-B65E3FFED46D configured CPU priority: normal (LowCpuPriority: 0) 2026-09-14T00:14:13.281 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-14T00:14:13.281 [SFC] System file cache build is not needed (already completed) 2026-09-14T00:14:27.859 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T00:14:36.296 Engine:Triggered AR EMS scan 2026-09-14T00:14:36.296 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.327 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.343 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.343 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.359 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.374 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.374 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.390 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.390 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.390 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.405 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.405 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.405 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.421 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.421 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.421 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.437 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.452 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.468 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.468 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.468 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.484 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.484 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.484 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.499 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.499 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.515 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.515 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.546 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.546 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.546 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.546 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.562 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.577 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.577 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.593 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.593 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.609 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.609 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.609 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.624 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.624 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.624 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.640 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.640 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.655 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.655 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.655 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.671 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.671 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.687 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.702 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.718 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.718 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.734 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.765 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.780 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.804 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.812 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.827 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:14:36.827 Engine:EMS scan for process: svchost pid: 4108, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-14T00:15:18.577 QuickScan:ScanID:D8492033-9A9D-4E89-95DB-B65E3FFED46D: Quick scan finished with error 0 2026-09-14T00:15:19.093 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-14T00:15:19.093 [RTP] Duplicating the current plugin configuration object... 2026-09-14T00:15:19.093 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-14T00:15:19.093 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-14T00:15:19.093 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-14T00:15:19.093 [RTP] No config change detected. Not updating plugin configuration. 2026-09-14T00:15:19.093 [RTP] No config changes found. No configuration switch. 2026-09-14T00:15:19.093 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-14T00:15:55.734 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T00:15:55.734 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T00:15:55.734 [Cloud] Queued cloud request. 2026-09-14T00:15:55.734 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T00:15:55.734 [Cloud] Dequeued cloud request. 2026-09-14T00:15:55.734 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T00:15:55.999 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{800FFE4A-D500-8982-DCB0-8F435408A838} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 00:15:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T00:15:56.515 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T00:16:42.671 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T00:16:42.671 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T00:16:42.671 [Cloud] Queued cloud request. 2026-09-14T00:16:42.671 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T00:16:42.671 [Cloud] Dequeued cloud request. 2026-09-14T00:16:42.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T00:16:42.780 [Cloud] End of cloud request. 2026-09-14T00:16:43.280 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T00:22:09.312 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T00:22:09.312 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T00:22:09.312 [Cloud] Queued cloud request. 2026-09-14T00:22:09.312 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T00:22:09.312 [Cloud] Dequeued cloud request. 2026-09-14T00:22:09.312 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T00:22:09.452 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2AFF1D56-747C-3348-DE92-3DECB8952D24} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 00:22:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T00:22:09.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T00:29:32.858 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T00:38:36.842 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T00:38:36.842 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T00:38:36.842 [Cloud] Queued cloud request. 2026-09-14T00:38:36.842 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T00:38:36.842 [Cloud] Dequeued cloud request. 2026-09-14T00:38:36.842 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T00:38:37.045 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{03D7DEF4-6C6D-B95E-A03F-128487AAF7F4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 00:38:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T00:38:37.545 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T00:44:37.858 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T00:46:56.185 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T00:46:56.185 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T00:46:56.185 [Cloud] Queued cloud request. 2026-09-14T00:46:56.185 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T00:46:56.185 [Cloud] Dequeued cloud request. 2026-09-14T00:46:56.185 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T00:46:56.404 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{57AC5FDA-0D84-2CFF-1EF4-D2AE2F5A091A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 00:46:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T00:46:56.904 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T00:51:17.998 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T00:51:17.998 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T00:51:17.998 [Cloud] Queued cloud request. 2026-09-14T00:51:17.998 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T00:51:17.998 [Cloud] Dequeued cloud request. 2026-09-14T00:51:17.998 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T00:51:18.201 [Cloud] End of cloud request. 2026-09-14T00:51:18.701 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T00:56:08.044 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T00:56:08.044 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T00:56:08.044 [Cloud] Queued cloud request. 2026-09-14T00:56:08.044 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T00:56:08.044 [Cloud] Dequeued cloud request. 2026-09-14T00:56:08.044 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T00:56:08.247 [Cloud] End of cloud request. 2026-09-14T00:56:08.747 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T00:58:17.091 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T00:58:17.091 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T00:58:17.091 [Cloud] Queued cloud request. 2026-09-14T00:58:17.091 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T00:58:17.091 [Cloud] Dequeued cloud request. 2026-09-14T00:58:17.091 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T00:58:17.294 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A376EAD7-BED0-599A-15DB-DDC9DBA14694} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 00:58:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T00:58:17.794 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T00:59:42.857 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T01:00:01.528 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489564, FileId: 0xe000000039979, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.528 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489565, FileId: 0xf000000039978, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.560 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489570, FileId: 0x10000000039979, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.560 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489571, FileId: 0x11000000039978, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.575 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489577, FileId: 0x13000000039978, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.575 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489576, FileId: 0x12000000039979, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.606 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489583, FileId: 0x15000000039978, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.606 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489582, FileId: 0x14000000039979, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.622 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489589, FileId: 0x17000000039978, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.622 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489588, FileId: 0x16000000039979, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.638 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489594, FileId: 0x18000000039979, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.638 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489595, FileId: 0x19000000039978, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.653 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489601, FileId: 0x1b000000039978, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.653 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489600, FileId: 0x1a000000039979, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.669 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489607, FileId: 0x1d000000039978, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.669 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489606, FileId: 0x1c000000039979, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.685 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489613, FileId: 0x1f000000039978, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.685 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489612, FileId: 0x1e000000039979, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.700 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489619, FileId: 0x20000000039979, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.700 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489618, FileId: 0x21000000039978, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.731 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489624, FileId: 0x22000000039979, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.731 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489625, FileId: 0x23000000039978, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.747 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489630, FileId: 0x24000000039979, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:00:01.747 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5489631, FileId: 0x25000000039978, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T01:09:28.716 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:09:28.716 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:09:28.716 [Cloud] Queued cloud request. 2026-09-14T01:09:28.716 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:09:28.716 [Cloud] Dequeued cloud request. 2026-09-14T01:09:28.716 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:09:28.887 [Cloud] End of cloud request. 2026-09-14T01:09:29.403 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:10:42.559 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:10:42.559 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:10:42.559 [Cloud] Queued cloud request. 2026-09-14T01:10:42.559 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:10:42.559 [Cloud] Dequeued cloud request. 2026-09-14T01:10:42.575 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:10:42.716 [Cloud] End of cloud request. 2026-09-14T01:10:43.216 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:12:39.356 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:12:39.356 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:12:39.356 [Cloud] Queued cloud request. 2026-09-14T01:12:39.356 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:12:39.356 [Cloud] Dequeued cloud request. 2026-09-14T01:12:39.356 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:12:39.497 [Cloud] End of cloud request. 2026-09-14T01:12:40.012 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:13:50.059 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:13:50.059 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:13:50.059 [Cloud] Queued cloud request. 2026-09-14T01:13:50.059 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:13:50.059 [Cloud] Dequeued cloud request. 2026-09-14T01:13:50.059 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:13:50.200 [Cloud] End of cloud request. 2026-09-14T01:13:50.700 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:14:16.825 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:14:16.825 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:14:16.825 [Cloud] Queued cloud request. 2026-09-14T01:14:16.825 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:14:16.825 [Cloud] Dequeued cloud request. 2026-09-14T01:14:16.825 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:14:16.903 [Cloud] End of cloud request. 2026-09-14T01:14:17.403 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:14:29.309 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:14:29.309 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:14:29.309 [Cloud] Queued cloud request. 2026-09-14T01:14:29.309 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:14:29.309 [Cloud] Dequeued cloud request. 2026-09-14T01:14:29.309 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:14:29.387 [Cloud] End of cloud request. 2026-09-14T01:14:29.903 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:14:47.856 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T01:17:41.340 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:17:41.340 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:17:41.340 [Cloud] Queued cloud request. 2026-09-14T01:17:41.340 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:17:41.340 [Cloud] Dequeued cloud request. 2026-09-14T01:17:41.340 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:17:51.465 [Cloud] End of cloud request. 2026-09-14T01:17:51.965 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:18:49.512 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:18:49.512 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:18:49.512 [Cloud] Queued cloud request. 2026-09-14T01:18:49.512 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:18:49.512 [Cloud] Dequeued cloud request. 2026-09-14T01:18:49.512 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:18:49.606 [Cloud] End of cloud request. 2026-09-14T01:18:50.121 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:18:58.434 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:18:58.434 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:18:58.434 [Cloud] Queued cloud request. 2026-09-14T01:18:58.434 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:18:58.434 [Cloud] Dequeued cloud request. 2026-09-14T01:18:58.434 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:18:58.512 [Cloud] End of cloud request. 2026-09-14T01:18:59.028 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:19:07.996 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:19:07.996 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:19:07.996 [Cloud] Queued cloud request. 2026-09-14T01:19:07.996 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:19:07.996 [Cloud] Dequeued cloud request. 2026-09-14T01:19:07.996 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:19:08.074 [Cloud] End of cloud request. 2026-09-14T01:19:08.590 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:19:29.231 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:19:29.231 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:19:29.231 [Cloud] Queued cloud request. 2026-09-14T01:19:29.231 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:19:29.231 [Cloud] Dequeued cloud request. 2026-09-14T01:19:29.231 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:19:29.309 [Cloud] End of cloud request. 2026-09-14T01:19:29.825 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:19:35.918 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:19:35.918 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:19:35.918 [Cloud] Queued cloud request. 2026-09-14T01:19:35.918 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:19:35.918 [Cloud] Dequeued cloud request. 2026-09-14T01:19:35.918 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:19:36.012 [Cloud] End of cloud request. 2026-09-14T01:19:36.528 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:20:57.949 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:20:57.949 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:20:57.949 [Cloud] Queued cloud request. 2026-09-14T01:20:57.949 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:20:57.949 [Cloud] Dequeued cloud request. 2026-09-14T01:20:57.949 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:20:58.121 [Cloud] End of cloud request. 2026-09-14T01:20:58.621 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:21:02.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:21:02.700 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:21:02.700 [Cloud] Queued cloud request. 2026-09-14T01:21:02.700 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:21:02.700 [Cloud] Dequeued cloud request. 2026-09-14T01:21:02.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:21:02.778 [Cloud] End of cloud request. 2026-09-14T01:21:03.293 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:22:10.903 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:22:10.903 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:22:10.903 [Cloud] Queued cloud request. 2026-09-14T01:22:10.903 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:22:10.903 [Cloud] Dequeued cloud request. 2026-09-14T01:22:10.903 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:22:11.090 [Cloud] End of cloud request. 2026-09-14T01:22:11.590 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:22:20.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:22:20.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:22:20.387 [Cloud] Queued cloud request. 2026-09-14T01:22:20.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:22:20.387 [Cloud] Dequeued cloud request. 2026-09-14T01:22:20.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:22:20.465 [Cloud] End of cloud request. 2026-09-14T01:22:20.965 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:22:49.887 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:22:49.887 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:22:49.887 [Cloud] Queued cloud request. 2026-09-14T01:22:49.887 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:22:49.887 [Cloud] Dequeued cloud request. 2026-09-14T01:22:49.887 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:22:49.965 [Cloud] End of cloud request. 2026-09-14T01:22:50.465 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:23:32.621 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:23:32.621 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:23:32.621 [Cloud] Queued cloud request. 2026-09-14T01:23:32.621 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:23:32.621 [Cloud] Dequeued cloud request. 2026-09-14T01:23:32.621 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:23:32.700 [Cloud] End of cloud request. 2026-09-14T01:23:33.215 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:23:48.449 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:23:48.449 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:23:48.449 [Cloud] Queued cloud request. 2026-09-14T01:23:48.449 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:23:48.449 [Cloud] Dequeued cloud request. 2026-09-14T01:23:48.449 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:23:48.528 [Cloud] End of cloud request. 2026-09-14T01:23:49.043 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:23:55.949 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:23:55.949 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:23:55.949 [Cloud] Queued cloud request. 2026-09-14T01:23:55.949 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:23:55.949 [Cloud] Dequeued cloud request. 2026-09-14T01:23:55.949 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:23:56.028 [Cloud] End of cloud request. 2026-09-14T01:23:56.543 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:24:31.684 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:24:31.684 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:24:31.684 [Cloud] Queued cloud request. 2026-09-14T01:24:31.684 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:24:31.684 [Cloud] Dequeued cloud request. 2026-09-14T01:24:31.684 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:24:31.762 [Cloud] End of cloud request. 2026-09-14T01:24:32.262 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:24:47.574 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:24:47.574 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:24:47.574 [Cloud] Queued cloud request. 2026-09-14T01:24:47.574 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:24:47.574 [Cloud] Dequeued cloud request. 2026-09-14T01:24:47.574 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:24:47.934 [Cloud] End of cloud request. 2026-09-14T01:24:48.434 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:25:52.215 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:25:52.215 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:25:52.215 [Cloud] Queued cloud request. 2026-09-14T01:25:52.215 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:25:52.215 [Cloud] Dequeued cloud request. 2026-09-14T01:25:52.215 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:25:52.371 [Cloud] End of cloud request. 2026-09-14T01:25:52.887 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:26:21.777 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:26:21.777 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:26:21.777 [Cloud] Queued cloud request. 2026-09-14T01:26:21.777 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:26:21.777 [Cloud] Dequeued cloud request. 2026-09-14T01:26:21.777 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:26:21.856 [Cloud] End of cloud request. 2026-09-14T01:26:22.356 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:26:36.512 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:26:36.512 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:26:36.512 [Cloud] Queued cloud request. 2026-09-14T01:26:36.512 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:26:36.512 [Cloud] Dequeued cloud request. 2026-09-14T01:26:36.512 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:26:36.590 [Cloud] End of cloud request. 2026-09-14T01:26:37.090 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:27:30.683 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:27:30.683 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:27:30.683 [Cloud] Queued cloud request. 2026-09-14T01:27:30.683 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:27:30.683 [Cloud] Dequeued cloud request. 2026-09-14T01:27:30.683 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:27:30.762 [Cloud] End of cloud request. 2026-09-14T01:27:31.277 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:27:35.871 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:27:35.871 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:27:35.871 [Cloud] Queued cloud request. 2026-09-14T01:27:35.871 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:27:35.871 [Cloud] Dequeued cloud request. 2026-09-14T01:27:35.871 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:27:35.949 [Cloud] End of cloud request. 2026-09-14T01:27:36.449 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:27:51.340 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:27:51.340 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:27:51.340 [Cloud] Queued cloud request. 2026-09-14T01:27:51.340 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:27:51.340 [Cloud] Dequeued cloud request. 2026-09-14T01:27:51.340 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:27:51.418 [Cloud] End of cloud request. 2026-09-14T01:27:51.918 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:28:07.168 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:28:07.168 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:28:07.168 [Cloud] Queued cloud request. 2026-09-14T01:28:07.168 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:28:07.168 [Cloud] Dequeued cloud request. 2026-09-14T01:28:07.168 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:28:07.262 [Cloud] End of cloud request. 2026-09-14T01:28:07.777 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:28:08.980 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:28:08.980 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:28:08.980 [Cloud] Queued cloud request. 2026-09-14T01:28:08.980 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:28:08.980 [Cloud] Dequeued cloud request. 2026-09-14T01:28:08.980 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:28:09.152 [Cloud] End of cloud request. 2026-09-14T01:28:09.668 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:28:46.887 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 12092, Count: 603, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T01:28:46.887 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 9026, Count: 417, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-14T01:28:46.887 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-14T01:28:46.887 ProcessImageName: WmiPrvSE.exe, Pid: 2908, TotalTime: 708, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-14T01:28:46.887 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 470, Count: 27, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-14T01:28:46.887 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-14T01:28:46.887 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T01:28:46.887 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-14T01:28:46.887 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-14T01:28:46.887 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-2.MAD, EstimatedImpact: 30% 2026-09-14T01:28:46.887 ProcessImageName: mysqldump.exe, Pid: 7272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-14T01:28:46.887 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T01:28:46.887 ProcessImageName: powershell.exe, Pid: 2876, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-14T01:28:46.887 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-14T01:29:52.855 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T01:44:57.855 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T01:58:41.151 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:58:41.151 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:58:41.151 [Cloud] Queued cloud request. 2026-09-14T01:58:41.151 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:58:41.151 [Cloud] Dequeued cloud request. 2026-09-14T01:58:41.151 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:58:41.354 [Cloud] End of cloud request. 2026-09-14T01:58:41.854 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:59:20.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:59:20.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:59:20.604 [Cloud] Queued cloud request. 2026-09-14T01:59:20.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:59:20.604 [Cloud] Dequeued cloud request. 2026-09-14T01:59:20.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:59:20.714 [Cloud] End of cloud request. 2026-09-14T01:59:21.229 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:59:33.057 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:59:33.057 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:59:33.057 [Cloud] Queued cloud request. 2026-09-14T01:59:33.057 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:59:33.057 [Cloud] Dequeued cloud request. 2026-09-14T01:59:33.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:59:33.135 [Cloud] End of cloud request. 2026-09-14T01:59:33.151 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:59:33.151 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:59:33.151 [Cloud] Queued cloud request. 2026-09-14T01:59:33.151 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:59:33.151 [Cloud] Dequeued cloud request. 2026-09-14T01:59:33.151 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:59:33.213 [Cloud] End of cloud request. 2026-09-14T01:59:33.635 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:59:44.292 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:59:44.292 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:59:44.292 [Cloud] Queued cloud request. 2026-09-14T01:59:44.292 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:59:44.292 [Cloud] Dequeued cloud request. 2026-09-14T01:59:44.292 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:59:44.370 [Cloud] End of cloud request. 2026-09-14T01:59:44.885 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:59:47.542 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:59:47.542 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:59:47.542 [Cloud] Queued cloud request. 2026-09-14T01:59:47.542 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:59:47.542 [Cloud] Dequeued cloud request. 2026-09-14T01:59:47.542 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:59:47.635 [Cloud] End of cloud request. 2026-09-14T01:59:48.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T01:59:54.417 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T01:59:54.417 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T01:59:54.417 [Cloud] Queued cloud request. 2026-09-14T01:59:54.417 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T01:59:54.417 [Cloud] Dequeued cloud request. 2026-09-14T01:59:54.417 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T01:59:54.510 [Cloud] End of cloud request. 2026-09-14T01:59:55.010 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:00:02.854 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T02:00:07.948 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:00:07.948 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:00:07.948 [Cloud] Queued cloud request. 2026-09-14T02:00:07.948 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:00:07.948 [Cloud] Dequeued cloud request. 2026-09-14T02:00:07.948 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:00:08.042 [Cloud] End of cloud request. 2026-09-14T02:00:08.542 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:00:17.213 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:00:17.213 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:00:17.213 [Cloud] Queued cloud request. 2026-09-14T02:00:17.213 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:00:17.213 [Cloud] Dequeued cloud request. 2026-09-14T02:00:17.213 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:00:17.292 [Cloud] End of cloud request. 2026-09-14T02:00:17.807 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:00:28.729 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:00:28.729 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:00:28.729 [Cloud] Queued cloud request. 2026-09-14T02:00:28.729 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:00:28.729 [Cloud] Dequeued cloud request. 2026-09-14T02:00:28.729 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:00:28.807 [Cloud] End of cloud request. 2026-09-14T02:00:29.323 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:01:53.120 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:01:53.120 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:01:53.120 [Cloud] Queued cloud request. 2026-09-14T02:01:53.120 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:01:53.120 [Cloud] Dequeued cloud request. 2026-09-14T02:01:53.135 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:01:53.307 [Cloud] End of cloud request. 2026-09-14T02:01:53.807 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:02:05.994 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:02:05.994 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:02:05.994 [Cloud] Queued cloud request. 2026-09-14T02:02:05.994 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:02:05.994 [Cloud] Dequeued cloud request. 2026-09-14T02:02:05.994 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:02:06.073 [Cloud] End of cloud request. 2026-09-14T02:02:06.588 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:02:35.135 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:02:35.135 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:02:35.135 [Cloud] Queued cloud request. 2026-09-14T02:02:35.135 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:02:35.135 [Cloud] Dequeued cloud request. 2026-09-14T02:02:35.135 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:02:35.229 [Cloud] End of cloud request. 2026-09-14T02:02:35.244 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:02:35.244 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:02:35.244 [Cloud] Queued cloud request. 2026-09-14T02:02:35.244 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:02:35.244 [Cloud] Dequeued cloud request. 2026-09-14T02:02:35.244 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:02:35.323 [Cloud] End of cloud request. 2026-09-14T02:02:35.323 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:02:35.323 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:02:35.323 [Cloud] Queued cloud request. 2026-09-14T02:02:35.323 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:02:35.323 [Cloud] Dequeued cloud request. 2026-09-14T02:02:35.323 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:02:35.401 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{37F572BC-6A54-A9C4-9DFD-6F93D92905A3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 02:02:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T02:02:35.729 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:02:44.244 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:02:44.244 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:02:44.244 [Cloud] Queued cloud request. 2026-09-14T02:02:44.244 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:02:44.244 [Cloud] Dequeued cloud request. 2026-09-14T02:02:44.244 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:02:44.338 [Cloud] End of cloud request. 2026-09-14T02:02:44.838 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:03:17.807 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:03:17.807 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:03:17.807 [Cloud] Queued cloud request. 2026-09-14T02:03:17.807 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:03:17.807 [Cloud] Dequeued cloud request. 2026-09-14T02:03:17.807 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:03:17.885 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DA5CCE8F-DD04-3C3E-8F5F-BF22E20A8F2B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 02:03:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T02:03:18.385 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:03:37.526 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:03:37.526 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:03:37.526 [Cloud] Queued cloud request. 2026-09-14T02:03:37.526 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:03:37.526 [Cloud] Dequeued cloud request. 2026-09-14T02:03:37.526 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:03:37.619 [Cloud] End of cloud request. 2026-09-14T02:03:38.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:04:01.510 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:04:01.510 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:04:01.510 [Cloud] Queued cloud request. 2026-09-14T02:04:01.510 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:04:01.510 [Cloud] Dequeued cloud request. 2026-09-14T02:04:01.510 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:04:01.604 [Cloud] End of cloud request. 2026-09-14T02:04:02.119 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:04:04.244 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:04:04.244 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:04:04.244 [Cloud] Queued cloud request. 2026-09-14T02:04:04.244 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:04:04.244 [Cloud] Dequeued cloud request. 2026-09-14T02:04:04.244 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:04:04.323 [Cloud] End of cloud request. 2026-09-14T02:04:04.823 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:04:33.791 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:04:33.791 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:04:33.791 [Cloud] Queued cloud request. 2026-09-14T02:04:33.791 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:04:33.791 [Cloud] Dequeued cloud request. 2026-09-14T02:04:33.791 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:04:33.885 [Cloud] End of cloud request. 2026-09-14T02:04:34.385 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:04:50.401 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:04:50.401 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:04:50.401 [Cloud] Queued cloud request. 2026-09-14T02:04:50.401 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:04:50.401 [Cloud] Dequeued cloud request. 2026-09-14T02:04:50.401 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:04:50.479 [Cloud] End of cloud request. 2026-09-14T02:04:50.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:05:07.057 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:05:07.057 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:05:07.057 [Cloud] Queued cloud request. 2026-09-14T02:05:07.057 [Cloud] Dequeued cloud request. 2026-09-14T02:05:07.057 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:05:07.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:05:07.135 [Cloud] End of cloud request. 2026-09-14T02:05:07.635 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:05:10.666 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:05:10.666 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:05:10.666 [Cloud] Queued cloud request. 2026-09-14T02:05:10.666 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:05:10.666 [Cloud] Dequeued cloud request. 2026-09-14T02:05:10.666 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:05:10.744 [Cloud] End of cloud request. 2026-09-14T02:05:11.260 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:05:26.869 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:05:26.869 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:05:26.869 [Cloud] Queued cloud request. 2026-09-14T02:05:26.869 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:05:26.869 [Cloud] Dequeued cloud request. 2026-09-14T02:05:26.869 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:05:26.948 [Cloud] End of cloud request. 2026-09-14T02:05:27.448 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:05:36.526 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:05:36.526 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:05:36.526 [Cloud] Queued cloud request. 2026-09-14T02:05:36.526 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:05:36.526 [Cloud] Dequeued cloud request. 2026-09-14T02:05:36.526 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:05:36.604 [Cloud] End of cloud request. 2026-09-14T02:05:37.104 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:06:09.041 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:06:09.041 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:06:09.041 [Cloud] Queued cloud request. 2026-09-14T02:06:09.041 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:06:09.041 [Cloud] Dequeued cloud request. 2026-09-14T02:06:09.041 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:06:09.135 [Cloud] End of cloud request. 2026-09-14T02:06:09.651 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:06:22.807 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:06:22.807 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:06:22.807 [Cloud] Queued cloud request. 2026-09-14T02:06:22.807 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:06:22.807 [Cloud] Dequeued cloud request. 2026-09-14T02:06:22.807 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:06:22.885 [Cloud] End of cloud request. 2026-09-14T02:06:23.385 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:06:34.916 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:06:34.916 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:06:34.916 [Cloud] Queued cloud request. 2026-09-14T02:06:34.916 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:06:34.916 [Cloud] Dequeued cloud request. 2026-09-14T02:06:34.916 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:06:34.994 [Cloud] End of cloud request. 2026-09-14T02:06:35.494 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:06:37.963 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:06:37.963 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:06:37.963 [Cloud] Queued cloud request. 2026-09-14T02:06:37.963 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:06:37.963 [Cloud] Dequeued cloud request. 2026-09-14T02:06:37.963 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:06:38.041 [Cloud] End of cloud request. 2026-09-14T02:06:38.541 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:06:57.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:06:57.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:06:57.604 [Cloud] Queued cloud request. 2026-09-14T02:06:57.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:06:57.604 [Cloud] Dequeued cloud request. 2026-09-14T02:06:57.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:06:57.682 [Cloud] End of cloud request. 2026-09-14T02:06:58.198 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:06:59.151 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:06:59.151 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:06:59.151 [Cloud] Queued cloud request. 2026-09-14T02:06:59.151 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:06:59.151 [Cloud] Dequeued cloud request. 2026-09-14T02:06:59.151 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:06:59.244 [Cloud] End of cloud request. 2026-09-14T02:06:59.744 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:07:00.994 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:07:00.994 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:07:00.994 [Cloud] Queued cloud request. 2026-09-14T02:07:00.994 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:07:00.994 [Cloud] Dequeued cloud request. 2026-09-14T02:07:00.994 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:07:01.073 [Cloud] End of cloud request. 2026-09-14T02:07:01.573 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:07:19.963 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:07:19.963 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:07:19.963 [Cloud] Queued cloud request. 2026-09-14T02:07:19.963 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:07:19.963 [Cloud] Dequeued cloud request. 2026-09-14T02:07:19.963 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:07:20.041 [Cloud] End of cloud request. 2026-09-14T02:07:20.557 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:08:09.057 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:08:09.057 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:08:09.057 [Cloud] Queued cloud request. 2026-09-14T02:08:09.057 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:08:09.057 [Cloud] Dequeued cloud request. 2026-09-14T02:08:09.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:08:09.151 [Cloud] End of cloud request. 2026-09-14T02:08:09.666 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:08:10.760 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:08:10.760 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:08:10.760 [Cloud] Queued cloud request. 2026-09-14T02:08:10.760 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:08:10.760 [Cloud] Dequeued cloud request. 2026-09-14T02:08:10.760 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:08:10.838 [Cloud] End of cloud request. 2026-09-14T02:08:11.354 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:08:13.182 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:08:13.182 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:08:13.182 [Cloud] Queued cloud request. 2026-09-14T02:08:13.182 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:08:13.182 [Cloud] Dequeued cloud request. 2026-09-14T02:08:13.182 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:08:13.260 [Cloud] End of cloud request. 2026-09-14T02:08:13.776 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:08:25.807 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:08:25.807 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:08:25.807 [Cloud] Queued cloud request. 2026-09-14T02:08:25.807 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:08:25.807 [Cloud] Dequeued cloud request. 2026-09-14T02:08:25.807 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:08:25.885 [Cloud] End of cloud request. 2026-09-14T02:08:26.385 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:09:10.182 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:09:10.182 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:09:10.182 [Cloud] Queued cloud request. 2026-09-14T02:09:10.182 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:09:10.182 [Cloud] Dequeued cloud request. 2026-09-14T02:09:10.182 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:09:10.276 [Cloud] End of cloud request. 2026-09-14T02:09:10.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:10:17.213 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:10:17.213 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:10:17.213 [Cloud] Queued cloud request. 2026-09-14T02:10:17.213 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:10:17.213 [Cloud] Dequeued cloud request. 2026-09-14T02:10:17.213 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:10:17.369 [Cloud] End of cloud request. 2026-09-14T02:10:17.885 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:10:18.557 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:10:18.557 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:10:18.557 [Cloud] Queued cloud request. 2026-09-14T02:10:18.557 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:10:18.557 [Cloud] Dequeued cloud request. 2026-09-14T02:10:18.557 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:10:18.651 [Cloud] End of cloud request. 2026-09-14T02:10:19.151 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:10:33.807 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:10:33.807 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:10:33.807 [Cloud] Queued cloud request. 2026-09-14T02:10:33.807 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:10:33.807 [Cloud] Dequeued cloud request. 2026-09-14T02:10:33.807 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:10:33.885 [Cloud] End of cloud request. 2026-09-14T02:10:34.401 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:10:35.776 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:10:35.776 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:10:35.776 [Cloud] Queued cloud request. 2026-09-14T02:10:35.776 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:10:35.776 [Cloud] Dequeued cloud request. 2026-09-14T02:10:35.776 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:10:35.854 [Cloud] End of cloud request. 2026-09-14T02:10:36.354 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:10:43.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:10:43.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:10:43.604 [Cloud] Queued cloud request. 2026-09-14T02:10:43.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:10:43.604 [Cloud] Dequeued cloud request. 2026-09-14T02:10:43.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:10:43.682 [Cloud] End of cloud request. 2026-09-14T02:10:43.697 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:10:43.697 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:10:43.697 [Cloud] Queued cloud request. 2026-09-14T02:10:43.697 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:10:43.697 [Cloud] Dequeued cloud request. 2026-09-14T02:10:43.697 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:10:44.182 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:10:49.994 [Cloud] End of cloud request. 2026-09-14T02:10:50.510 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:10:54.619 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:10:54.619 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:10:54.619 [Cloud] Queued cloud request. 2026-09-14T02:10:54.619 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:10:54.619 [Cloud] Dequeued cloud request. 2026-09-14T02:10:54.619 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:10:54.697 [Cloud] End of cloud request. 2026-09-14T02:10:55.213 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:11:08.682 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:11:08.682 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:11:08.682 [Cloud] Queued cloud request. 2026-09-14T02:11:08.682 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:11:08.682 [Cloud] Dequeued cloud request. 2026-09-14T02:11:08.682 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:11:08.760 [Cloud] End of cloud request. 2026-09-14T02:11:09.276 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:11:21.666 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:11:21.666 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:11:21.666 [Cloud] Queued cloud request. 2026-09-14T02:11:21.666 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:11:21.666 [Cloud] Dequeued cloud request. 2026-09-14T02:11:21.666 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:11:21.776 [Cloud] End of cloud request. 2026-09-14T02:11:22.291 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:11:26.291 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:11:26.291 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:11:26.291 [Cloud] Queued cloud request. 2026-09-14T02:11:26.291 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:11:26.291 [Cloud] Dequeued cloud request. 2026-09-14T02:11:26.291 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:11:26.369 [Cloud] End of cloud request. 2026-09-14T02:11:26.869 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:11:50.822 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:11:50.822 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:11:50.822 [Cloud] Queued cloud request. 2026-09-14T02:11:50.822 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:11:50.822 [Cloud] Dequeued cloud request. 2026-09-14T02:11:50.822 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:11:50.916 [Cloud] End of cloud request. 2026-09-14T02:11:51.416 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:11:53.854 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:11:53.854 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:11:53.854 [Cloud] Queued cloud request. 2026-09-14T02:11:53.854 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:11:53.854 [Cloud] Dequeued cloud request. 2026-09-14T02:11:53.854 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:11:53.932 [Cloud] End of cloud request. 2026-09-14T02:11:54.447 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:11:55.244 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:11:55.244 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:11:55.244 [Cloud] Queued cloud request. 2026-09-14T02:11:55.244 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:11:55.244 [Cloud] Dequeued cloud request. 2026-09-14T02:11:55.244 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:11:55.338 [Cloud] End of cloud request. 2026-09-14T02:11:55.854 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:11:56.916 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:11:56.916 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:11:56.916 [Cloud] Queued cloud request. 2026-09-14T02:11:56.916 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:11:56.916 [Cloud] Dequeued cloud request. 2026-09-14T02:11:56.916 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:11:56.994 [Cloud] End of cloud request. 2026-09-14T02:11:57.510 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:11:59.401 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:11:59.401 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:11:59.401 [Cloud] Queued cloud request. 2026-09-14T02:11:59.401 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:11:59.401 [Cloud] Dequeued cloud request. 2026-09-14T02:11:59.401 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:11:59.479 [Cloud] End of cloud request. 2026-09-14T02:11:59.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:12:12.135 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:12:12.135 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:12:12.135 [Cloud] Queued cloud request. 2026-09-14T02:12:12.135 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:12:12.135 [Cloud] Dequeued cloud request. 2026-09-14T02:12:12.135 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:12:12.213 [Cloud] End of cloud request. 2026-09-14T02:12:12.729 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:12:24.619 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:12:24.619 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:12:24.619 [Cloud] Queued cloud request. 2026-09-14T02:12:24.619 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:12:24.619 [Cloud] Dequeued cloud request. 2026-09-14T02:12:24.619 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:12:24.697 [Cloud] End of cloud request. 2026-09-14T02:12:25.213 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:13:07.541 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:13:07.541 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:13:07.541 [Cloud] Queued cloud request. 2026-09-14T02:13:07.541 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:13:07.541 [Cloud] Dequeued cloud request. 2026-09-14T02:13:07.541 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:13:07.619 [Cloud] End of cloud request. 2026-09-14T02:13:08.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:13:15.010 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:13:15.010 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:13:15.010 [Cloud] Queued cloud request. 2026-09-14T02:13:15.010 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:13:15.010 [Cloud] Dequeued cloud request. 2026-09-14T02:13:15.010 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:13:15.088 [Cloud] End of cloud request. 2026-09-14T02:13:15.588 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:13:17.901 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:13:17.901 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:13:17.901 [Cloud] Queued cloud request. 2026-09-14T02:13:17.901 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:13:17.901 [Cloud] Dequeued cloud request. 2026-09-14T02:13:17.901 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:13:17.979 [Cloud] End of cloud request. 2026-09-14T02:13:18.494 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:13:19.432 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:13:19.432 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:13:19.432 [Cloud] Queued cloud request. 2026-09-14T02:13:19.432 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:13:19.432 [Cloud] Dequeued cloud request. 2026-09-14T02:13:19.432 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:13:19.541 [Cloud] End of cloud request. 2026-09-14T02:13:20.041 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:13:23.416 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:13:23.416 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:13:23.416 [Cloud] Queued cloud request. 2026-09-14T02:13:23.416 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:13:23.416 [Cloud] Dequeued cloud request. 2026-09-14T02:13:23.416 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:13:23.510 [Cloud] End of cloud request. 2026-09-14T02:13:24.026 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:13:57.854 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:13:57.854 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:13:57.854 [Cloud] Queued cloud request. 2026-09-14T02:13:57.854 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:13:57.854 [Cloud] Dequeued cloud request. 2026-09-14T02:13:57.854 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:13:57.947 [Cloud] End of cloud request. 2026-09-14T02:13:57.947 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:13:57.947 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:13:57.947 [Cloud] Queued cloud request. 2026-09-14T02:13:57.947 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:13:57.947 [Cloud] Dequeued cloud request. 2026-09-14T02:13:57.947 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:13:58.025 [Cloud] End of cloud request. 2026-09-14T02:13:58.463 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:14:27.369 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:14:27.369 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:14:27.369 [Cloud] Queued cloud request. 2026-09-14T02:14:27.369 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:14:27.369 [Cloud] Dequeued cloud request. 2026-09-14T02:14:27.369 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:14:27.447 [Cloud] End of cloud request. 2026-09-14T02:14:27.963 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:14:46.900 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:14:46.900 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:14:46.900 [Cloud] Queued cloud request. 2026-09-14T02:14:46.900 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:14:46.900 [Cloud] Dequeued cloud request. 2026-09-14T02:14:46.900 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:14:46.978 [Cloud] End of cloud request. 2026-09-14T02:14:47.478 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:15:07.853 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T02:15:08.025 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:15:08.025 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:15:08.025 [Cloud] Queued cloud request. 2026-09-14T02:15:08.025 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:15:08.025 [Cloud] Dequeued cloud request. 2026-09-14T02:15:08.025 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:15:08.103 [Cloud] End of cloud request. 2026-09-14T02:15:08.603 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:15:29.822 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:15:29.822 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:15:29.822 [Cloud] Queued cloud request. 2026-09-14T02:15:29.822 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:15:29.822 [Cloud] Dequeued cloud request. 2026-09-14T02:15:29.822 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:15:29.900 [Cloud] End of cloud request. 2026-09-14T02:15:30.416 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:15:32.010 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:15:32.010 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:15:32.010 [Cloud] Queued cloud request. 2026-09-14T02:15:32.010 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:15:32.010 [Cloud] Dequeued cloud request. 2026-09-14T02:15:32.010 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:15:32.088 [Cloud] End of cloud request. 2026-09-14T02:15:32.588 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:15:45.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T02:15:45.088 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T02:15:45.088 [Cloud] Queued cloud request. 2026-09-14T02:15:45.088 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T02:15:45.088 [Cloud] Dequeued cloud request. 2026-09-14T02:15:45.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T02:15:45.182 [Cloud] End of cloud request. 2026-09-14T02:15:45.682 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T02:30:12.852 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T02:45:17.852 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T03:00:22.851 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T03:07:06.179 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-14T03:07:06.257 [AutoPurge] Cleanup Routine tasks have started. 2026-09-14T03:07:06.273 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-14T03:07:06.273 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-14T03:07:06.273 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-14-2026 03:07:06 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-14-2026 03:07:06 2026-09-14T03:07:06.304 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-14T03:07:06.304 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-14T03:07:06.304 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-14T03:07:06.304 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-14T03:07:06.304 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-14T03:07:06.304 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-14T03:07:06.304 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-14T03:07:06.304 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-14T03:07:06.304 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-14T03:07:06.304 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-14T03:07:06.335 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-14T03:07:06.351 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-14T03:07:06.367 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-14T03:07:06.367 [AutoPurge] Removing expired default signature package ... 2026-09-14T03:07:06.429 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-14T03:07:06.757 Job Notification: New process added to job (6500) 2026-09-14T03:07:06.835 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-14T03:07:07.038 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-14T03:07:07.617 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:07:08.038 Job Notification: Process exited from job (6500) 2026-09-14T03:07:08.132 [AutoPurge] Verification Routine tasks have ended. 2026-09-14T03:07:08.429 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-14T03:07:08.554 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-14T03:07:09.210 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-14T03:07:09.304 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-14T03:07:09.523 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-14T03:07:11.538 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_mi.dll", hr=0x0 2026-09-14T03:07:11.663 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:12.163 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-14T03:07:12.445 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-14T03:07:12.460 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:12.679 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-14T03:07:13.476 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-14T03:07:14.179 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-14T03:07:14.320 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-14T03:07:14.476 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-14T03:07:14.726 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:07:14.773 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psuser_arm64.dll", hr=0x0 2026-09-14T03:07:14.882 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-14T03:07:15.226 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-14T03:07:15.273 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ko.dll", hr=0x0 2026-09-14T03:07:15.351 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-14T03:07:15.538 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:15.648 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:15.710 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:15.726 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-14T03:07:15.882 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:07:15.945 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-14T03:07:15.992 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-14T03:07:16.023 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ro.dll", hr=0x0 2026-09-14T03:07:16.054 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-14T03:07:16.179 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-14T03:07:16.554 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:16.601 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-14T03:07:16.992 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ga.dll", hr=0x0 2026-09-14T03:07:17.085 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:07:17.241 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-14T03:07:17.882 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-14T03:07:18.382 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:18.570 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:07:18.695 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fil.dll", hr=0x0 2026-09-14T03:07:18.882 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-14T03:07:19.148 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fr.dll", hr=0x0 2026-09-14T03:07:19.320 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-14T03:07:19.429 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-14T03:07:19.866 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-14T03:07:19.991 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:20.616 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:07:20.741 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-14T03:07:20.741 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-14T03:07:20.788 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psmachine.dll", hr=0x0 2026-09-14T03:07:20.820 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-14T03:07:21.007 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-14T03:07:21.070 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-14T03:07:21.116 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:21.195 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-14T03:07:21.445 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-14T03:07:21.898 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-14T03:07:22.179 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-14T03:07:22.788 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-14T03:07:23.116 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_zh-tw.dll", hr=0x0 2026-09-14T03:07:24.226 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-14T03:07:24.741 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-14T03:07:24.773 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-14T03:07:24.804 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-14T03:07:24.804 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-14T03:07:24.835 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-14T03:07:24.976 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-14T03:07:25.241 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-14T03:07:25.273 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:25.366 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-14T03:07:25.773 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-14T03:07:25.835 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-14T03:07:25.851 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-14T03:07:25.913 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-14T03:07:26.054 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_hr.dll", hr=0x0 2026-09-14T03:07:26.460 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:26.632 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:26.663 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-14T03:07:26.710 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-14T03:07:26.741 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:27.195 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-14T03:07:27.570 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-14T03:07:27.585 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:28.054 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_th.dll", hr=0x0 2026-09-14T03:07:28.319 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-14T03:07:28.351 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-14T03:07:28.976 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:07:29.351 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-14T03:07:29.757 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-14T03:07:29.929 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:30.085 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:30.273 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-14T03:07:30.351 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ca-es-valencia.dll", hr=0x0 2026-09-14T03:07:30.491 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-14T03:07:30.569 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-14T03:07:30.616 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:31.179 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-14T03:07:31.507 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-14T03:07:31.554 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-14T03:07:31.616 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:07:31.976 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:07:32.179 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-14T03:07:32.194 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_gd.dll", hr=0x0 2026-09-14T03:07:32.319 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-14T03:07:32.476 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-14T03:07:32.507 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-14T03:07:32.616 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-14T03:07:33.179 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-14T03:07:33.617 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-14T03:07:33.726 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-14T03:07:33.835 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-14T03:07:33.976 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\microsoftedgeupdatebroker.exe", hr=0x0 2026-09-14T03:07:34.460 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-14T03:07:34.507 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:34.882 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-14T03:07:34.991 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-14T03:07:35.007 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-14T03:07:35.054 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-14T03:07:35.163 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-14T03:07:35.210 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-14T03:07:35.241 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-14T03:07:35.601 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-14T03:07:35.601 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-14T03:07:35.960 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-14T03:07:36.132 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:36.257 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-14T03:07:36.273 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-14T03:07:36.523 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:07:36.773 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-14T03:07:37.226 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:07:37.569 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-14T03:07:37.726 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-14T03:07:38.132 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-14T03:07:38.148 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:38.304 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-14T03:07:38.444 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-14T03:07:39.023 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-14T03:07:39.069 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-14T03:07:39.288 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:39.288 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-14T03:07:39.491 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-14T03:07:39.554 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-14T03:07:39.773 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:07:40.132 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:07:40.288 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-14T03:07:40.335 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-14T03:07:41.085 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-14T03:07:41.085 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-14T03:07:41.382 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-14T03:07:41.554 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-14T03:07:41.866 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-14T03:07:42.601 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fa.dll", hr=0x0 2026-09-14T03:07:42.616 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:07:42.788 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_de.dll", hr=0x0 2026-09-14T03:07:42.804 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-14T03:07:43.304 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-14T03:07:43.648 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-14T03:07:43.835 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-14T03:07:43.866 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:43.882 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-14T03:07:43.929 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ca.dll", hr=0x0 2026-09-14T03:07:43.991 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-14T03:07:44.273 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-14T03:07:44.663 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-14T03:07:44.726 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-14T03:07:44.976 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-14T03:07:45.007 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sl.dll", hr=0x0 2026-09-14T03:07:45.257 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-14T03:07:45.319 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-14T03:07:45.648 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:07:45.851 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-14T03:07:46.054 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-14T03:07:46.444 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_da.dll", hr=0x0 2026-09-14T03:07:46.819 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:07:46.898 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-14T03:07:46.991 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-14T03:07:47.038 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-14T03:07:48.069 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-14T03:07:48.148 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-14T03:07:48.273 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-14T03:07:48.413 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-14T03:07:48.648 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-14T03:07:48.882 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-14T03:07:49.648 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-14T03:07:49.694 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-14T03:07:49.726 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-14T03:07:49.804 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-14T03:07:49.913 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-14T03:07:50.273 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-14T03:07:50.413 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-14T03:07:50.444 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-14T03:07:50.460 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-14T03:07:50.538 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:50.585 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-14T03:07:50.632 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-14T03:07:50.991 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-14T03:07:51.038 Engine:Setting original file name "MicrosoftEdgeUpdate.exe" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\microsoftedgeupdatecore.exe", hr=0x0 2026-09-14T03:07:51.132 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-14T03:07:51.460 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-14T03:07:51.616 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:51.882 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-14T03:07:52.288 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-14T03:07:52.335 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-14T03:07:52.538 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-14T03:07:52.788 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-14T03:07:52.851 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-14T03:07:52.944 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:07:53.085 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:07:53.288 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-14T03:07:53.351 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-14T03:07:53.538 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:07:53.694 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-14T03:07:53.788 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:07:54.101 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:07:54.148 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-14T03:07:54.194 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-14T03:07:54.398 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-14T03:07:54.444 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-14T03:07:54.444 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-14T03:07:54.929 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-14T03:07:54.991 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:55.023 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_cs.dll", hr=0x0 2026-09-14T03:07:55.038 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-14T03:07:55.116 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:07:55.335 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:07:55.476 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-14T03:07:56.054 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-14T03:07:56.194 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-14T03:07:56.226 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_bn.dll", hr=0x0 2026-09-14T03:07:56.273 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-14T03:07:56.601 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-14T03:07:56.632 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-14T03:07:56.679 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-14T03:07:57.085 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-14T03:07:57.132 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-14T03:07:57.507 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-14T03:07:57.585 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-14T03:07:57.601 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\microsoftedgeupdateondemand.exe", hr=0x0 2026-09-14T03:07:57.648 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-14T03:07:57.648 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:57.663 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:57.710 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:07:57.710 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-14T03:07:57.726 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:57.991 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ja.dll", hr=0x0 2026-09-14T03:07:58.351 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-14T03:07:58.679 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-14T03:07:58.976 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:07:59.023 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-14T03:07:59.273 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_lv.dll", hr=0x0 2026-09-14T03:07:59.304 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:59.335 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:07:59.398 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sq.dll", hr=0x0 2026-09-14T03:07:59.460 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-14T03:07:59.460 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_eu.dll", hr=0x0 2026-09-14T03:07:59.788 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-14T03:07:59.804 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-14T03:08:00.038 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-14T03:08:00.069 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-14T03:08:00.210 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-14T03:08:00.304 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-14T03:08:00.304 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:00.616 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-14T03:08:00.663 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-14T03:08:00.663 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-14T03:08:00.819 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_az.dll", hr=0x0 2026-09-14T03:08:00.835 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-14T03:08:01.054 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:01.226 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-14T03:08:01.616 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\systemapps\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-14T03:08:01.757 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-14T03:08:01.898 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:02.116 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-14T03:08:02.273 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:02.288 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-14T03:08:02.288 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:08:02.554 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-14T03:08:02.569 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-14T03:08:02.804 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:02.944 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-14T03:08:02.976 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-14T03:08:03.819 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:08:03.819 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-14T03:08:03.944 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-14T03:08:04.085 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:08:04.085 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:08:04.241 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_hi.dll", hr=0x0 2026-09-14T03:08:04.976 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:08:05.429 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-14T03:08:05.632 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:05.648 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:05.819 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psuser.dll", hr=0x0 2026-09-14T03:08:05.866 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:05.898 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-14T03:08:06.007 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-14T03:08:06.116 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-14T03:08:06.116 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_el.dll", hr=0x0 2026-09-14T03:08:06.179 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-14T03:08:06.366 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.265.7\microsoftedgeupdatesetup_x86_1.3.265.7.exe", hr=0x0 2026-09-14T03:08:06.491 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-14T03:08:06.538 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:08:06.804 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:08:06.819 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:06.882 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-14T03:08:07.491 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-14T03:08:08.085 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-14T03:08:08.132 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:08.194 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-14T03:08:08.335 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:08:08.585 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:08.648 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-14T03:08:08.788 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sr.dll", hr=0x0 2026-09-14T03:08:09.179 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-14T03:08:09.679 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:09.710 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-14T03:08:09.991 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:08:10.148 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-14T03:08:10.366 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-14T03:08:10.382 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:10.663 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-14T03:08:11.085 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-14T03:08:11.132 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:11.241 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:11.398 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-14T03:08:11.429 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-14T03:08:11.819 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-14T03:08:11.944 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:12.132 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-14T03:08:12.148 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-14T03:08:12.179 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:12.226 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:08:12.382 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-14T03:08:12.460 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:08:12.476 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ka.dll", hr=0x0 2026-09-14T03:08:12.866 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-14T03:08:12.929 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_en.dll", hr=0x0 2026-09-14T03:08:12.960 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-14T03:08:13.398 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_pt-pt.dll", hr=0x0 2026-09-14T03:08:13.569 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-14T03:08:13.632 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-14T03:08:13.710 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-14T03:08:13.819 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-14T03:08:13.866 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:08:13.898 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-14T03:08:13.960 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-14T03:08:14.476 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-14T03:08:14.648 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-14T03:08:14.944 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-14T03:08:14.944 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-14T03:08:15.304 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-14T03:08:15.319 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:15.648 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-14T03:08:16.038 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-14T03:08:16.319 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-14T03:08:16.398 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-14T03:08:16.460 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-14T03:08:16.523 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:08:16.648 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-14T03:08:16.710 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-14T03:08:16.741 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-14T03:08:16.835 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-14T03:08:17.226 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-14T03:08:17.273 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:08:17.335 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:08:17.835 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-14T03:08:17.944 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:08:18.148 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-14T03:08:18.413 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-14T03:08:18.694 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_mk.dll", hr=0x0 2026-09-14T03:08:18.773 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-14T03:08:18.773 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:18.866 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ml.dll", hr=0x0 2026-09-14T03:08:19.179 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-14T03:08:19.194 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:19.241 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-14T03:08:19.476 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-14T03:08:19.741 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-14T03:08:19.757 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-14T03:08:20.101 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-14T03:08:20.194 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-14T03:08:20.319 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-14T03:08:20.429 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:08:20.460 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-14T03:08:20.616 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-14T03:08:20.851 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-14T03:08:21.038 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-14T03:08:21.116 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-14T03:08:21.304 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-14T03:08:22.804 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-14T03:08:23.257 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-14T03:08:23.413 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-14T03:08:23.648 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:08:23.679 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_tr.dll", hr=0x0 2026-09-14T03:08:23.929 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-14T03:08:24.101 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-14T03:08:24.398 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-14T03:08:24.663 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-14T03:08:24.773 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-14T03:08:24.804 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-14T03:08:24.804 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-14T03:08:24.944 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-14T03:08:25.273 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-14T03:08:25.304 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:25.304 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-14T03:08:25.398 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-14T03:08:25.429 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-14T03:08:25.538 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-14T03:08:25.866 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sk.dll", hr=0x0 2026-09-14T03:08:25.960 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-14T03:08:26.069 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-14T03:08:26.273 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-14T03:08:26.288 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:26.413 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-14T03:08:26.429 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-14T03:08:26.647 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-14T03:08:26.694 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:08:26.944 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-14T03:08:27.132 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_it.dll", hr=0x0 2026-09-14T03:08:27.304 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-14T03:08:27.382 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_ms.dll", hr=0x0 2026-09-14T03:08:27.757 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:08:28.241 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:28.319 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-14T03:08:28.819 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-14T03:08:29.210 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:08:29.304 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:29.585 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-14T03:08:29.882 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:29.944 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-14T03:08:30.132 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-14T03:08:30.304 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-14T03:08:30.788 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-14T03:08:31.554 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-14T03:08:31.632 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-14T03:08:31.726 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-14T03:08:32.351 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:32.491 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-14T03:08:32.851 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-14T03:08:32.929 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-14T03:08:33.054 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-14T03:08:33.054 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-14T03:08:33.601 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_lb.dll", hr=0x0 2026-09-14T03:08:33.616 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-14T03:08:33.726 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-14T03:08:33.741 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:33.773 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-14T03:08:34.085 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:34.101 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_quz.dll", hr=0x0 2026-09-14T03:08:34.101 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:08:34.335 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-14T03:08:34.460 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-14T03:08:34.663 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psmachine_arm64.dll", hr=0x0 2026-09-14T03:08:34.694 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\psmachine_64.dll", hr=0x0 2026-09-14T03:08:34.726 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fi.dll", hr=0x0 2026-09-14T03:08:34.804 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-14T03:08:35.319 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-14T03:08:35.429 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:08:35.648 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:35.882 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-14T03:08:36.273 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:36.351 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-14T03:08:36.554 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-14T03:08:36.616 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_id.dll", hr=0x0 2026-09-14T03:08:36.726 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-14T03:08:36.898 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:37.038 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-14T03:08:37.163 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_tt.dll", hr=0x0 2026-09-14T03:08:37.319 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-14T03:08:37.710 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-14T03:08:37.773 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-14T03:08:37.804 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-14T03:08:37.960 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:37.991 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-14T03:08:38.351 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_sr-cyrl-rs.dll", hr=0x0 2026-09-14T03:08:38.366 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-14T03:08:38.538 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-14T03:08:38.663 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:39.632 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-14T03:08:39.663 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_et.dll", hr=0x0 2026-09-14T03:08:40.226 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-14T03:08:40.272 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-14T03:08:40.319 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:40.366 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-14T03:08:40.694 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:40.757 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-14T03:08:40.960 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-14T03:08:41.054 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-14T03:08:41.116 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-14T03:08:41.179 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:41.273 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-14T03:08:41.476 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-14T03:08:41.554 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-14T03:08:41.991 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-14T03:08:42.085 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-14T03:08:42.163 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:08:42.163 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-14T03:08:42.179 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:42.194 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-14T03:08:42.335 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-14T03:08:42.351 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:08:42.366 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-14T03:08:42.429 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-14T03:08:42.851 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-14T03:08:42.882 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-14T03:08:43.257 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:08:43.319 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-14T03:08:43.335 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-14T03:08:43.351 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-14T03:08:44.319 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-14T03:08:44.460 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:08:44.647 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:08:44.663 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-14T03:08:44.851 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:45.054 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-14T03:08:45.210 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-14T03:08:45.288 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_nb.dll", hr=0x0 2026-09-14T03:08:45.304 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:46.085 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-14T03:08:46.116 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-14T03:08:46.272 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-14T03:08:46.304 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-14T03:08:46.304 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:08:46.788 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:08:46.788 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-14T03:08:46.929 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-14T03:08:46.944 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-14T03:08:47.101 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-14T03:08:47.538 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-14T03:08:47.976 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-14T03:08:48.241 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:48.710 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-14T03:08:49.007 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-14T03:08:49.069 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-14T03:08:49.241 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-14T03:08:49.273 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-14T03:08:49.351 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-14T03:08:49.444 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-14T03:08:49.554 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-14T03:08:49.554 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:08:49.819 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-14T03:08:49.913 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-14T03:08:50.210 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-14T03:08:50.319 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-14T03:08:50.476 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-14T03:08:50.507 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:08:50.616 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_nn.dll", hr=0x0 2026-09-14T03:08:50.663 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\de-de\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:50.835 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-console-l1-1-0.dll", hr=0x0 2026-09-14T03:08:50.991 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0 2026-09-14T03:08:50.991 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-registry-l2-1-0.dll", hr=0x0 2026-09-14T03:08:51.335 Engine:Setting original file name "MrmCore.dll" for "c:\windows\winsxs\wow64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.20348.5020_none_9e6a80bbc86408d7\mrmcorer.dll", hr=0x0 2026-09-14T03:08:51.351 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:51.476 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_en-gb_56416fd74780e848\vsswmi.dll.mui", hr=0x0 2026-09-14T03:08:51.491 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\es-es\aerolite.msstyles.mui", hr=0x0 2026-09-14T03:08:51.663 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_7573f1c6d4639f87\penimc.dll", hr=0x0 2026-09-14T03:08:51.694 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.data.winmd", hr=0x0 2026-09-14T03:08:51.882 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\de-de\ndisimplatcim.dll.mui", hr=0x0 2026-09-14T03:08:51.960 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_4e347e352039867c\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:52.069 Engine:Setting original file name "winsqlite3" for "c:\windows\winsxs\wow64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.20348.4647_none_c9096b99901f19cd\winsqlite3.dll", hr=0x0 2026-09-14T03:08:52.116 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0 2026-09-14T03:08:52.132 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000c.dll", hr=0x0 2026-09-14T03:08:52.319 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.265.7\msedgeupdateres_fr-ca.dll", hr=0x0 2026-09-14T03:08:52.491 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-1-0.dll", hr=0x0 2026-09-14T03:08:52.507 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata000a.dll", hr=0x0 2026-09-14T03:08:52.804 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-2-0.dll", hr=0x0 2026-09-14T03:08:52.898 Engine:Setting original file name "wmic.exe" for "c:\windows\winsxs\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.20348.2849_none_54405a5933961199\wmic.exe", hr=0x0 2026-09-14T03:08:53.054 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.storage.winmd", hr=0x0 2026-09-14T03:08:53.382 Engine:Setting original file name "CRYPT32.DLL" for "c:\windows\systemresources\crypt32.dll.mun", hr=0x0 2026-09-14T03:08:53.632 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_7d8ffbc5cb37c8e0\bootmgr.exe.mui", hr=0x0 2026-09-14T03:08:53.694 Engine:Setting original file name "mstsc.exe" for "c:\windows\systemresources\mstsc.exe.mun", hr=0x0 2026-09-14T03:08:53.897 Engine:Setting original file name "SYSTEMCPL.DLL" for "c:\windows\systemresources\systemcpl.dll.mun", hr=0x0 2026-09-14T03:08:53.944 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0 2026-09-14T03:08:54.101 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1e6e07718388e886\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:54.163 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0 2026-09-14T03:08:54.866 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0 2026-09-14T03:08:54.866 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mpg4decd_31bf3856ad364e35_10.0.20348.2849_none_08e768f194682e23\mpg4decd.dll", hr=0x0 2026-09-14T03:08:54.882 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0 2026-09-14T03:08:54.929 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0 2026-09-14T03:08:55.163 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-1.dll", hr=0x0 2026-09-14T03:08:55.179 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\naturallanguage6.dll", hr=0x0 2026-09-14T03:08:55.726 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0 2026-09-14T03:08:56.007 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0 2026-09-14T03:08:56.366 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ja-jp_5634cc97d85965d9\bootmgr_ex.efi.mui", hr=0x0 2026-09-14T03:08:56.382 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0 2026-09-14T03:08:56.648 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_d7c56d20c9fb1c22\diagpackage.dll.mui", hr=0x0 2026-09-14T03:08:56.960 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgfw_ex.efi.mui", hr=0x0 2026-09-14T03:08:57.069 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mpg4decd.dll", hr=0x0 2026-09-14T03:08:57.288 Engine:Setting original file name "SYSMON.OCX" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\sysmon.ocx.mun", hr=0x0 2026-09-14T03:08:57.351 OriginalFileName Maintenance::28165 files in Moac, 0 skipped (cached), 592 filename set 2026-09-14T03:08:57.351 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-14T03:15:27.850 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T03:18:18.381 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-14T03:18:18.397 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-14T03:18:18.397 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-14T03:18:18.397 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-14T03:18:18.397 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-14T03:18:18.397 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-14T03:18:18.397 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-14T03:18:18.397 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-14T03:18:18.397 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-14T03:18:18.397 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-14T03:18:18.397 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-14T03:18:18.397 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-14T03:18:18.397 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:18:18.397 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-14T03:18:18.397 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-14T03:18:18.397 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-14T03:18:18.397 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:18:18.397 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-14T03:18:18.397 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-14T03:18:18.397 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-14T03:18:18.397 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-14T03:18:18.397 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-14T03:18:18.397 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-14T03:18:18.413 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:18:18.413 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:18:18.413 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:18:20.975 [RTP] Duplicating the current plugin configuration object... 2026-09-14T03:18:20.975 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-14T03:18:20.975 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-14T03:18:20.975 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-14T03:18:20.975 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-14T03:18:20.975 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-14T03:28:46.896 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 16529, Count: 863, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-14T03:28:46.896 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 16211, Count: 791, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T03:28:46.896 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-14T03:28:46.896 ProcessImageName: WmiPrvSE.exe, Pid: 2908, TotalTime: 708, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-14T03:28:46.896 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 546, Count: 31, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-14T03:28:46.896 ProcessImageName: WmiPrvSE.exe, Pid: 1432, TotalTime: 348, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 35% 2026-09-14T03:28:46.896 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-14T03:28:46.896 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T03:28:46.896 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-14T03:28:46.896 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-14T03:28:46.896 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 91, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-14T03:28:46.896 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-2.MAD, EstimatedImpact: 30% 2026-09-14T03:28:46.896 ProcessImageName: DeviceCensus.exe, Pid: 5068, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 6% 2026-09-14T03:28:46.896 ProcessImageName: mysqldump.exe, Pid: 7272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-14T03:28:46.896 ProcessImageName: cmd.exe, Pid: 6656, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-14T03:28:46.896 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T03:28:46.896 ProcessImageName: powershell.exe, Pid: 2876, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-14T03:28:46.896 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-14T03:30:32.850 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T03:45:37.849 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T03:46:46.458 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:46:46.458 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:46:46.458 [Cloud] Queued cloud request. 2026-09-14T03:46:46.458 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:46:46.458 [Cloud] Dequeued cloud request. 2026-09-14T03:46:46.458 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:46:46.630 [Cloud] End of cloud request. 2026-09-14T03:46:47.146 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:47:08.990 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:47:08.990 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:47:08.990 [Cloud] Queued cloud request. 2026-09-14T03:47:08.990 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:47:08.990 [Cloud] Dequeued cloud request. 2026-09-14T03:47:08.990 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:47:09.068 [Cloud] End of cloud request. 2026-09-14T03:47:09.583 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:47:31.474 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:47:31.474 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:47:31.474 [Cloud] Queued cloud request. 2026-09-14T03:47:31.474 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:47:31.474 [Cloud] Dequeued cloud request. 2026-09-14T03:47:31.474 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:47:31.614 [Cloud] End of cloud request. 2026-09-14T03:47:32.114 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{05E13FF6-E71E-524E-85E3-B1517A04D46F} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-14-2026 03:47:44 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T03:47:45.895 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:47:45.895 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:47:45.895 [Cloud] Queued cloud request. 2026-09-14T03:47:45.895 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:47:45.895 [Cloud] Dequeued cloud request. 2026-09-14T03:47:45.895 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:47:46.161 [Cloud] End of cloud request. 2026-09-14T03:47:46.677 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:47:50.286 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:47:50.286 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:47:50.286 [Cloud] Queued cloud request. 2026-09-14T03:47:50.286 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:47:50.286 [Cloud] Dequeued cloud request. 2026-09-14T03:47:50.286 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:47:50.395 [Cloud] End of cloud request. 2026-09-14T03:47:50.895 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:48:13.333 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:48:13.333 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:48:13.333 [Cloud] Queued cloud request. 2026-09-14T03:48:13.333 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:48:13.333 [Cloud] Dequeued cloud request. 2026-09-14T03:48:13.333 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:48:13.411 [Cloud] End of cloud request. 2026-09-14T03:48:13.911 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:48:14.927 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:48:14.927 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:48:14.927 [Cloud] Queued cloud request. 2026-09-14T03:48:14.927 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:48:14.927 [Cloud] Dequeued cloud request. 2026-09-14T03:48:14.927 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:48:15.005 [Cloud] End of cloud request. 2026-09-14T03:48:15.520 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:49:59.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:49:59.145 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:49:59.145 [Cloud] Queued cloud request. 2026-09-14T03:49:59.145 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:49:59.145 [Cloud] Dequeued cloud request. 2026-09-14T03:49:59.145 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:49:59.317 [Cloud] End of cloud request. 2026-09-14T03:49:59.833 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:50:09.067 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:50:09.067 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:50:09.067 [Cloud] Queued cloud request. 2026-09-14T03:50:09.067 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:50:09.067 [Cloud] Dequeued cloud request. 2026-09-14T03:50:09.067 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:50:09.145 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DAA96850-C0C8-B10E-738D-4958E1E1F478} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 03:50:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T03:50:09.645 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:50:42.895 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:50:42.895 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:50:42.895 [Cloud] Queued cloud request. 2026-09-14T03:50:42.895 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:50:42.895 [Cloud] Dequeued cloud request. 2026-09-14T03:50:42.895 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:50:42.989 [Cloud] End of cloud request. 2026-09-14T03:50:43.505 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:50:58.989 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:50:58.989 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:50:58.989 [Cloud] Queued cloud request. 2026-09-14T03:50:58.989 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:50:58.989 [Cloud] Dequeued cloud request. 2026-09-14T03:50:58.989 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:50:59.067 [Cloud] End of cloud request. 2026-09-14T03:50:59.567 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:51:18.661 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:51:18.661 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:51:18.661 [Cloud] Queued cloud request. 2026-09-14T03:51:18.661 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:51:18.661 [Cloud] Dequeued cloud request. 2026-09-14T03:51:18.661 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:51:18.739 [Cloud] End of cloud request. 2026-09-14T03:51:19.239 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:52:34.864 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:52:34.864 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:52:34.864 [Cloud] Queued cloud request. 2026-09-14T03:52:34.864 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:52:34.864 [Cloud] Dequeued cloud request. 2026-09-14T03:52:34.864 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:52:35.005 [Cloud] End of cloud request. 2026-09-14T03:52:35.505 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:52:36.442 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:52:36.442 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:52:36.442 [Cloud] Queued cloud request. 2026-09-14T03:52:36.442 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:52:36.442 [Cloud] Dequeued cloud request. 2026-09-14T03:52:36.442 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:52:36.520 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5BAB08D1-633F-C2E2-017A-7E918D33CB11} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 03:52:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T03:52:37.020 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:52:44.661 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:52:44.661 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:52:44.661 [Cloud] Queued cloud request. 2026-09-14T03:52:44.661 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:52:44.661 [Cloud] Dequeued cloud request. 2026-09-14T03:52:44.661 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:52:44.739 [Cloud] End of cloud request. 2026-09-14T03:52:45.239 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:52:57.520 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:52:57.520 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:52:57.520 [Cloud] Queued cloud request. 2026-09-14T03:52:57.520 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:52:57.520 [Cloud] Dequeued cloud request. 2026-09-14T03:52:57.536 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:52:57.598 [Cloud] End of cloud request. 2026-09-14T03:52:58.114 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:54:31.755 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:54:31.755 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:54:31.755 [Cloud] Queued cloud request. 2026-09-14T03:54:31.755 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:54:31.755 [Cloud] Dequeued cloud request. 2026-09-14T03:54:31.755 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:54:31.911 [Cloud] End of cloud request. 2026-09-14T03:54:32.426 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:54:44.005 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:54:44.005 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:54:44.005 [Cloud] Queued cloud request. 2026-09-14T03:54:44.005 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:54:44.005 [Cloud] Dequeued cloud request. 2026-09-14T03:54:44.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:54:44.083 [Cloud] End of cloud request. 2026-09-14T03:54:44.598 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:55:25.958 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:55:25.958 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:55:25.958 [Cloud] Queued cloud request. 2026-09-14T03:55:25.958 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:55:25.958 [Cloud] Dequeued cloud request. 2026-09-14T03:55:25.958 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:55:26.051 [Cloud] End of cloud request. 2026-09-14T03:55:26.551 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:55:27.958 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:55:27.958 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:55:27.958 [Cloud] Queued cloud request. 2026-09-14T03:55:27.958 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:55:27.958 [Cloud] Dequeued cloud request. 2026-09-14T03:55:27.958 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:55:28.036 [Cloud] End of cloud request. 2026-09-14T03:55:28.551 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:55:49.067 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:55:49.067 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:55:49.067 [Cloud] Queued cloud request. 2026-09-14T03:55:49.067 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:55:49.067 [Cloud] Dequeued cloud request. 2026-09-14T03:55:49.067 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:55:49.145 [Cloud] End of cloud request. 2026-09-14T03:55:49.661 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:56:07.130 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:56:07.130 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:56:07.130 [Cloud] Queued cloud request. 2026-09-14T03:56:07.130 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:56:07.130 [Cloud] Dequeued cloud request. 2026-09-14T03:56:07.130 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:56:07.411 [Cloud] End of cloud request. 2026-09-14T03:56:07.426 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:56:07.426 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:56:07.426 [Cloud] Queued cloud request. 2026-09-14T03:56:07.426 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:56:07.426 [Cloud] Dequeued cloud request. 2026-09-14T03:56:07.426 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:56:07.911 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:56:08.551 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{04B0744C-CE4D-E4CF-8EA8-401197205F2C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 03:56:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T03:56:09.051 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:56:15.348 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:56:15.348 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:56:15.348 [Cloud] Queued cloud request. 2026-09-14T03:56:15.348 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:56:15.348 [Cloud] Dequeued cloud request. 2026-09-14T03:56:15.348 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:56:15.426 [Cloud] End of cloud request. 2026-09-14T03:56:15.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:56:19.770 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:56:19.770 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:56:19.770 [Cloud] Queued cloud request. 2026-09-14T03:56:19.770 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:56:19.770 [Cloud] Dequeued cloud request. 2026-09-14T03:56:19.770 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:56:20.614 [Cloud] End of cloud request. 2026-09-14T03:56:21.130 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:57:33.598 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:57:33.598 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:57:33.598 [Cloud] Queued cloud request. 2026-09-14T03:57:33.598 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:57:33.598 [Cloud] Dequeued cloud request. 2026-09-14T03:57:33.598 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:57:33.739 [Cloud] End of cloud request. 2026-09-14T03:57:34.239 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:57:35.192 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:57:35.192 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:57:35.192 [Cloud] Queued cloud request. 2026-09-14T03:57:35.192 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:57:35.192 [Cloud] Dequeued cloud request. 2026-09-14T03:57:35.192 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:57:45.223 [Cloud] End of cloud request. 2026-09-14T03:57:45.739 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T03:59:35.926 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T03:59:35.926 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T03:59:35.926 [Cloud] Queued cloud request. 2026-09-14T03:59:35.926 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T03:59:35.926 [Cloud] Dequeued cloud request. 2026-09-14T03:59:35.926 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T03:59:36.098 [Cloud] End of cloud request. 2026-09-14T03:59:36.598 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:00:12.442 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:00:12.442 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:00:12.442 [Cloud] Queued cloud request. 2026-09-14T04:00:12.442 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:00:12.442 [Cloud] Dequeued cloud request. 2026-09-14T04:00:12.442 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:00:12.535 [Cloud] End of cloud request. 2026-09-14T04:00:13.035 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:00:38.379 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:00:38.379 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:00:38.379 [Cloud] Queued cloud request. 2026-09-14T04:00:38.379 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:00:38.379 [Cloud] Dequeued cloud request. 2026-09-14T04:00:38.379 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:00:38.457 [Cloud] End of cloud request. 2026-09-14T04:00:38.957 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:00:42.848 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T04:00:55.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:00:55.145 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:00:55.145 [Cloud] Queued cloud request. 2026-09-14T04:00:55.145 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:00:55.145 [Cloud] Dequeued cloud request. 2026-09-14T04:00:55.145 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:00:55.238 [Cloud] End of cloud request. 2026-09-14T04:00:55.738 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:01:30.129 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:01:30.129 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:01:30.129 [Cloud] Queued cloud request. 2026-09-14T04:01:30.129 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:01:30.129 [Cloud] Dequeued cloud request. 2026-09-14T04:01:30.129 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:01:30.207 [Cloud] End of cloud request. 2026-09-14T04:01:30.707 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:01:39.504 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:01:39.504 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:01:39.504 [Cloud] Queued cloud request. 2026-09-14T04:01:39.504 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:01:39.504 [Cloud] Dequeued cloud request. 2026-09-14T04:01:39.504 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:01:39.582 [Cloud] End of cloud request. 2026-09-14T04:01:40.098 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:02:50.317 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:02:50.317 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:02:50.317 [Cloud] Queued cloud request. 2026-09-14T04:02:50.317 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:02:50.317 [Cloud] Dequeued cloud request. 2026-09-14T04:02:50.317 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:02:50.520 [Cloud] End of cloud request. 2026-09-14T04:02:51.020 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:04:11.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:04:11.145 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:04:11.145 [Cloud] Queued cloud request. 2026-09-14T04:04:11.145 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:04:11.145 [Cloud] Dequeued cloud request. 2026-09-14T04:04:11.145 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:04:11.285 [Cloud] End of cloud request. 2026-09-14T04:04:11.801 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:04:23.723 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:04:23.723 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:04:23.723 [Cloud] Queued cloud request. 2026-09-14T04:04:23.723 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:04:23.723 [Cloud] Dequeued cloud request. 2026-09-14T04:04:23.723 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:04:23.801 [Cloud] End of cloud request. 2026-09-14T04:04:24.301 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:04:48.098 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:04:48.098 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:04:48.098 [Cloud] Queued cloud request. 2026-09-14T04:04:48.098 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:04:48.098 [Cloud] Dequeued cloud request. 2026-09-14T04:04:48.098 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:04:48.192 [Cloud] End of cloud request. 2026-09-14T04:04:48.692 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:06:22.004 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:06:22.004 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:06:22.004 [Cloud] Queued cloud request. 2026-09-14T04:06:22.004 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:06:22.004 [Cloud] Dequeued cloud request. 2026-09-14T04:06:22.004 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:06:22.145 [Cloud] End of cloud request. 2026-09-14T04:06:22.660 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:06:34.910 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:06:34.910 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:06:34.910 [Cloud] Queued cloud request. 2026-09-14T04:06:34.910 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:06:34.910 [Cloud] Dequeued cloud request. 2026-09-14T04:06:34.910 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:06:34.988 [Cloud] End of cloud request. 2026-09-14T04:06:35.488 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:06:36.691 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:06:36.691 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:06:36.691 [Cloud] Queued cloud request. 2026-09-14T04:06:36.691 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:06:36.691 [Cloud] Dequeued cloud request. 2026-09-14T04:06:36.691 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:06:36.770 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{214C1BC8-D913-AF0D-6673-AE5089D6CE15} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 04:06:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T04:06:37.270 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:06:43.285 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:06:43.285 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:06:43.285 [Cloud] Queued cloud request. 2026-09-14T04:06:43.285 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:06:43.285 [Cloud] Dequeued cloud request. 2026-09-14T04:06:43.285 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:06:43.395 [Cloud] End of cloud request. 2026-09-14T04:06:43.910 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:08:17.894 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:08:17.894 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:08:17.894 [Cloud] Queued cloud request. 2026-09-14T04:08:17.894 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:08:17.894 [Cloud] Dequeued cloud request. 2026-09-14T04:08:17.894 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:08:18.113 [Cloud] End of cloud request. 2026-09-14T04:08:18.613 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:08:20.535 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:08:20.535 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:08:20.535 [Cloud] Queued cloud request. 2026-09-14T04:08:20.535 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:08:20.535 [Cloud] Dequeued cloud request. 2026-09-14T04:08:20.535 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:08:20.613 [Cloud] End of cloud request. 2026-09-14T04:08:21.129 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:08:57.754 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:08:57.754 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:08:57.754 [Cloud] Queued cloud request. 2026-09-14T04:08:57.754 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:08:57.754 [Cloud] Dequeued cloud request. 2026-09-14T04:08:57.754 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:08:57.879 [Cloud] End of cloud request. 2026-09-14T04:08:58.394 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:08:58.785 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:08:58.785 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:08:58.785 [Cloud] Queued cloud request. 2026-09-14T04:08:58.785 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:08:58.785 [Cloud] Dequeued cloud request. 2026-09-14T04:08:58.785 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:08:58.863 [Cloud] End of cloud request. 2026-09-14T04:08:59.379 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:10:28.316 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:10:28.316 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:10:28.316 [Cloud] Queued cloud request. 2026-09-14T04:10:28.316 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:10:28.316 [Cloud] Dequeued cloud request. 2026-09-14T04:10:28.332 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:10:28.519 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{029AEABC-0F58-3CC0-FBA5-41E61EFA46A6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 04:10:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T04:10:29.035 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:10:52.144 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:10:52.144 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:10:52.144 [Cloud] Queued cloud request. 2026-09-14T04:10:52.144 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:10:52.144 [Cloud] Dequeued cloud request. 2026-09-14T04:10:52.144 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:10:52.222 [Cloud] End of cloud request. 2026-09-14T04:10:52.722 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:11:05.128 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:11:05.128 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:11:05.128 [Cloud] Queued cloud request. 2026-09-14T04:11:05.128 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:11:05.128 [Cloud] Dequeued cloud request. 2026-09-14T04:11:05.128 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:11:05.300 [Cloud] End of cloud request. 2026-09-14T04:11:05.816 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:12:23.410 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:12:23.410 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:12:23.410 [Cloud] Queued cloud request. 2026-09-14T04:12:23.410 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:12:23.410 [Cloud] Dequeued cloud request. 2026-09-14T04:12:23.410 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:12:23.597 [Cloud] End of cloud request. 2026-09-14T04:12:24.113 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:13:11.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:13:11.925 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:13:11.925 [Cloud] Queued cloud request. 2026-09-14T04:13:11.925 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:13:11.925 [Cloud] Dequeued cloud request. 2026-09-14T04:13:11.925 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:13:12.019 [Cloud] End of cloud request. 2026-09-14T04:13:12.519 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:13:53.503 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:13:53.503 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:13:53.503 [Cloud] Queued cloud request. 2026-09-14T04:13:53.503 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:13:53.503 [Cloud] Dequeued cloud request. 2026-09-14T04:13:53.503 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:13:53.597 [Cloud] End of cloud request. 2026-09-14T04:13:54.082 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:14:43.425 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:14:43.425 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:14:43.425 [Cloud] Queued cloud request. 2026-09-14T04:14:43.425 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:14:43.425 [Cloud] Dequeued cloud request. 2026-09-14T04:14:43.425 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:14:43.566 [Cloud] End of cloud request. 2026-09-14T04:14:44.082 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:15:36.675 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:15:36.675 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:15:36.675 [Cloud] Queued cloud request. 2026-09-14T04:15:36.675 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:15:36.675 [Cloud] Dequeued cloud request. 2026-09-14T04:15:36.675 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:15:36.785 [Cloud] End of cloud request. 2026-09-14T04:15:37.285 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:15:47.847 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T04:16:01.957 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:16:01.957 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:16:01.957 [Cloud] Queued cloud request. 2026-09-14T04:16:01.957 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:16:01.957 [Cloud] Dequeued cloud request. 2026-09-14T04:16:01.957 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:16:02.035 [Cloud] End of cloud request. 2026-09-14T04:16:02.550 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:16:41.331 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:16:41.331 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:16:41.331 [Cloud] Queued cloud request. 2026-09-14T04:16:41.331 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:16:41.347 [Cloud] Dequeued cloud request. 2026-09-14T04:16:41.347 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:16:41.425 [Cloud] End of cloud request. 2026-09-14T04:16:41.941 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:16:53.691 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:16:53.691 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:16:53.691 [Cloud] Queued cloud request. 2026-09-14T04:16:53.691 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:16:53.691 [Cloud] Dequeued cloud request. 2026-09-14T04:16:53.691 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:16:53.769 [Cloud] End of cloud request. 2026-09-14T04:16:54.285 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:18:50.472 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:18:50.472 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:18:50.472 [Cloud] Queued cloud request. 2026-09-14T04:18:50.472 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:18:50.472 [Cloud] Dequeued cloud request. 2026-09-14T04:18:50.472 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:19:00.628 [Cloud] End of cloud request. 2026-09-14T04:19:01.128 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:19:51.847 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:19:51.847 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:19:51.847 [Cloud] Queued cloud request. 2026-09-14T04:19:51.847 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:19:51.847 [Cloud] Dequeued cloud request. 2026-09-14T04:19:51.847 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:19:51.925 [Cloud] End of cloud request. 2026-09-14T04:19:52.425 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:20:51.987 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:20:51.987 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:20:51.987 [Cloud] Queued cloud request. 2026-09-14T04:20:51.987 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:20:51.987 [Cloud] Dequeued cloud request. 2026-09-14T04:20:51.987 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:20:56.191 [Cloud] End of cloud request. 2026-09-14T04:20:56.691 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:23:29.378 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:23:29.378 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:23:29.378 [Cloud] Queued cloud request. 2026-09-14T04:23:29.378 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:23:29.378 [Cloud] Dequeued cloud request. 2026-09-14T04:23:29.378 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:23:29.597 [Cloud] End of cloud request. 2026-09-14T04:23:30.112 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:23:32.112 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:23:32.112 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:23:32.112 [Cloud] Queued cloud request. 2026-09-14T04:23:32.112 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:23:32.112 [Cloud] Dequeued cloud request. 2026-09-14T04:23:32.112 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:23:32.191 [Cloud] End of cloud request. 2026-09-14T04:23:32.706 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:26:41.362 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:26:41.362 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:26:41.362 [Cloud] Queued cloud request. 2026-09-14T04:26:41.362 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:26:41.378 [Cloud] Dequeued cloud request. 2026-09-14T04:26:41.378 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:26:41.550 [Cloud] End of cloud request. 2026-09-14T04:26:42.050 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:26:52.331 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:26:52.331 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:26:52.331 [Cloud] Queued cloud request. 2026-09-14T04:26:52.331 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:26:52.331 [Cloud] Dequeued cloud request. 2026-09-14T04:26:52.331 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:26:52.409 [Cloud] End of cloud request. 2026-09-14T04:26:52.909 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:27:24.315 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:27:24.315 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:27:24.315 [Cloud] Queued cloud request. 2026-09-14T04:27:24.315 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:27:24.315 [Cloud] Dequeued cloud request. 2026-09-14T04:27:24.315 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:27:24.721 [Cloud] End of cloud request. 2026-09-14T04:27:25.221 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:27:33.331 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:27:33.331 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:27:33.331 [Cloud] Queued cloud request. 2026-09-14T04:27:33.331 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:27:33.331 [Cloud] Dequeued cloud request. 2026-09-14T04:27:33.331 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:27:33.409 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{39D1B533-50B3-C88F-FCAE-C23F54B39142} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 04:27:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T04:27:33.909 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:28:22.628 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:28:22.628 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:28:22.628 [Cloud] Queued cloud request. 2026-09-14T04:28:22.628 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:28:22.628 [Cloud] Dequeued cloud request. 2026-09-14T04:28:22.628 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:28:22.706 [Cloud] End of cloud request. 2026-09-14T04:28:23.221 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:30:22.877 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:30:22.877 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:30:22.877 [Cloud] Queued cloud request. 2026-09-14T04:30:22.877 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:30:22.877 [Cloud] Dequeued cloud request. 2026-09-14T04:30:22.877 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:30:23.081 [Cloud] End of cloud request. 2026-09-14T04:30:23.581 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:30:47.674 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:30:47.674 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:30:47.674 [Cloud] Queued cloud request. 2026-09-14T04:30:47.674 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:30:47.674 [Cloud] Dequeued cloud request. 2026-09-14T04:30:47.674 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:30:47.815 [Cloud] End of cloud request. 2026-09-14T04:30:48.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:30:52.846 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T04:31:20.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:31:20.643 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:31:20.643 [Cloud] Queued cloud request. 2026-09-14T04:31:20.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:31:20.643 [Cloud] Dequeued cloud request. 2026-09-14T04:31:20.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:31:24.659 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:31:24.659 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:31:24.659 [Cloud] Queued cloud request. 2026-09-14T04:31:24.659 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:31:24.659 [Cloud] Dequeued cloud request. 2026-09-14T04:31:24.674 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:31:24.799 [Cloud] End of cloud request. 2026-09-14T04:31:25.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:31:30.674 [Cloud] End of cloud request. 2026-09-14T04:31:31.190 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:31:49.752 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:31:49.752 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:31:49.752 [Cloud] Queued cloud request. 2026-09-14T04:31:49.752 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:31:49.752 [Cloud] Dequeued cloud request. 2026-09-14T04:31:49.752 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:31:49.971 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8CBC8090-2E88-197F-10F2-D4D254CE4478} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 04:31:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T04:31:50.487 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:32:43.768 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:32:43.768 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:32:43.768 [Cloud] Queued cloud request. 2026-09-14T04:32:43.768 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:32:43.768 [Cloud] Dequeued cloud request. 2026-09-14T04:32:43.768 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:32:43.877 [Cloud] End of cloud request. 2026-09-14T04:32:44.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:33:21.940 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:33:21.940 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:33:21.940 [Cloud] Queued cloud request. 2026-09-14T04:33:21.940 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:33:21.940 [Cloud] Dequeued cloud request. 2026-09-14T04:33:21.940 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:33:22.034 [Cloud] End of cloud request. 2026-09-14T04:33:22.549 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:33:35.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:33:35.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:33:35.049 [Cloud] Queued cloud request. 2026-09-14T04:33:35.049 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:33:35.049 [Cloud] Dequeued cloud request. 2026-09-14T04:33:35.049 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:33:35.159 [Cloud] End of cloud request. 2026-09-14T04:33:35.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:33:45.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:33:45.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:33:45.049 [Cloud] Queued cloud request. 2026-09-14T04:33:45.049 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:33:45.049 [Cloud] Dequeued cloud request. 2026-09-14T04:33:45.049 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:33:55.065 [Cloud] End of cloud request. 2026-09-14T04:33:55.565 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:34:08.721 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:34:08.721 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:34:08.721 [Cloud] Queued cloud request. 2026-09-14T04:34:08.721 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:34:08.721 [Cloud] Dequeued cloud request. 2026-09-14T04:34:08.721 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:34:08.815 [Cloud] End of cloud request. 2026-09-14T04:34:09.331 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:35:04.502 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:35:04.502 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:35:04.502 [Cloud] Queued cloud request. 2026-09-14T04:35:04.502 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:35:04.502 [Cloud] Dequeued cloud request. 2026-09-14T04:35:04.502 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:35:04.674 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{66CE61D6-B089-C717-A388-EB8A411461CE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 04:35:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T04:35:05.174 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:35:27.377 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:35:27.377 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:35:27.377 [Cloud] Queued cloud request. 2026-09-14T04:35:27.377 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:35:27.377 [Cloud] Dequeued cloud request. 2026-09-14T04:35:27.377 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:35:27.955 [Cloud] End of cloud request. 2026-09-14T04:35:28.471 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:35:34.080 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:35:34.080 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:35:34.080 [Cloud] Queued cloud request. 2026-09-14T04:35:34.080 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:35:34.080 [Cloud] Dequeued cloud request. 2026-09-14T04:35:34.080 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:35:34.158 [Cloud] End of cloud request. 2026-09-14T04:35:34.658 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:36:36.080 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:36:36.080 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:36:36.080 [Cloud] Queued cloud request. 2026-09-14T04:36:36.080 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:36:36.080 [Cloud] Dequeued cloud request. 2026-09-14T04:36:36.080 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:36:36.299 [Cloud] End of cloud request. 2026-09-14T04:36:36.799 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:37:09.018 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:37:09.018 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:37:09.018 [Cloud] Queued cloud request. 2026-09-14T04:37:09.018 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:37:09.018 [Cloud] Dequeued cloud request. 2026-09-14T04:37:09.018 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:37:18.596 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:37:18.596 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:37:18.596 [Cloud] Queued cloud request. 2026-09-14T04:37:18.596 [Cloud] Dequeued cloud request. 2026-09-14T04:37:18.596 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:37:18.596 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:37:18.752 [Cloud] End of cloud request. 2026-09-14T04:37:19.049 [Cloud] End of cloud request. 2026-09-14T04:37:19.252 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:38:15.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:38:15.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:38:15.049 [Cloud] Queued cloud request. 2026-09-14T04:38:15.049 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:38:15.049 [Cloud] Dequeued cloud request. 2026-09-14T04:38:15.049 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:38:15.127 [Cloud] End of cloud request. 2026-09-14T04:38:15.627 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:40:50.721 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:40:50.721 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:40:50.721 [Cloud] Queued cloud request. 2026-09-14T04:40:50.721 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:40:50.721 [Cloud] Dequeued cloud request. 2026-09-14T04:40:50.721 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:40:50.939 [Cloud] End of cloud request. 2026-09-14T04:40:51.439 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:42:45.471 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:42:45.471 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:42:45.471 [Cloud] Queued cloud request. 2026-09-14T04:42:45.471 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:42:45.471 [Cloud] Dequeued cloud request. 2026-09-14T04:42:45.486 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:42:45.674 [Cloud] End of cloud request. 2026-09-14T04:42:46.189 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:43:41.924 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:43:41.924 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:43:41.924 [Cloud] Queued cloud request. 2026-09-14T04:43:41.924 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:43:41.924 [Cloud] Dequeued cloud request. 2026-09-14T04:43:41.924 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:43:42.033 [Cloud] End of cloud request. 2026-09-14T04:43:42.533 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:43:47.705 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:43:47.705 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:43:47.705 [Cloud] Queued cloud request. 2026-09-14T04:43:47.705 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:43:47.705 [Cloud] Dequeued cloud request. 2026-09-14T04:43:47.705 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:43:47.783 [Cloud] End of cloud request. 2026-09-14T04:43:48.299 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:44:07.877 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:44:07.877 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:44:07.877 [Cloud] Queued cloud request. 2026-09-14T04:44:07.877 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:44:07.877 [Cloud] Dequeued cloud request. 2026-09-14T04:44:07.877 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:44:08.095 [Cloud] End of cloud request. 2026-09-14T04:44:08.611 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:44:57.048 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:44:57.048 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:44:57.048 [Cloud] Queued cloud request. 2026-09-14T04:44:57.048 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:44:57.048 [Cloud] Dequeued cloud request. 2026-09-14T04:44:57.048 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:44:57.127 [Cloud] End of cloud request. 2026-09-14T04:44:57.642 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:45:21.783 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:45:21.783 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:45:21.783 [Cloud] Queued cloud request. 2026-09-14T04:45:21.783 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:45:21.783 [Cloud] Dequeued cloud request. 2026-09-14T04:45:21.783 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:45:21.861 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{174DAC75-5409-DD73-F79D-4D2D1C244747} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 04:45:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T04:45:22.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:45:57.845 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T04:46:10.830 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:46:10.830 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:46:10.830 [Cloud] Queued cloud request. 2026-09-14T04:46:10.830 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:46:10.830 [Cloud] Dequeued cloud request. 2026-09-14T04:46:10.830 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:46:10.923 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F8FC63B-B765-4FE8-D536-E12D67F75BEA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 04:46:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T04:46:11.423 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:47:03.595 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:47:03.595 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:47:03.595 [Cloud] Queued cloud request. 2026-09-14T04:47:03.595 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:47:03.595 [Cloud] Dequeued cloud request. 2026-09-14T04:47:03.595 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:47:03.673 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C13A4946-D16D-4A81-08CD-035822DA52C9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 04:47:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T04:47:04.173 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:47:06.283 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:47:06.283 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:47:06.283 [Cloud] Queued cloud request. 2026-09-14T04:47:06.283 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:47:06.283 [Cloud] Dequeued cloud request. 2026-09-14T04:47:06.283 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:47:06.377 [Cloud] End of cloud request. 2026-09-14T04:47:06.892 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:47:10.298 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:47:10.298 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:47:10.298 [Cloud] Queued cloud request. 2026-09-14T04:47:10.298 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:47:10.298 [Cloud] Dequeued cloud request. 2026-09-14T04:47:10.298 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:47:10.392 [Cloud] End of cloud request. 2026-09-14T04:47:10.892 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:47:12.736 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:47:12.736 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:47:12.736 [Cloud] Queued cloud request. 2026-09-14T04:47:12.736 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:47:12.736 [Cloud] Dequeued cloud request. 2026-09-14T04:47:12.736 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:47:12.830 [Cloud] End of cloud request. 2026-09-14T04:47:13.330 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:47:34.533 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:47:34.533 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:47:34.533 [Cloud] Queued cloud request. 2026-09-14T04:47:34.533 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:47:34.533 [Cloud] Dequeued cloud request. 2026-09-14T04:47:34.533 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:47:34.611 [Cloud] End of cloud request. 2026-09-14T04:47:35.126 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:47:49.283 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:47:49.283 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:47:49.283 [Cloud] Queued cloud request. 2026-09-14T04:47:49.283 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:47:49.283 [Cloud] Dequeued cloud request. 2026-09-14T04:47:49.283 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:47:49.361 [Cloud] End of cloud request. 2026-09-14T04:47:49.876 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:47:59.548 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:47:59.548 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:47:59.548 [Cloud] Queued cloud request. 2026-09-14T04:47:59.548 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:47:59.548 [Cloud] Dequeued cloud request. 2026-09-14T04:47:59.548 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:47:59.642 [Cloud] End of cloud request. 2026-09-14T04:48:00.158 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:49:32.142 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:49:32.142 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:49:32.142 [Cloud] Queued cloud request. 2026-09-14T04:49:32.142 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:49:32.142 [Cloud] Dequeued cloud request. 2026-09-14T04:49:32.142 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:49:32.548 [Cloud] End of cloud request. 2026-09-14T04:49:33.064 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:51:51.408 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:51:51.408 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:51:51.408 [Cloud] Queued cloud request. 2026-09-14T04:51:51.408 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:51:51.408 [Cloud] Dequeued cloud request. 2026-09-14T04:51:51.408 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:51:51.564 [Cloud] End of cloud request. 2026-09-14T04:51:52.064 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:52:04.564 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:52:04.564 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:52:04.564 [Cloud] Queued cloud request. 2026-09-14T04:52:04.564 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:52:04.564 [Cloud] Dequeued cloud request. 2026-09-14T04:52:04.564 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:52:04.642 [Cloud] End of cloud request. 2026-09-14T04:52:05.142 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:52:19.876 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:52:19.876 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:52:19.876 [Cloud] Queued cloud request. 2026-09-14T04:52:19.876 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:52:19.876 [Cloud] Dequeued cloud request. 2026-09-14T04:52:19.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:52:19.970 [Cloud] End of cloud request. 2026-09-14T04:52:20.486 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:52:52.501 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:52:52.501 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:52:52.501 [Cloud] Queued cloud request. 2026-09-14T04:52:52.501 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:52:52.501 [Cloud] Dequeued cloud request. 2026-09-14T04:52:52.501 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:52:52.579 [Cloud] End of cloud request. 2026-09-14T04:52:53.095 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:54:53.720 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:54:53.720 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:54:53.720 [Cloud] Queued cloud request. 2026-09-14T04:54:53.720 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:54:53.720 [Cloud] Dequeued cloud request. 2026-09-14T04:54:53.720 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:54:53.939 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C4F9AB8-216E-D4DA-36AB-A542C4212EAB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 04:54:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T04:54:54.454 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:55:04.860 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:55:04.860 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:55:04.860 [Cloud] Queued cloud request. 2026-09-14T04:55:04.860 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:55:04.860 [Cloud] Dequeued cloud request. 2026-09-14T04:55:04.860 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:55:04.954 [Cloud] End of cloud request. 2026-09-14T04:55:05.454 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:58:55.469 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:58:55.469 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:58:55.469 [Cloud] Queued cloud request. 2026-09-14T04:58:55.469 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:58:55.469 [Cloud] Dequeued cloud request. 2026-09-14T04:58:55.469 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:58:55.907 [Cloud] End of cloud request. 2026-09-14T04:58:56.407 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T04:59:57.329 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T04:59:57.329 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T04:59:57.329 [Cloud] Queued cloud request. 2026-09-14T04:59:57.329 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T04:59:57.329 [Cloud] Dequeued cloud request. 2026-09-14T04:59:57.329 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T04:59:57.516 [Cloud] End of cloud request. 2026-09-14T04:59:58.016 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T05:00:11.766 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T05:00:11.766 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T05:00:11.766 [Cloud] Queued cloud request. 2026-09-14T05:00:11.766 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T05:00:11.766 [Cloud] Dequeued cloud request. 2026-09-14T05:00:11.766 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T05:00:11.844 [Cloud] End of cloud request. 2026-09-14T05:00:12.344 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T05:01:02.844 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T05:01:06.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T05:01:06.672 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T05:01:06.672 [Cloud] Queued cloud request. 2026-09-14T05:01:06.672 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T05:01:06.672 [Cloud] Dequeued cloud request. 2026-09-14T05:01:06.672 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T05:01:06.766 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E3C95894-EAF7-CE5F-1D1F-C427AFE230CB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 05:01:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T05:01:07.266 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T05:02:11.438 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T05:02:11.438 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T05:02:11.438 [Cloud] Queued cloud request. 2026-09-14T05:02:11.438 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T05:02:11.438 [Cloud] Dequeued cloud request. 2026-09-14T05:02:11.438 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T05:02:12.751 [Cloud] End of cloud request. 2026-09-14T05:02:13.251 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T05:03:28.453 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T05:03:28.453 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T05:03:28.453 [Cloud] Queued cloud request. 2026-09-14T05:03:28.453 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T05:03:28.453 [Cloud] Dequeued cloud request. 2026-09-14T05:03:28.453 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T05:03:28.719 [Cloud] End of cloud request. 2026-09-14T05:03:28.735 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T05:03:28.735 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T05:03:28.735 [Cloud] Queued cloud request. 2026-09-14T05:03:28.735 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T05:03:28.735 [Cloud] Dequeued cloud request. 2026-09-14T05:03:28.735 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T05:03:29.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T05:03:38.766 [Cloud] End of cloud request. 2026-09-14T05:03:39.266 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T05:03:48.828 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T05:03:48.828 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T05:03:48.828 [Cloud] Queued cloud request. 2026-09-14T05:03:48.828 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T05:03:48.828 [Cloud] Dequeued cloud request. 2026-09-14T05:03:48.828 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T05:03:48.907 [Cloud] End of cloud request. 2026-09-14T05:03:48.922 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T05:03:48.922 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T05:03:48.922 [Cloud] Queued cloud request. 2026-09-14T05:03:48.922 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T05:03:48.922 [Cloud] Dequeued cloud request. 2026-09-14T05:03:48.922 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T05:03:48.985 [Cloud] End of cloud request. 2026-09-14T05:03:49.407 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T05:05:08.547 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T05:05:08.547 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T05:05:08.547 [Cloud] Queued cloud request. 2026-09-14T05:05:08.547 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T05:05:08.547 [Cloud] Dequeued cloud request. 2026-09-14T05:05:08.547 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T05:05:08.750 [Cloud] End of cloud request. 2026-09-14T05:05:09.250 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T05:05:30.938 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T05:05:30.938 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T05:05:30.938 [Cloud] Queued cloud request. 2026-09-14T05:05:30.938 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T05:05:30.938 [Cloud] Dequeued cloud request. 2026-09-14T05:05:30.938 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T05:05:31.031 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DC869A7E-C437-3414-BC2D-15C3BFB497F2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 05:05:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T05:05:31.547 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T05:05:53.063 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T05:05:53.063 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T05:05:53.063 [Cloud] Queued cloud request. 2026-09-14T05:05:53.063 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T05:05:53.063 [Cloud] Dequeued cloud request. 2026-09-14T05:05:53.063 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T05:05:53.141 [Cloud] End of cloud request. 2026-09-14T05:05:53.641 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T05:07:25.594 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T05:07:25.594 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T05:07:25.594 [Cloud] Queued cloud request. 2026-09-14T05:07:25.594 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T05:07:25.594 [Cloud] Dequeued cloud request. 2026-09-14T05:07:25.594 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T05:07:25.766 [Cloud] End of cloud request. 2026-09-14T05:07:26.266 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T05:10:42.218 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T05:10:42.218 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T05:10:42.218 [Cloud] Queued cloud request. 2026-09-14T05:10:42.218 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T05:10:42.218 [Cloud] Dequeued cloud request. 2026-09-14T05:10:42.218 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T05:10:42.375 [Cloud] End of cloud request. 2026-09-14T05:10:42.890 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T05:16:07.843 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T05:28:46.889 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 23450, Count: 1320, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-14T05:28:46.889 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 20299, Count: 980, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T05:28:46.889 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-14T05:28:46.889 ProcessImageName: WmiPrvSE.exe, Pid: 2908, TotalTime: 708, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-14T05:28:46.889 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 576, Count: 33, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-14T05:28:46.889 ProcessImageName: WmiPrvSE.exe, Pid: 1432, TotalTime: 348, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 35% 2026-09-14T05:28:46.889 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-14T05:28:46.889 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T05:28:46.889 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-14T05:28:46.889 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-14T05:28:46.889 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-14T05:28:46.889 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T05:28:46.889 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-2.MAD, EstimatedImpact: 0% 2026-09-14T05:28:46.889 ProcessImageName: DeviceCensus.exe, Pid: 5068, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 6% 2026-09-14T05:28:46.889 ProcessImageName: mysqldump.exe, Pid: 7272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-14T05:28:46.889 ProcessImageName: cmd.exe, Pid: 6656, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-14T05:28:46.889 ProcessImageName: powershell.exe, Pid: 2876, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-14T05:28:46.889 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-14T05:28:46.889 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-14T05:31:12.843 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T05:46:17.842 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T06:01:22.841 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T06:16:27.840 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T06:31:32.839 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T06:46:37.572 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T06:46:37.572 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T06:46:37.572 [Cloud] Queued cloud request. 2026-09-14T06:46:37.572 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T06:46:37.572 [Cloud] Dequeued cloud request. 2026-09-14T06:46:37.572 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T06:46:37.729 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B7C4693F-A164-1A76-D3A3-2C42C2E2EFFF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 06:46:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T06:46:37.838 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T06:46:38.229 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T06:46:53.026 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T06:46:53.026 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T06:46:53.026 [Cloud] Queued cloud request. 2026-09-14T06:46:53.026 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T06:46:53.026 [Cloud] Dequeued cloud request. 2026-09-14T06:46:53.026 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T06:46:53.119 [Cloud] End of cloud request. 2026-09-14T06:46:53.619 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T06:47:42.009 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T06:47:42.009 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T06:47:42.009 [Cloud] Queued cloud request. 2026-09-14T06:47:42.009 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T06:47:42.009 [Cloud] Dequeued cloud request. 2026-09-14T06:47:42.009 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T06:47:42.088 [Cloud] End of cloud request. 2026-09-14T06:47:42.588 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T06:50:14.947 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T06:50:14.962 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T06:50:14.962 [Cloud] Queued cloud request. 2026-09-14T06:50:14.962 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T06:50:14.962 [Cloud] Dequeued cloud request. 2026-09-14T06:50:14.962 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T06:50:15.119 [Cloud] End of cloud request. 2026-09-14T06:50:15.634 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T06:52:37.978 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T06:52:37.978 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T06:52:37.978 [Cloud] Queued cloud request. 2026-09-14T06:52:37.978 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T06:52:37.978 [Cloud] Dequeued cloud request. 2026-09-14T06:52:37.994 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T06:52:38.134 [Cloud] End of cloud request. 2026-09-14T06:52:38.150 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T06:52:38.150 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T06:52:38.150 [Cloud] Queued cloud request. 2026-09-14T06:52:38.150 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T06:52:38.150 [Cloud] Dequeued cloud request. 2026-09-14T06:52:38.150 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T06:52:38.228 [Cloud] End of cloud request. 2026-09-14T06:52:38.650 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T06:53:20.572 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T06:53:20.572 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T06:53:20.572 [Cloud] Queued cloud request. 2026-09-14T06:53:20.572 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T06:53:20.572 [Cloud] Dequeued cloud request. 2026-09-14T06:53:20.572 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T06:53:20.665 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{22579CA5-DEC9-150A-B252-C9DB96633440} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 06:53:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T06:53:21.165 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T06:55:39.447 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T06:55:39.462 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T06:55:39.462 [Cloud] Queued cloud request. 2026-09-14T06:55:39.462 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T06:55:39.462 [Cloud] Dequeued cloud request. 2026-09-14T06:55:39.462 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T06:55:40.134 [Cloud] End of cloud request. 2026-09-14T06:55:40.650 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T06:59:10.040 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T06:59:10.040 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T06:59:10.040 [Cloud] Queued cloud request. 2026-09-14T06:59:10.040 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T06:59:10.040 [Cloud] Dequeued cloud request. 2026-09-14T06:59:10.040 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T06:59:10.274 [Cloud] End of cloud request. 2026-09-14T06:59:10.790 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T06:59:58.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T06:59:58.337 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T06:59:58.337 [Cloud] Queued cloud request. 2026-09-14T06:59:58.337 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T06:59:58.337 [Cloud] Dequeued cloud request. 2026-09-14T06:59:58.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T06:59:58.431 [Cloud] End of cloud request. 2026-09-14T06:59:58.931 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:00:07.462 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:00:07.462 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:00:07.462 [Cloud] Queued cloud request. 2026-09-14T07:00:07.462 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:00:07.462 [Cloud] Dequeued cloud request. 2026-09-14T07:00:07.462 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:00:07.556 [Cloud] End of cloud request. 2026-09-14T07:00:08.071 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:01:42.837 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T07:05:50.633 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:05:50.633 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:05:50.633 [Cloud] Queued cloud request. 2026-09-14T07:05:50.633 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:05:50.633 [Cloud] Dequeued cloud request. 2026-09-14T07:05:50.633 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:05:50.852 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{47BC12E8-FD3C-E2D3-0154-00311CEFBD9E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 07:05:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T07:05:51.352 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:06:22.133 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:06:22.133 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:06:22.133 [Cloud] Queued cloud request. 2026-09-14T07:06:22.133 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:06:22.133 [Cloud] Dequeued cloud request. 2026-09-14T07:06:22.133 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:06:22.274 [Cloud] End of cloud request. 2026-09-14T07:06:22.774 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:08:54.649 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:08:54.649 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:08:54.649 [Cloud] Queued cloud request. 2026-09-14T07:08:54.649 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:08:54.649 [Cloud] Dequeued cloud request. 2026-09-14T07:08:54.649 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:08:55.118 [Cloud] End of cloud request. 2026-09-14T07:08:55.618 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:09:33.540 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:09:33.540 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:09:33.540 [Cloud] Queued cloud request. 2026-09-14T07:09:33.540 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:09:33.540 [Cloud] Dequeued cloud request. 2026-09-14T07:09:33.555 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:09:34.024 [Cloud] End of cloud request. 2026-09-14T07:09:34.540 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:12:07.977 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:12:07.977 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:12:07.977 [Cloud] Queued cloud request. 2026-09-14T07:12:07.977 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:12:07.977 [Cloud] Dequeued cloud request. 2026-09-14T07:12:07.977 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:12:08.180 [Cloud] End of cloud request. 2026-09-14T07:12:08.680 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:12:15.743 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:12:15.743 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:12:15.743 [Cloud] Queued cloud request. 2026-09-14T07:12:15.743 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:12:15.758 [Cloud] Dequeued cloud request. 2026-09-14T07:12:15.758 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:12:16.196 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BADB6FE4-DD81-9E34-C188-24A280D2BCD4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 07:12:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T07:12:16.711 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:13:06.555 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:13:06.555 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:13:06.555 [Cloud] Queued cloud request. 2026-09-14T07:13:06.555 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:13:06.555 [Cloud] Dequeued cloud request. 2026-09-14T07:13:06.555 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:13:06.883 [Cloud] End of cloud request. 2026-09-14T07:13:07.399 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:13:12.805 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:13:12.805 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:13:12.805 [Cloud] Queued cloud request. 2026-09-14T07:13:12.805 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:13:12.805 [Cloud] Dequeued cloud request. 2026-09-14T07:13:12.805 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:13:12.946 [Cloud] End of cloud request. 2026-09-14T07:13:13.461 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:13:33.649 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:13:33.649 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:13:33.649 [Cloud] Queued cloud request. 2026-09-14T07:13:33.649 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:13:33.649 [Cloud] Dequeued cloud request. 2026-09-14T07:13:33.649 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:13:33.727 [Cloud] End of cloud request. 2026-09-14T07:13:34.242 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:14:59.664 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:14:59.664 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:14:59.664 [Cloud] Queued cloud request. 2026-09-14T07:14:59.664 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:14:59.664 [Cloud] Dequeued cloud request. 2026-09-14T07:14:59.680 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:14:59.899 [Cloud] End of cloud request. 2026-09-14T07:15:00.399 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:16:47.836 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T07:21:07.383 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:21:07.383 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:21:07.383 [Cloud] Queued cloud request. 2026-09-14T07:21:07.383 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:21:07.383 [Cloud] Dequeued cloud request. 2026-09-14T07:21:07.398 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:21:07.570 [Cloud] End of cloud request. 2026-09-14T07:21:08.070 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:21:51.367 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:21:51.367 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:21:51.367 [Cloud] Queued cloud request. 2026-09-14T07:21:51.367 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:21:51.367 [Cloud] Dequeued cloud request. 2026-09-14T07:21:51.367 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:21:51.461 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5DD3A1F6-2179-183E-CD93-576B34857F07} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 07:21:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T07:21:51.976 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:25:11.398 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:25:11.398 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:25:11.398 [Cloud] Queued cloud request. 2026-09-14T07:25:11.398 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:25:11.398 [Cloud] Dequeued cloud request. 2026-09-14T07:25:11.398 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:25:11.586 [Cloud] End of cloud request. 2026-09-14T07:25:12.086 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:26:33.851 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:26:33.851 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:26:33.851 [Cloud] Queued cloud request. 2026-09-14T07:26:33.851 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:26:33.851 [Cloud] Dequeued cloud request. 2026-09-14T07:26:33.851 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:26:34.039 [Cloud] End of cloud request. 2026-09-14T07:26:34.539 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:27:03.461 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:27:03.461 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:27:03.461 [Cloud] Queued cloud request. 2026-09-14T07:27:03.461 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:27:03.461 [Cloud] Dequeued cloud request. 2026-09-14T07:27:03.461 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:27:03.539 [Cloud] End of cloud request. 2026-09-14T07:27:04.039 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:28:05.867 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:28:05.867 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:28:05.867 [Cloud] Queued cloud request. 2026-09-14T07:28:05.867 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:28:05.867 [Cloud] Dequeued cloud request. 2026-09-14T07:28:05.867 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:28:06.054 [Cloud] End of cloud request. 2026-09-14T07:28:06.570 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:28:45.616 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:28:45.616 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:28:45.616 [Cloud] Queued cloud request. 2026-09-14T07:28:45.616 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:28:45.616 [Cloud] Dequeued cloud request. 2026-09-14T07:28:45.616 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:28:45.695 [Cloud] End of cloud request. 2026-09-14T07:28:46.195 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:28:46.898 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 25277, Count: 1401, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-14T07:28:46.898 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 24286, Count: 1164, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T07:28:46.898 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-14T07:28:46.898 ProcessImageName: WmiPrvSE.exe, Pid: 2908, TotalTime: 708, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-14T07:28:46.898 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 698, Count: 39, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-14T07:28:46.898 ProcessImageName: WmiPrvSE.exe, Pid: 1432, TotalTime: 348, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 35% 2026-09-14T07:28:46.898 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-14T07:28:46.898 ProcessImageName: powershell.exe, Pid: 5432, TotalTime: 293, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-14T07:28:46.898 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T07:28:46.898 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-14T07:28:46.898 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-14T07:28:46.898 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T07:28:46.898 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-14T07:28:46.898 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-2.MAD, EstimatedImpact: 0% 2026-09-14T07:28:46.898 ProcessImageName: DeviceCensus.exe, Pid: 5068, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 6% 2026-09-14T07:28:46.898 ProcessImageName: mysqldump.exe, Pid: 7272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-14T07:28:46.898 ProcessImageName: cmd.exe, Pid: 6656, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-14T07:28:46.898 ProcessImageName: python.exe, Pid: 6112, TotalTime: 45, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-14T07:28:46.898 ProcessImageName: powershell.exe, Pid: 2876, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-14T07:28:46.898 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-14T07:28:46.898 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-14T07:29:45.866 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:29:45.866 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:29:45.866 [Cloud] Queued cloud request. 2026-09-14T07:29:45.866 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:29:45.866 [Cloud] Dequeued cloud request. 2026-09-14T07:29:45.866 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:29:46.054 [Cloud] End of cloud request. 2026-09-14T07:29:46.554 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:30:18.851 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:30:18.851 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:30:18.851 [Cloud] Queued cloud request. 2026-09-14T07:30:18.851 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:30:18.851 [Cloud] Dequeued cloud request. 2026-09-14T07:30:18.851 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:30:18.929 [Cloud] End of cloud request. 2026-09-14T07:30:19.429 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:31:52.835 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T07:37:10.319 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:37:10.319 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:37:10.319 [Cloud] Queued cloud request. 2026-09-14T07:37:10.319 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:37:10.319 [Cloud] Dequeued cloud request. 2026-09-14T07:37:10.319 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:37:10.522 [Cloud] End of cloud request. 2026-09-14T07:37:11.038 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:37:22.772 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:37:22.772 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:37:22.772 [Cloud] Queued cloud request. 2026-09-14T07:37:22.772 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:37:22.772 [Cloud] Dequeued cloud request. 2026-09-14T07:37:22.772 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:37:22.850 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9FCBACCC-EF60-B932-D7EB-67A39C87D3F6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 07:37:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T07:37:23.350 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:45:16.928 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:45:16.928 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:45:16.928 [Cloud] Queued cloud request. 2026-09-14T07:45:16.928 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:45:16.928 [Cloud] Dequeued cloud request. 2026-09-14T07:45:16.928 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:45:17.131 [Cloud] End of cloud request. 2026-09-14T07:45:17.647 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:46:57.834 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T07:50:47.818 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:50:47.818 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:50:47.818 [Cloud] Queued cloud request. 2026-09-14T07:50:47.818 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:50:47.818 [Cloud] Dequeued cloud request. 2026-09-14T07:50:47.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:50:48.021 [Cloud] End of cloud request. 2026-09-14T07:50:48.537 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:51:49.037 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:51:49.037 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:51:49.037 [Cloud] Queued cloud request. 2026-09-14T07:51:49.037 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:51:49.037 [Cloud] Dequeued cloud request. 2026-09-14T07:51:49.037 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:51:49.224 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3E736D89-DA8D-FD01-7EE9-F3ED096CFA28} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 07:51:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T07:51:49.740 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:52:39.818 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:52:39.818 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:52:39.818 [Cloud] Queued cloud request. 2026-09-14T07:52:39.818 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:52:39.818 [Cloud] Dequeued cloud request. 2026-09-14T07:52:39.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:52:39.896 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{78C09B6E-2E02-A129-15DC-072418691A4C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 07:52:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T07:52:40.412 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:56:48.974 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:56:48.974 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:56:48.974 [Cloud] Queued cloud request. 2026-09-14T07:56:48.974 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:56:48.974 [Cloud] Dequeued cloud request. 2026-09-14T07:56:48.974 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:56:49.162 [Cloud] End of cloud request. 2026-09-14T07:56:49.662 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T07:59:37.911 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T07:59:37.911 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T07:59:37.911 [Cloud] Queued cloud request. 2026-09-14T07:59:37.911 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T07:59:37.911 [Cloud] Dequeued cloud request. 2026-09-14T07:59:37.911 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T07:59:38.099 [Cloud] End of cloud request. 2026-09-14T07:59:38.615 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:02:02.833 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T08:03:36.052 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:03:36.052 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:03:36.052 [Cloud] Queued cloud request. 2026-09-14T08:03:36.052 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:03:36.052 [Cloud] Dequeued cloud request. 2026-09-14T08:03:36.052 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:03:36.630 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{87B0C429-EA76-0BBF-3D60-0DF08500174A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 08:03:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T08:03:37.146 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:04:27.880 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:04:27.880 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:04:27.880 [Cloud] Queued cloud request. 2026-09-14T08:04:27.880 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:04:27.880 [Cloud] Dequeued cloud request. 2026-09-14T08:04:27.896 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:04:27.974 [Cloud] End of cloud request. 2026-09-14T08:04:28.474 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:13:50.926 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:13:50.926 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:13:50.926 [Cloud] Queued cloud request. 2026-09-14T08:13:50.926 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:13:50.926 [Cloud] Dequeued cloud request. 2026-09-14T08:13:50.926 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:13:51.130 [Cloud] End of cloud request. 2026-09-14T08:13:51.630 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:17:07.832 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T08:17:41.020 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:17:41.020 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:17:41.020 [Cloud] Queued cloud request. 2026-09-14T08:17:41.020 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:17:41.020 [Cloud] Dequeued cloud request. 2026-09-14T08:17:41.020 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:17:41.191 [Cloud] End of cloud request. 2026-09-14T08:17:41.707 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:21:57.691 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:21:57.691 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:21:57.691 [Cloud] Queued cloud request. 2026-09-14T08:21:57.691 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:21:57.691 [Cloud] Dequeued cloud request. 2026-09-14T08:21:57.691 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:21:57.848 [Cloud] End of cloud request. 2026-09-14T08:21:58.348 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:25:18.129 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:25:18.129 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:25:18.129 [Cloud] Queued cloud request. 2026-09-14T08:25:18.129 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:25:18.129 [Cloud] Dequeued cloud request. 2026-09-14T08:25:18.144 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:25:18.300 [Cloud] End of cloud request. 2026-09-14T08:25:18.800 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:27:29.332 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:27:29.332 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:27:29.332 [Cloud] Queued cloud request. 2026-09-14T08:27:29.332 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:27:29.332 [Cloud] Dequeued cloud request. 2026-09-14T08:27:29.332 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:27:29.472 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3CE84D04-1289-A920-09F7-F24BB7AB8DB9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 08:27:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T08:27:29.988 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:28:39.113 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:28:39.113 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:28:39.113 [Cloud] Queued cloud request. 2026-09-14T08:28:39.113 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:28:39.113 [Cloud] Dequeued cloud request. 2026-09-14T08:28:39.113 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:28:39.300 [Cloud] End of cloud request. 2026-09-14T08:28:39.816 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:29:35.144 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:29:35.144 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:29:35.144 [Cloud] Queued cloud request. 2026-09-14T08:29:35.144 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:29:35.144 [Cloud] Dequeued cloud request. 2026-09-14T08:29:35.144 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:29:35.238 [Cloud] End of cloud request. 2026-09-14T08:29:35.738 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:31:09.847 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:31:09.847 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:31:09.847 [Cloud] Queued cloud request. 2026-09-14T08:31:09.847 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:31:09.847 [Cloud] Dequeued cloud request. 2026-09-14T08:31:09.847 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:31:10.035 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4D929CFD-87BA-1D3E-E753-52FE7D6074A4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 08:31:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T08:31:10.550 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:32:12.831 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T08:32:48.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:32:48.097 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:32:48.097 [Cloud] Queued cloud request. 2026-09-14T08:32:48.097 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:32:48.097 [Cloud] Dequeued cloud request. 2026-09-14T08:32:48.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:32:48.285 [Cloud] End of cloud request. 2026-09-14T08:32:48.785 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:32:53.722 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:32:53.722 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:32:53.722 [Cloud] Queued cloud request. 2026-09-14T08:32:53.722 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:32:53.722 [Cloud] Dequeued cloud request. 2026-09-14T08:32:53.722 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:32:53.800 [Cloud] End of cloud request. 2026-09-14T08:32:54.300 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:33:22.160 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:33:22.160 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:33:22.160 [Cloud] Queued cloud request. 2026-09-14T08:33:22.160 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:33:22.160 [Cloud] Dequeued cloud request. 2026-09-14T08:33:22.160 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:33:22.284 [Cloud] End of cloud request. 2026-09-14T08:33:22.785 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:36:24.987 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:36:24.987 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:36:24.987 [Cloud] Queued cloud request. 2026-09-14T08:36:24.987 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:36:24.987 [Cloud] Dequeued cloud request. 2026-09-14T08:36:24.987 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:36:25.237 [Cloud] End of cloud request. 2026-09-14T08:36:25.737 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:38:54.503 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:38:54.503 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:38:54.503 [Cloud] Queued cloud request. 2026-09-14T08:38:54.503 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:38:54.503 [Cloud] Dequeued cloud request. 2026-09-14T08:38:54.503 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:38:54.706 [Cloud] End of cloud request. 2026-09-14T08:38:55.206 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:39:02.096 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:39:02.096 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:39:02.096 [Cloud] Queued cloud request. 2026-09-14T08:39:02.096 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:39:02.096 [Cloud] Dequeued cloud request. 2026-09-14T08:39:02.096 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:39:02.174 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3DD125CF-CE56-1D20-3699-E41D9DBCE04D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 08:39:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T08:39:02.675 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:40:56.315 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:40:56.315 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:40:56.315 [Cloud] Queued cloud request. 2026-09-14T08:40:56.315 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:40:56.315 [Cloud] Dequeued cloud request. 2026-09-14T08:40:56.315 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:40:56.503 [Cloud] End of cloud request. 2026-09-14T08:40:57.003 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:42:00.143 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:42:00.143 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:42:00.143 [Cloud] Queued cloud request. 2026-09-14T08:42:00.143 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:42:00.143 [Cloud] Dequeued cloud request. 2026-09-14T08:42:00.143 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:42:00.331 [Cloud] End of cloud request. 2026-09-14T08:42:00.346 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:42:00.346 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:42:00.346 [Cloud] Queued cloud request. 2026-09-14T08:42:00.346 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:42:00.346 [Cloud] Dequeued cloud request. 2026-09-14T08:42:00.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:42:00.424 [Cloud] End of cloud request. 2026-09-14T08:42:00.846 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:44:56.893 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:44:56.893 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:44:56.893 [Cloud] Queued cloud request. 2026-09-14T08:44:56.893 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:44:56.893 [Cloud] Dequeued cloud request. 2026-09-14T08:44:56.893 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:44:57.096 [Cloud] End of cloud request. 2026-09-14T08:44:57.612 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:45:43.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:45:43.643 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:45:43.643 [Cloud] Queued cloud request. 2026-09-14T08:45:43.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:45:43.643 [Cloud] Dequeued cloud request. 2026-09-14T08:45:43.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:45:43.737 [Cloud] End of cloud request. 2026-09-14T08:45:44.237 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:47:17.830 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T08:48:00.377 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:48:00.377 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:48:00.377 [Cloud] Queued cloud request. 2026-09-14T08:48:00.377 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:48:00.377 [Cloud] Dequeued cloud request. 2026-09-14T08:48:00.377 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:48:00.611 [Cloud] End of cloud request. 2026-09-14T08:48:01.111 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:48:13.315 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:48:13.315 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:48:13.315 [Cloud] Queued cloud request. 2026-09-14T08:48:13.315 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:48:13.315 [Cloud] Dequeued cloud request. 2026-09-14T08:48:13.315 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:48:13.408 [Cloud] End of cloud request. 2026-09-14T08:48:13.924 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:48:53.455 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:48:53.455 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:48:53.455 [Cloud] Queued cloud request. 2026-09-14T08:48:53.455 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:48:53.471 [Cloud] Dequeued cloud request. 2026-09-14T08:48:53.471 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:48:53.549 [Cloud] End of cloud request. 2026-09-14T08:48:54.049 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:50:01.674 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:50:01.674 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:50:01.674 [Cloud] Queued cloud request. 2026-09-14T08:50:01.674 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:50:01.674 [Cloud] Dequeued cloud request. 2026-09-14T08:50:01.674 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:50:02.065 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F777F6CD-0805-707D-20A7-14FA9C3C7A04} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 08:50:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T08:50:02.565 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:50:58.018 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:50:58.018 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:50:58.018 [Cloud] Queued cloud request. 2026-09-14T08:50:58.018 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:50:58.018 [Cloud] Dequeued cloud request. 2026-09-14T08:50:58.018 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:50:58.111 [Cloud] End of cloud request. 2026-09-14T08:50:58.627 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:51:03.486 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:51:03.486 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:51:03.486 [Cloud] Queued cloud request. 2026-09-14T08:51:03.486 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:51:03.486 [Cloud] Dequeued cloud request. 2026-09-14T08:51:03.486 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:51:03.596 [Cloud] End of cloud request. 2026-09-14T08:51:04.096 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:51:22.315 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:51:22.315 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:51:22.315 [Cloud] Queued cloud request. 2026-09-14T08:51:22.315 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:51:22.315 [Cloud] Dequeued cloud request. 2026-09-14T08:51:22.315 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:51:22.408 [Cloud] End of cloud request. 2026-09-14T08:51:22.908 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:51:38.377 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:51:38.377 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:51:38.377 [Cloud] Queued cloud request. 2026-09-14T08:51:38.377 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:51:38.377 [Cloud] Dequeued cloud request. 2026-09-14T08:51:38.377 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:51:38.455 [Cloud] End of cloud request. 2026-09-14T08:51:38.971 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:53:04.424 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:53:04.424 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:53:04.424 [Cloud] Queued cloud request. 2026-09-14T08:53:04.424 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:53:04.424 [Cloud] Dequeued cloud request. 2026-09-14T08:53:04.424 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:53:04.611 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3BC5F0D7-FBB6-E1C6-D54E-E66D58D103D3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 08:53:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T08:53:05.127 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:53:45.768 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:53:45.768 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:53:45.768 [Cloud] Queued cloud request. 2026-09-14T08:53:45.768 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:53:45.768 [Cloud] Dequeued cloud request. 2026-09-14T08:53:45.768 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:53:45.846 [Cloud] End of cloud request. 2026-09-14T08:53:46.346 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:54:12.283 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:54:12.283 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:54:12.283 [Cloud] Queued cloud request. 2026-09-14T08:54:12.283 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:54:12.283 [Cloud] Dequeued cloud request. 2026-09-14T08:54:12.283 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:54:12.377 [Cloud] End of cloud request. 2026-09-14T08:54:12.877 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:54:13.486 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:54:13.486 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:54:13.486 [Cloud] Queued cloud request. 2026-09-14T08:54:13.486 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:54:13.486 [Cloud] Dequeued cloud request. 2026-09-14T08:54:13.486 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:54:13.564 [Cloud] End of cloud request. 2026-09-14T08:54:14.080 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:56:08.767 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:56:08.767 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:56:08.767 [Cloud] Queued cloud request. 2026-09-14T08:56:08.767 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:56:08.767 [Cloud] Dequeued cloud request. 2026-09-14T08:56:08.783 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:56:08.970 [Cloud] End of cloud request. 2026-09-14T08:56:09.470 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:56:46.548 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:56:46.548 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:56:46.548 [Cloud] Queued cloud request. 2026-09-14T08:56:46.548 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:56:46.548 [Cloud] Dequeued cloud request. 2026-09-14T08:56:46.548 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:56:46.658 [Cloud] End of cloud request. 2026-09-14T08:56:47.158 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:56:58.642 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:56:58.642 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:56:58.642 [Cloud] Queued cloud request. 2026-09-14T08:56:58.642 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:56:58.642 [Cloud] Dequeued cloud request. 2026-09-14T08:56:58.642 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:56:58.720 [Cloud] End of cloud request. 2026-09-14T08:56:59.236 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:58:37.408 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:58:37.408 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:58:37.408 [Cloud] Queued cloud request. 2026-09-14T08:58:37.408 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:58:37.408 [Cloud] Dequeued cloud request. 2026-09-14T08:58:37.408 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:58:37.595 [Cloud] End of cloud request. 2026-09-14T08:58:38.095 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T08:59:35.408 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T08:59:35.408 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T08:59:35.408 [Cloud] Queued cloud request. 2026-09-14T08:59:35.408 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T08:59:35.408 [Cloud] Dequeued cloud request. 2026-09-14T08:59:35.408 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T08:59:35.564 [Cloud] End of cloud request. 2026-09-14T08:59:36.079 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:00:24.236 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:00:24.236 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:00:24.236 [Cloud] Queued cloud request. 2026-09-14T09:00:24.236 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:00:24.236 [Cloud] Dequeued cloud request. 2026-09-14T09:00:24.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:00:24.314 [Cloud] End of cloud request. 2026-09-14T09:00:24.829 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:01:57.392 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:01:57.392 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:01:57.392 [Cloud] Queued cloud request. 2026-09-14T09:01:57.392 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:01:57.392 [Cloud] Dequeued cloud request. 2026-09-14T09:01:57.408 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:01:57.595 [Cloud] End of cloud request. 2026-09-14T09:01:58.111 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:02:22.829 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T09:02:53.314 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:02:53.314 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:02:53.314 [Cloud] Queued cloud request. 2026-09-14T09:02:53.314 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:02:53.314 [Cloud] Dequeued cloud request. 2026-09-14T09:02:53.314 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:02:53.408 [Cloud] End of cloud request. 2026-09-14T09:02:53.923 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:04:04.048 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:04:04.048 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:04:04.048 [Cloud] Queued cloud request. 2026-09-14T09:04:04.048 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:04:04.048 [Cloud] Dequeued cloud request. 2026-09-14T09:04:04.064 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:04:14.204 [Cloud] End of cloud request. 2026-09-14T09:04:14.704 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:05:00.376 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:05:00.376 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:05:00.376 [Cloud] Queued cloud request. 2026-09-14T09:05:00.376 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:05:00.376 [Cloud] Dequeued cloud request. 2026-09-14T09:05:00.376 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:05:00.485 [Cloud] End of cloud request. 2026-09-14T09:05:01.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:05:15.235 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:05:15.235 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:05:15.235 [Cloud] Queued cloud request. 2026-09-14T09:05:15.235 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:05:15.235 [Cloud] Dequeued cloud request. 2026-09-14T09:05:15.235 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:05:15.329 [Cloud] End of cloud request. 2026-09-14T09:05:15.830 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:05:25.407 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:05:25.407 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:05:25.407 [Cloud] Queued cloud request. 2026-09-14T09:05:25.407 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:05:25.407 [Cloud] Dequeued cloud request. 2026-09-14T09:05:25.407 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:05:25.501 [Cloud] End of cloud request. 2026-09-14T09:05:26.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:06:05.532 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:06:05.532 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:06:05.532 [Cloud] Queued cloud request. 2026-09-14T09:06:05.532 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:06:05.532 [Cloud] Dequeued cloud request. 2026-09-14T09:06:05.532 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:06:05.626 [Cloud] End of cloud request. 2026-09-14T09:06:06.126 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:06:13.532 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:06:13.532 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:06:13.532 [Cloud] Queued cloud request. 2026-09-14T09:06:13.532 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:06:13.532 [Cloud] Dequeued cloud request. 2026-09-14T09:06:13.532 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:06:13.610 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{726ECE72-FBF4-3876-6A5F-5035893DC14A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 09:06:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T09:06:14.110 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:07:11.783 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:07:11.783 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:07:11.783 [Cloud] Queued cloud request. 2026-09-14T09:07:11.783 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:07:11.783 [Cloud] Dequeued cloud request. 2026-09-14T09:07:11.783 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:07:11.876 [Cloud] End of cloud request. 2026-09-14T09:07:12.392 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:10:42.517 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:10:42.517 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:10:42.517 [Cloud] Queued cloud request. 2026-09-14T09:10:42.517 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:10:42.517 [Cloud] Dequeued cloud request. 2026-09-14T09:10:42.532 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:10:42.704 [Cloud] End of cloud request. 2026-09-14T09:10:43.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:10:54.907 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:10:54.907 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:10:54.907 [Cloud] Queued cloud request. 2026-09-14T09:10:54.907 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:10:54.907 [Cloud] Dequeued cloud request. 2026-09-14T09:10:54.907 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:10:54.985 [Cloud] End of cloud request. 2026-09-14T09:10:55.501 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:11:24.376 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:11:24.376 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:11:24.376 [Cloud] Queued cloud request. 2026-09-14T09:11:24.376 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:11:24.376 [Cloud] Dequeued cloud request. 2026-09-14T09:11:24.376 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:11:24.485 [Cloud] End of cloud request. 2026-09-14T09:11:25.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:11:47.094 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:11:47.094 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:11:47.094 [Cloud] Queued cloud request. 2026-09-14T09:11:47.094 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:11:47.094 [Cloud] Dequeued cloud request. 2026-09-14T09:11:47.094 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:11:47.173 [Cloud] End of cloud request. 2026-09-14T09:11:47.688 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:14:04.110 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:14:04.110 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:14:04.110 [Cloud] Queued cloud request. 2026-09-14T09:14:04.110 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:14:04.110 [Cloud] Dequeued cloud request. 2026-09-14T09:14:04.110 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:14:04.548 [Cloud] End of cloud request. 2026-09-14T09:14:05.063 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:17:27.829 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T09:17:57.688 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:17:57.688 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:17:57.688 [Cloud] Queued cloud request. 2026-09-14T09:17:57.688 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:17:57.688 [Cloud] Dequeued cloud request. 2026-09-14T09:17:57.688 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:17:57.907 [Cloud] End of cloud request. 2026-09-14T09:17:58.407 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:18:00.000 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:18:00.000 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:18:00.000 [Cloud] Queued cloud request. 2026-09-14T09:18:00.000 [Cloud] Dequeued cloud request. 2026-09-14T09:18:00.000 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:18:00.016 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:18:00.094 [Cloud] End of cloud request. 2026-09-14T09:18:00.594 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:18:42.063 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:18:42.063 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:18:42.063 [Cloud] Queued cloud request. 2026-09-14T09:18:42.063 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:18:42.063 [Cloud] Dequeued cloud request. 2026-09-14T09:18:42.063 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:18:42.203 [Cloud] End of cloud request. 2026-09-14T09:18:42.703 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:18:53.500 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:18:53.500 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:18:53.500 [Cloud] Queued cloud request. 2026-09-14T09:18:53.500 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:18:53.500 [Cloud] Dequeued cloud request. 2026-09-14T09:18:53.500 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:18:53.594 [Cloud] End of cloud request. 2026-09-14T09:18:54.094 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:20:07.969 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:20:07.969 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:20:07.969 [Cloud] Queued cloud request. 2026-09-14T09:20:07.969 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:20:07.969 [Cloud] Dequeued cloud request. 2026-09-14T09:20:07.969 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:20:18.094 [Cloud] End of cloud request. 2026-09-14T09:20:18.594 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:20:30.547 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:20:30.547 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:20:30.547 [Cloud] Queued cloud request. 2026-09-14T09:20:30.547 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:20:30.547 [Cloud] Dequeued cloud request. 2026-09-14T09:20:30.547 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:20:30.641 [Cloud] End of cloud request. 2026-09-14T09:20:31.156 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:20:39.344 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:20:39.344 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:20:39.344 [Cloud] Queued cloud request. 2026-09-14T09:20:39.344 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:20:39.344 [Cloud] Dequeued cloud request. 2026-09-14T09:20:39.344 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:20:39.453 [Cloud] End of cloud request. 2026-09-14T09:20:39.969 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:21:20.063 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:21:20.063 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:21:20.063 [Cloud] Queued cloud request. 2026-09-14T09:21:20.063 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:21:20.063 [Cloud] Dequeued cloud request. 2026-09-14T09:21:20.063 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:21:20.156 [Cloud] End of cloud request. 2026-09-14T09:21:20.656 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:23:04.516 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:23:04.516 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:23:04.531 [Cloud] Queued cloud request. 2026-09-14T09:23:04.531 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:23:04.531 [Cloud] Dequeued cloud request. 2026-09-14T09:23:04.531 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:23:04.703 [Cloud] End of cloud request. 2026-09-14T09:23:05.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:23:38.688 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T09:23:38.688 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T09:23:38.688 [Cloud] Queued cloud request. 2026-09-14T09:23:38.688 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T09:23:38.688 [Cloud] Dequeued cloud request. 2026-09-14T09:23:38.688 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T09:23:38.766 [Cloud] End of cloud request. 2026-09-14T09:23:39.281 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T09:28:46.906 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 32256, Count: 1834, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-14T09:28:46.906 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 28510, Count: 1338, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T09:28:46.906 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-14T09:28:46.906 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 744, Count: 41, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-14T09:28:46.906 ProcessImageName: WmiPrvSE.exe, Pid: 2908, TotalTime: 708, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-14T09:28:46.906 ProcessImageName: WmiPrvSE.exe, Pid: 1432, TotalTime: 348, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 35% 2026-09-14T09:28:46.906 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-14T09:28:46.906 ProcessImageName: powershell.exe, Pid: 5432, TotalTime: 293, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-14T09:28:46.906 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T09:28:46.906 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-14T09:28:46.906 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-14T09:28:46.906 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T09:28:46.906 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-14T09:28:46.906 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-2.MAD, EstimatedImpact: 0% 2026-09-14T09:28:46.906 ProcessImageName: DeviceCensus.exe, Pid: 5068, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 6% 2026-09-14T09:28:46.906 ProcessImageName: mysqldump.exe, Pid: 7272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-14T09:28:46.906 ProcessImageName: cmd.exe, Pid: 6656, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-14T09:28:46.906 ProcessImageName: python.exe, Pid: 6112, TotalTime: 45, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-14T09:28:46.906 ProcessImageName: powershell.exe, Pid: 2876, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-14T09:28:46.906 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-14T09:28:46.906 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-14T09:32:32.828 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T09:47:37.827 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T10:02:42.826 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T10:17:47.825 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) Internal signature match:subtype=Lowfi, sigseq=0x0000157EDBC612FC, sigsha=d5f1909a20fbb89ca049ea3ac446bcfd3acf514e, cached=false, source=2, resourceid=0x9e4188f7 2026-09-14T10:32:52.824 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T10:47:57.823 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T10:54:01.042 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T10:54:01.042 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T10:54:01.042 [Cloud] Queued cloud request. 2026-09-14T10:54:01.042 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T10:54:01.058 [Cloud] Dequeued cloud request. 2026-09-14T10:54:01.058 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T10:54:01.214 [Cloud] End of cloud request. 2026-09-14T10:54:01.730 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T10:55:36.886 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T10:55:36.886 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T10:55:36.886 [Cloud] Queued cloud request. 2026-09-14T10:55:36.886 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T10:55:36.901 [Cloud] Dequeued cloud request. 2026-09-14T10:55:36.901 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T10:55:37.073 [Cloud] End of cloud request. 2026-09-14T10:55:37.573 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T10:56:04.573 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T10:56:04.573 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T10:56:04.573 [Cloud] Queued cloud request. 2026-09-14T10:56:04.573 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T10:56:04.573 [Cloud] Dequeued cloud request. 2026-09-14T10:56:04.573 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T10:56:04.683 [Cloud] End of cloud request. 2026-09-14T10:56:05.198 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:01:10.245 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:01:10.245 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:01:10.245 [Cloud] Queued cloud request. 2026-09-14T11:01:10.245 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:01:10.245 [Cloud] Dequeued cloud request. 2026-09-14T11:01:10.245 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:01:10.401 [Cloud] End of cloud request. 2026-09-14T11:01:10.916 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:01:39.182 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:01:39.182 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:01:39.182 [Cloud] Queued cloud request. 2026-09-14T11:01:39.182 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:01:39.182 [Cloud] Dequeued cloud request. 2026-09-14T11:01:39.182 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:01:39.276 [Cloud] End of cloud request. 2026-09-14T11:01:39.776 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:02:59.135 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:02:59.135 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:02:59.135 [Cloud] Queued cloud request. 2026-09-14T11:02:59.135 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:02:59.135 [Cloud] Dequeued cloud request. 2026-09-14T11:02:59.135 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:02:59.291 [Cloud] End of cloud request. 2026-09-14T11:02:59.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:03:02.823 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T11:04:11.698 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:04:11.698 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:04:11.698 [Cloud] Queued cloud request. 2026-09-14T11:04:11.698 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:04:11.698 [Cloud] Dequeued cloud request. 2026-09-14T11:04:11.698 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:04:11.838 [Cloud] End of cloud request. 2026-09-14T11:04:12.338 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:04:46.979 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:04:46.979 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:04:46.979 [Cloud] Queued cloud request. 2026-09-14T11:04:46.979 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:04:46.979 [Cloud] Dequeued cloud request. 2026-09-14T11:04:46.979 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:04:47.057 [Cloud] End of cloud request. 2026-09-14T11:04:47.557 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:05:10.760 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:05:10.760 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:05:10.760 [Cloud] Queued cloud request. 2026-09-14T11:05:10.760 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:05:10.760 [Cloud] Dequeued cloud request. 2026-09-14T11:05:10.760 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:05:11.166 [Cloud] End of cloud request. 2026-09-14T11:05:11.666 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:05:35.073 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:05:35.073 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:05:35.073 [Cloud] Queued cloud request. 2026-09-14T11:05:35.073 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:05:35.073 [Cloud] Dequeued cloud request. 2026-09-14T11:05:35.073 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:05:35.369 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{14B6E848-4890-F538-67D2-2D8E3FE7F949} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 11:05:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T11:05:35.885 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:05:45.119 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:05:45.119 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:05:45.119 [Cloud] Queued cloud request. 2026-09-14T11:05:45.119 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:05:45.119 [Cloud] Dequeued cloud request. 2026-09-14T11:05:45.119 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:05:45.276 [Cloud] End of cloud request. 2026-09-14T11:05:45.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:08:13.072 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:08:13.072 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:08:13.072 [Cloud] Queued cloud request. 2026-09-14T11:08:13.072 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:08:13.072 [Cloud] Dequeued cloud request. 2026-09-14T11:08:13.072 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:08:13.260 [Cloud] End of cloud request. 2026-09-14T11:08:13.775 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:08:17.307 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:08:17.307 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:08:17.307 [Cloud] Queued cloud request. 2026-09-14T11:08:17.307 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:08:17.307 [Cloud] Dequeued cloud request. 2026-09-14T11:08:17.307 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:08:17.385 [Cloud] End of cloud request. 2026-09-14T11:08:17.885 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:09:14.041 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:09:14.041 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:09:14.041 [Cloud] Queued cloud request. 2026-09-14T11:09:14.041 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:09:14.057 [Cloud] Dequeued cloud request. 2026-09-14T11:09:14.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:09:14.135 [Cloud] End of cloud request. 2026-09-14T11:09:14.650 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:12:08.963 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:12:08.963 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:12:08.963 [Cloud] Queued cloud request. 2026-09-14T11:12:08.963 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:12:08.963 [Cloud] Dequeued cloud request. 2026-09-14T11:12:08.963 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:12:16.088 [Cloud] End of cloud request. 2026-09-14T11:12:16.588 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:14:51.072 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:14:51.072 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:14:51.072 [Cloud] Queued cloud request. 2026-09-14T11:14:51.072 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:14:51.072 [Cloud] Dequeued cloud request. 2026-09-14T11:14:51.072 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:14:51.259 [Cloud] End of cloud request. 2026-09-14T11:14:51.775 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:18:07.822 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T11:24:18.025 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:24:18.025 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:24:18.025 [Cloud] Queued cloud request. 2026-09-14T11:24:18.025 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:24:18.025 [Cloud] Dequeued cloud request. 2026-09-14T11:24:18.025 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:24:18.259 [Cloud] End of cloud request. 2026-09-14T11:24:18.759 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:25:38.087 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:25:38.087 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:25:38.087 [Cloud] Queued cloud request. 2026-09-14T11:25:38.087 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:25:38.087 [Cloud] Dequeued cloud request. 2026-09-14T11:25:38.103 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:25:38.290 [Cloud] End of cloud request. 2026-09-14T11:25:38.790 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:28:16.009 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:28:16.009 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:28:16.009 [Cloud] Queued cloud request. 2026-09-14T11:28:16.009 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:28:16.009 [Cloud] Dequeued cloud request. 2026-09-14T11:28:16.009 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:28:16.212 [Cloud] End of cloud request. 2026-09-14T11:28:16.712 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:28:46.899 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 33510, Count: 1901, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-14T11:28:46.899 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 32783, Count: 1516, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T11:28:46.899 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-14T11:28:46.899 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 865, Count: 49, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-14T11:28:46.899 ProcessImageName: WmiPrvSE.exe, Pid: 2908, TotalTime: 708, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-14T11:28:46.899 ProcessImageName: WmiPrvSE.exe, Pid: 1432, TotalTime: 348, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 35% 2026-09-14T11:28:46.899 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-14T11:28:46.899 ProcessImageName: powershell.exe, Pid: 5432, TotalTime: 293, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-14T11:28:46.899 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T11:28:46.899 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-14T11:28:46.899 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-14T11:28:46.899 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T11:28:46.899 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-14T11:28:46.899 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-2.MAD, EstimatedImpact: 0% 2026-09-14T11:28:46.899 ProcessImageName: DeviceCensus.exe, Pid: 5068, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 6% 2026-09-14T11:28:46.899 ProcessImageName: mysqldump.exe, Pid: 7272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-14T11:28:46.899 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-14T11:28:46.899 ProcessImageName: cmd.exe, Pid: 6656, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-14T11:28:46.899 ProcessImageName: python.exe, Pid: 6112, TotalTime: 45, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-14T11:28:46.899 ProcessImageName: powershell.exe, Pid: 2876, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-14T11:28:46.899 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-14T11:33:12.821 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T11:36:09.571 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:36:09.571 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:36:09.571 [Cloud] Queued cloud request. 2026-09-14T11:36:09.571 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:36:09.727 [Cloud] Dequeued cloud request. 2026-09-14T11:36:09.727 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:36:09.868 [Cloud] End of cloud request. 2026-09-14T11:36:10.368 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:36:17.602 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:36:17.602 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:36:17.602 [Cloud] Queued cloud request. 2026-09-14T11:36:17.602 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:36:17.602 [Cloud] Dequeued cloud request. 2026-09-14T11:36:17.602 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:36:17.696 [Cloud] End of cloud request. 2026-09-14T11:36:18.196 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:39:23.258 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:39:23.258 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:39:23.258 [Cloud] Queued cloud request. 2026-09-14T11:39:23.258 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:39:23.258 [Cloud] Dequeued cloud request. 2026-09-14T11:39:23.258 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:39:23.414 [Cloud] End of cloud request. 2026-09-14T11:39:23.930 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:40:05.602 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:40:05.602 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:40:05.602 [Cloud] Queued cloud request. 2026-09-14T11:40:05.602 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:40:05.602 [Cloud] Dequeued cloud request. 2026-09-14T11:40:05.602 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:40:05.680 [Cloud] End of cloud request. 2026-09-14T11:40:06.180 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:40:46.930 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:40:46.930 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:40:46.930 [Cloud] Queued cloud request. 2026-09-14T11:40:46.930 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:40:46.930 [Cloud] Dequeued cloud request. 2026-09-14T11:40:46.930 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:40:47.024 [Cloud] End of cloud request. 2026-09-14T11:40:47.524 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:48:04.273 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:48:04.273 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:48:04.273 [Cloud] Queued cloud request. 2026-09-14T11:48:04.273 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:48:04.273 [Cloud] Dequeued cloud request. 2026-09-14T11:48:04.289 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:48:04.476 [Cloud] End of cloud request. 2026-09-14T11:48:04.976 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:48:17.820 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T11:49:06.164 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:49:06.164 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:49:06.164 [Cloud] Queued cloud request. 2026-09-14T11:49:06.164 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:49:06.164 [Cloud] Dequeued cloud request. 2026-09-14T11:49:06.164 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:49:06.351 [Cloud] End of cloud request. 2026-09-14T11:49:06.867 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:50:10.133 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:50:10.133 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:50:10.133 [Cloud] Queued cloud request. 2026-09-14T11:50:10.133 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:50:10.133 [Cloud] Dequeued cloud request. 2026-09-14T11:50:10.133 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:50:20.305 [Cloud] End of cloud request. 2026-09-14T11:50:20.820 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:51:56.086 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:51:56.086 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:51:56.086 [Cloud] Queued cloud request. 2026-09-14T11:51:56.086 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:51:56.086 [Cloud] Dequeued cloud request. 2026-09-14T11:51:56.101 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:51:56.289 [Cloud] End of cloud request. 2026-09-14T11:51:56.789 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:53:08.117 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:53:08.117 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:53:08.117 [Cloud] Queued cloud request. 2026-09-14T11:53:08.117 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:53:08.117 [Cloud] Dequeued cloud request. 2026-09-14T11:53:08.117 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:53:18.336 [Cloud] End of cloud request. 2026-09-14T11:53:18.836 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:54:28.320 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:54:28.320 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:54:28.320 [Cloud] Queued cloud request. 2026-09-14T11:54:28.320 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:54:28.336 [Cloud] Dequeued cloud request. 2026-09-14T11:54:28.336 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:54:28.523 [Cloud] End of cloud request. 2026-09-14T11:54:29.039 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:54:53.148 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:54:53.148 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:54:53.148 [Cloud] Queued cloud request. 2026-09-14T11:54:53.148 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:54:53.148 [Cloud] Dequeued cloud request. 2026-09-14T11:54:53.148 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:54:53.226 [Cloud] End of cloud request. 2026-09-14T11:54:53.742 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:55:29.211 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:55:29.211 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:55:29.211 [Cloud] Queued cloud request. 2026-09-14T11:55:29.211 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:55:29.211 [Cloud] Dequeued cloud request. 2026-09-14T11:55:29.211 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:55:29.320 [Cloud] End of cloud request. 2026-09-14T11:55:29.836 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:56:32.023 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:56:32.023 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:56:32.023 [Cloud] Queued cloud request. 2026-09-14T11:56:32.023 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:56:32.023 [Cloud] Dequeued cloud request. 2026-09-14T11:56:32.023 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:56:32.226 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C10E5E8A-9268-F891-3990-4975A76C764F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 11:56:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T11:56:32.726 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:58:57.820 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:58:57.820 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:58:57.820 [Cloud] Queued cloud request. 2026-09-14T11:58:57.820 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:58:57.820 [Cloud] Dequeued cloud request. 2026-09-14T11:58:57.820 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:58:58.007 [Cloud] End of cloud request. 2026-09-14T11:58:58.523 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T11:59:27.398 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T11:59:27.398 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T11:59:27.398 [Cloud] Queued cloud request. 2026-09-14T11:59:27.398 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T11:59:27.398 [Cloud] Dequeued cloud request. 2026-09-14T11:59:27.398 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T11:59:27.507 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A4C2C3CF-040F-1CC2-1834-80768BDC0A83} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 11:59:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T11:59:28.007 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:01:43.492 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:01:43.492 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:01:43.492 [Cloud] Queued cloud request. 2026-09-14T12:01:43.492 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:01:43.492 [Cloud] Dequeued cloud request. 2026-09-14T12:01:43.492 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:01:44.117 [Cloud] End of cloud request. 2026-09-14T12:01:44.617 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:03:22.820 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T12:03:31.195 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:03:31.195 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:03:31.195 [Cloud] Queued cloud request. 2026-09-14T12:03:31.195 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:03:31.195 [Cloud] Dequeued cloud request. 2026-09-14T12:03:31.195 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:03:31.382 [Cloud] End of cloud request. 2026-09-14T12:03:31.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:04:12.617 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:04:12.617 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:04:12.617 [Cloud] Queued cloud request. 2026-09-14T12:04:12.617 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:04:12.617 [Cloud] Dequeued cloud request. 2026-09-14T12:04:12.617 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:04:12.710 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2B414345-E622-4017-A1F3-B547D3702F83} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 12:04:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T12:04:13.226 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:11:55.272 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:11:55.272 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:11:55.272 [Cloud] Queued cloud request. 2026-09-14T12:11:55.272 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:11:55.272 [Cloud] Dequeued cloud request. 2026-09-14T12:11:55.288 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:11:55.538 [Cloud] End of cloud request. 2026-09-14T12:11:56.038 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:18:27.819 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T12:18:58.803 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:18:58.803 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:18:58.803 [Cloud] Queued cloud request. 2026-09-14T12:18:58.803 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:18:58.819 [Cloud] Dequeued cloud request. 2026-09-14T12:18:58.819 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:18:58.959 [Cloud] End of cloud request. 2026-09-14T12:18:59.459 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:20:03.178 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:20:03.178 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:20:03.178 [Cloud] Queued cloud request. 2026-09-14T12:20:03.178 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:20:03.178 [Cloud] Dequeued cloud request. 2026-09-14T12:20:03.178 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:20:03.366 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DA98E1AA-7BBC-9052-3FCB-449CA62652F5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 12:20:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T12:20:03.881 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:21:35.897 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:21:35.897 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:21:35.897 [Cloud] Queued cloud request. 2026-09-14T12:21:35.897 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:21:35.897 [Cloud] Dequeued cloud request. 2026-09-14T12:21:36.116 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:21:36.256 [Cloud] End of cloud request. 2026-09-14T12:21:36.756 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:24:15.990 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:24:15.990 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:24:15.990 [Cloud] Queued cloud request. 2026-09-14T12:24:15.990 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:24:15.990 [Cloud] Dequeued cloud request. 2026-09-14T12:24:15.990 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:24:17.053 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9759F31F-1EEE-D3FD-34A3-84FE625551DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 12:24:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T12:24:17.553 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:26:12.709 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:26:12.709 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:26:12.709 [Cloud] Queued cloud request. 2026-09-14T12:26:12.709 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:26:12.709 [Cloud] Dequeued cloud request. 2026-09-14T12:26:12.709 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:26:22.834 [Cloud] End of cloud request. 2026-09-14T12:26:23.350 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:32:51.552 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:32:51.552 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:32:51.552 [Cloud] Queued cloud request. 2026-09-14T12:32:51.552 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:32:51.552 [Cloud] Dequeued cloud request. 2026-09-14T12:32:51.552 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:32:51.771 [Cloud] End of cloud request. 2026-09-14T12:32:52.287 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:32:59.474 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:32:59.474 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:32:59.474 [Cloud] Queued cloud request. 2026-09-14T12:32:59.474 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:32:59.474 [Cloud] Dequeued cloud request. 2026-09-14T12:32:59.474 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:32:59.553 [Cloud] End of cloud request. 2026-09-14T12:33:00.068 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:33:17.443 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:33:17.443 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:33:17.443 [Cloud] Queued cloud request. 2026-09-14T12:33:17.443 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:33:17.443 [Cloud] Dequeued cloud request. 2026-09-14T12:33:17.443 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:33:17.521 [Cloud] End of cloud request. 2026-09-14T12:33:18.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:33:32.818 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T12:35:38.365 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:35:38.365 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:35:38.365 [Cloud] Queued cloud request. 2026-09-14T12:35:38.365 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:35:38.365 [Cloud] Dequeued cloud request. 2026-09-14T12:35:38.365 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:35:38.568 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C2EFAC70-55D0-8095-6049-EEB8AC694B59} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 12:35:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T12:35:39.068 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:42:14.380 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:42:14.380 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:42:14.380 [Cloud] Queued cloud request. 2026-09-14T12:42:14.380 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:42:14.380 [Cloud] Dequeued cloud request. 2026-09-14T12:42:14.380 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:42:14.568 [Cloud] End of cloud request. 2026-09-14T12:42:15.083 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:42:52.490 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:42:52.490 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:42:52.490 [Cloud] Queued cloud request. 2026-09-14T12:42:52.490 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:42:52.490 [Cloud] Dequeued cloud request. 2026-09-14T12:42:52.490 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:42:52.568 [Cloud] End of cloud request. 2026-09-14T12:42:53.083 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:43:01.880 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:43:01.880 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:43:01.880 [Cloud] Queued cloud request. 2026-09-14T12:43:01.880 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:43:01.880 [Cloud] Dequeued cloud request. 2026-09-14T12:43:01.880 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:43:01.958 [Cloud] End of cloud request. 2026-09-14T12:43:02.458 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:45:31.427 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:45:31.427 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:45:31.427 [Cloud] Queued cloud request. 2026-09-14T12:45:31.427 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:45:31.427 [Cloud] Dequeued cloud request. 2026-09-14T12:45:31.443 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:45:31.630 [Cloud] End of cloud request. 2026-09-14T12:45:32.130 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:47:35.427 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:47:35.427 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:47:35.427 [Cloud] Queued cloud request. 2026-09-14T12:47:35.427 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:47:35.427 [Cloud] Dequeued cloud request. 2026-09-14T12:47:35.427 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:47:35.583 [Cloud] End of cloud request. 2026-09-14T12:47:36.099 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:48:19.661 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:48:19.661 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:48:19.661 [Cloud] Queued cloud request. 2026-09-14T12:48:19.661 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:48:19.661 [Cloud] Dequeued cloud request. 2026-09-14T12:48:19.661 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:48:19.739 [Cloud] End of cloud request. 2026-09-14T12:48:20.239 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:48:37.817 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T12:51:32.802 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:51:32.802 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:51:32.802 [Cloud] Queued cloud request. 2026-09-14T12:51:32.802 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:51:32.802 [Cloud] Dequeued cloud request. 2026-09-14T12:51:32.817 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:51:32.989 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DF775113-8BED-2F60-4B20-BB378BCDDE87} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 12:51:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T12:51:33.505 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:51:46.239 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:51:46.239 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:51:46.239 [Cloud] Queued cloud request. 2026-09-14T12:51:46.239 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:51:46.239 [Cloud] Dequeued cloud request. 2026-09-14T12:51:46.239 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:51:46.317 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4ED4594C-A503-0FCD-79DE-7B7931365E4B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 12:51:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T12:51:46.817 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:54:28.755 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:54:28.755 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:54:28.755 [Cloud] Queued cloud request. 2026-09-14T12:54:28.755 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:54:28.755 [Cloud] Dequeued cloud request. 2026-09-14T12:54:28.755 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:54:28.896 [Cloud] End of cloud request. 2026-09-14T12:54:29.411 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:56:00.536 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:56:00.552 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:56:00.552 [Cloud] Queued cloud request. 2026-09-14T12:56:00.552 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:56:00.770 [Cloud] Dequeued cloud request. 2026-09-14T12:56:00.770 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:56:00.911 [Cloud] End of cloud request. 2026-09-14T12:56:01.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:57:27.129 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:57:27.129 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:57:27.129 [Cloud] Queued cloud request. 2026-09-14T12:57:27.129 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:57:27.129 [Cloud] Dequeued cloud request. 2026-09-14T12:57:27.161 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{8C592FBE-AF44-39A1-838D-51F7C7622812} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 12:57:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T12:57:27.708 [Cloud] End of cloud request. 2026-09-14T12:57:28.239 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:58:24.130 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:58:24.130 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:58:24.130 [Cloud] Queued cloud request. 2026-09-14T12:58:24.130 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:58:24.130 [Cloud] Dequeued cloud request. 2026-09-14T12:58:24.130 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:58:24.223 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{397B6065-687C-C71B-3E2D-F9CA502ADD7D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 12:58:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T12:58:24.723 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T12:58:28.380 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T12:58:28.380 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T12:58:28.380 [Cloud] Queued cloud request. 2026-09-14T12:58:28.380 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T12:58:28.380 [Cloud] Dequeued cloud request. 2026-09-14T12:58:28.380 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T12:58:28.473 [Cloud] End of cloud request. 2026-09-14T12:58:28.989 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:00:41.755 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:00:41.755 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:00:41.770 [Cloud] Queued cloud request. 2026-09-14T13:00:41.770 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:00:41.926 [Cloud] Dequeued cloud request. 2026-09-14T13:00:41.926 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:00:42.145 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2012DE3D-92A0-A77D-8741-017021352B23} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 13:00:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T13:00:42.645 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:00:42.895 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:00:42.895 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:00:42.895 [Cloud] Queued cloud request. 2026-09-14T13:00:42.895 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:00:42.895 [Cloud] Dequeued cloud request. 2026-09-14T13:00:42.895 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:00:42.973 [Cloud] End of cloud request. 2026-09-14T13:00:43.473 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:03:42.817 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T13:04:47.942 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:04:47.942 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:04:47.958 [Cloud] Queued cloud request. 2026-09-14T13:04:47.958 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:04:47.958 [Cloud] Dequeued cloud request. 2026-09-14T13:04:48.192 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:04:48.379 [Cloud] End of cloud request. 2026-09-14T13:04:48.895 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:08:05.645 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:08:05.645 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:08:05.645 [Cloud] Queued cloud request. 2026-09-14T13:08:05.645 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:08:05.645 [Cloud] Dequeued cloud request. 2026-09-14T13:08:05.645 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:08:05.848 [Cloud] End of cloud request. 2026-09-14T13:08:06.363 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:14:30.801 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:14:30.801 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:14:30.801 [Cloud] Queued cloud request. 2026-09-14T13:14:30.801 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:14:30.801 [Cloud] Dequeued cloud request. 2026-09-14T13:14:30.801 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:14:31.098 [Cloud] End of cloud request. 2026-09-14T13:14:31.598 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:16:56.363 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:16:56.363 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:16:56.363 [Cloud] Queued cloud request. 2026-09-14T13:16:56.363 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:16:56.363 [Cloud] Dequeued cloud request. 2026-09-14T13:16:56.363 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:16:56.535 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{50266939-49B7-AAA9-6C05-64371CEA2433} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 13:16:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T13:16:57.035 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:18:47.816 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T13:19:36.816 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:19:36.816 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:19:36.816 [Cloud] Queued cloud request. 2026-09-14T13:19:36.816 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:19:36.816 [Cloud] Dequeued cloud request. 2026-09-14T13:19:36.832 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:19:36.988 [Cloud] End of cloud request. 2026-09-14T13:19:37.504 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:20:27.004 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:20:27.004 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:20:27.004 [Cloud] Queued cloud request. 2026-09-14T13:20:27.004 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:20:27.004 [Cloud] Dequeued cloud request. 2026-09-14T13:20:27.004 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:20:27.082 [Cloud] End of cloud request. 2026-09-14T13:20:27.598 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:27:14.988 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:27:14.988 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:27:14.988 [Cloud] Queued cloud request. 2026-09-14T13:27:14.988 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:27:14.988 [Cloud] Dequeued cloud request. 2026-09-14T13:27:14.988 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:27:15.128 [Cloud] End of cloud request. 2026-09-14T13:27:15.628 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:28:46.894 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 37100, Count: 1687, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T13:28:46.894 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 33694, Count: 1909, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-14T13:28:46.894 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-14T13:28:46.894 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 971, Count: 55, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-14T13:28:46.894 ProcessImageName: WmiPrvSE.exe, Pid: 2908, TotalTime: 708, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-14T13:28:46.894 ProcessImageName: WmiPrvSE.exe, Pid: 1432, TotalTime: 348, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 35% 2026-09-14T13:28:46.894 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-14T13:28:46.894 ProcessImageName: powershell.exe, Pid: 5432, TotalTime: 293, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-14T13:28:46.894 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T13:28:46.894 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-14T13:28:46.894 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-14T13:28:46.894 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T13:28:46.894 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-14T13:28:46.894 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-2.MAD, EstimatedImpact: 0% 2026-09-14T13:28:46.894 ProcessImageName: DeviceCensus.exe, Pid: 5068, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 6% 2026-09-14T13:28:46.894 ProcessImageName: mysqldump.exe, Pid: 7272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-14T13:28:46.894 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-14T13:28:46.894 ProcessImageName: cmd.exe, Pid: 6656, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-14T13:28:46.894 ProcessImageName: python.exe, Pid: 6112, TotalTime: 45, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-14T13:28:46.894 ProcessImageName: powershell.exe, Pid: 2876, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-14T13:28:46.894 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-14T13:30:12.722 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:30:12.722 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:30:12.722 [Cloud] Queued cloud request. 2026-09-14T13:30:12.722 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:30:12.722 [Cloud] Dequeued cloud request. 2026-09-14T13:30:12.722 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:30:12.878 [Cloud] End of cloud request. 2026-09-14T13:30:13.378 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:30:23.238 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:30:23.238 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:30:23.238 [Cloud] Queued cloud request. 2026-09-14T13:30:23.238 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:30:23.238 [Cloud] Dequeued cloud request. 2026-09-14T13:30:23.238 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:30:23.347 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E3131E4C-8357-4574-6F16-923C4C81ED64} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 13:30:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T13:30:23.863 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:32:16.159 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:32:16.159 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:32:16.159 [Cloud] Queued cloud request. 2026-09-14T13:32:16.159 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:32:16.159 [Cloud] Dequeued cloud request. 2026-09-14T13:32:16.159 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:32:16.300 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4887C6E8-AD88-A240-7CA3-27B4BBB9FF0A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 13:32:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T13:32:16.800 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:33:52.816 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T13:35:07.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:35:07.925 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:35:07.925 [Cloud] Queued cloud request. 2026-09-14T13:35:07.925 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:35:07.925 [Cloud] Dequeued cloud request. 2026-09-14T13:35:07.925 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:35:08.081 [Cloud] End of cloud request. 2026-09-14T13:35:08.581 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:35:42.191 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:35:42.191 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:35:42.191 [Cloud] Queued cloud request. 2026-09-14T13:35:42.191 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:35:42.191 [Cloud] Dequeued cloud request. 2026-09-14T13:35:42.191 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:35:42.300 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D3997C6E-43D3-904D-2734-72059C2BFDA0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 13:35:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T13:35:42.816 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:37:19.065 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:37:19.065 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:37:19.065 [Cloud] Queued cloud request. 2026-09-14T13:37:19.065 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:37:19.065 [Cloud] Dequeued cloud request. 2026-09-14T13:37:19.065 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:37:19.222 [Cloud] End of cloud request. 2026-09-14T13:37:19.722 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:38:04.144 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:38:04.144 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:38:04.144 [Cloud] Queued cloud request. 2026-09-14T13:38:04.144 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:38:04.144 [Cloud] Dequeued cloud request. 2026-09-14T13:38:04.144 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:38:04.253 [Cloud] End of cloud request. 2026-09-14T13:38:04.753 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:40:10.987 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:40:10.987 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:40:10.987 [Cloud] Queued cloud request. 2026-09-14T13:40:10.987 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:40:10.987 [Cloud] Dequeued cloud request. 2026-09-14T13:40:10.987 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:40:11.190 [Cloud] End of cloud request. 2026-09-14T13:40:11.690 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:41:24.956 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:41:24.956 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:41:24.956 [Cloud] Queued cloud request. 2026-09-14T13:41:24.956 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:41:24.956 [Cloud] Dequeued cloud request. 2026-09-14T13:41:24.956 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:41:25.159 [Cloud] End of cloud request. 2026-09-14T13:41:25.659 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:45:51.378 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:45:51.378 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:45:51.378 [Cloud] Queued cloud request. 2026-09-14T13:45:51.378 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:45:51.378 [Cloud] Dequeued cloud request. 2026-09-14T13:45:51.393 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:45:53.065 [Cloud] End of cloud request. 2026-09-14T13:45:53.581 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T13:48:57.815 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T13:58:24.846 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T13:58:24.846 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T13:58:24.846 [Cloud] Queued cloud request. 2026-09-14T13:58:24.846 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T13:58:24.846 [Cloud] Dequeued cloud request. 2026-09-14T13:58:24.846 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T13:58:28.705 [Cloud] End of cloud request. 2026-09-14T13:58:29.221 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:00:13.190 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:00:13.190 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:00:13.190 [Cloud] Queued cloud request. 2026-09-14T14:00:13.190 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:00:13.190 [Cloud] Dequeued cloud request. 2026-09-14T14:00:13.190 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:00:13.346 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{80BECF08-E4EB-9E88-647F-8BD5C51A4042} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 14:00:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T14:00:13.846 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:00:51.565 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:00:51.565 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:00:51.565 [Cloud] Queued cloud request. 2026-09-14T14:00:51.565 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:00:51.565 [Cloud] Dequeued cloud request. 2026-09-14T14:00:51.565 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:00:51.705 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CD7D8857-F90F-C55C-A2F4-3C5BFCFEAB5B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 14:00:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T14:00:52.221 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:01:54.877 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:01:54.877 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:01:54.877 [Cloud] Queued cloud request. 2026-09-14T14:01:54.877 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:01:54.877 [Cloud] Dequeued cloud request. 2026-09-14T14:01:54.877 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:01:55.065 [Cloud] End of cloud request. 2026-09-14T14:01:55.580 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:03:42.237 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:03:42.237 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:03:42.237 [Cloud] Queued cloud request. 2026-09-14T14:03:42.237 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:03:42.237 [Cloud] Dequeued cloud request. 2026-09-14T14:03:42.237 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:03:42.690 [Cloud] End of cloud request. 2026-09-14T14:03:43.190 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:04:02.815 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T14:07:59.721 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:07:59.721 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:07:59.721 [Cloud] Queued cloud request. 2026-09-14T14:07:59.721 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:07:59.721 [Cloud] Dequeued cloud request. 2026-09-14T14:07:59.721 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:07:59.892 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A9B2EAB7-D171-64B5-5001-084B2A9D023A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 14:07:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T14:08:00.408 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:12:50.564 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:12:50.564 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:12:50.564 [Cloud] Queued cloud request. 2026-09-14T14:12:50.564 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:12:50.564 [Cloud] Dequeued cloud request. 2026-09-14T14:12:50.580 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:12:50.783 [Cloud] End of cloud request. 2026-09-14T14:12:51.299 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:16:50.220 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:16:50.220 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:16:50.220 [Cloud] Queued cloud request. 2026-09-14T14:16:50.220 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:16:50.220 [Cloud] Dequeued cloud request. 2026-09-14T14:16:50.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:16:50.408 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9C19170D-BFF7-F2C8-AFDE-368B7DB2F855} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 14:16:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T14:16:50.923 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:19:07.814 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T14:20:55.423 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:20:55.423 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:20:55.423 [Cloud] Queued cloud request. 2026-09-14T14:20:55.423 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:20:55.423 [Cloud] Dequeued cloud request. 2026-09-14T14:20:55.423 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:20:55.611 [Cloud] End of cloud request. 2026-09-14T14:20:56.126 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:21:17.267 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:21:17.267 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:21:17.267 [Cloud] Queued cloud request. 2026-09-14T14:21:17.267 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:21:17.267 [Cloud] Dequeued cloud request. 2026-09-14T14:21:17.267 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:21:17.361 [Cloud] End of cloud request. 2026-09-14T14:21:17.861 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:21:21.079 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:21:21.079 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:21:21.079 [Cloud] Queued cloud request. 2026-09-14T14:21:21.079 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:21:21.079 [Cloud] Dequeued cloud request. 2026-09-14T14:21:21.079 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:21:21.189 [Cloud] End of cloud request. 2026-09-14T14:21:21.689 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:26:03.064 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:26:03.064 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:26:03.064 [Cloud] Queued cloud request. 2026-09-14T14:26:03.064 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:26:03.064 [Cloud] Dequeued cloud request. 2026-09-14T14:26:03.064 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:26:03.236 [Cloud] End of cloud request. 2026-09-14T14:26:03.751 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:33:40.345 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:33:40.345 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:33:40.345 [Cloud] Queued cloud request. 2026-09-14T14:33:40.345 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:33:40.345 [Cloud] Dequeued cloud request. 2026-09-14T14:33:40.345 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:33:40.501 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{03B7326B-A45E-D0E0-52EE-0CB986D41253} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 14:33:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T14:33:41.017 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:34:12.814 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T14:38:53.360 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:38:53.360 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:38:53.360 [Cloud] Queued cloud request. 2026-09-14T14:38:53.360 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:38:53.360 [Cloud] Dequeued cloud request. 2026-09-14T14:38:53.376 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:38:53.579 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D58EB56C-12CC-993F-B740-5A362D8ACC25} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 14:38:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T14:38:54.079 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:40:09.719 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:40:09.719 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:40:09.719 [Cloud] Queued cloud request. 2026-09-14T14:40:09.719 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:40:09.719 [Cloud] Dequeued cloud request. 2026-09-14T14:40:09.719 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:40:09.938 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D3609ACF-D136-57AA-2DD5-AAFABC573336} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 14:40:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T14:40:10.438 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:40:16.360 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:40:16.360 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:40:16.360 [Cloud] Queued cloud request. 2026-09-14T14:40:16.360 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:40:16.360 [Cloud] Dequeued cloud request. 2026-09-14T14:40:16.360 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:40:16.454 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{22E89F21-ED22-870E-96A1-962D796A1413} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 14:40:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T14:40:16.954 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:46:09.548 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:46:09.548 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:46:09.548 [Cloud] Queued cloud request. 2026-09-14T14:46:09.548 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:46:09.548 [Cloud] Dequeued cloud request. 2026-09-14T14:46:09.548 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:46:09.735 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{371A83AD-BF97-4411-EC8A-A66BE941A446} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 14:46:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T14:46:10.235 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:46:24.173 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:46:24.173 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:46:24.173 [Cloud] Queued cloud request. 2026-09-14T14:46:24.173 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:46:24.173 [Cloud] Dequeued cloud request. 2026-09-14T14:46:24.173 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:46:24.266 [Cloud] End of cloud request. 2026-09-14T14:46:24.766 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:47:19.047 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:47:19.047 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:47:19.047 [Cloud] Queued cloud request. 2026-09-14T14:47:19.047 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:47:19.047 [Cloud] Dequeued cloud request. 2026-09-14T14:47:19.047 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:47:19.141 [Cloud] End of cloud request. 2026-09-14T14:47:19.641 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:47:22.907 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:47:22.907 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:47:22.907 [Cloud] Queued cloud request. 2026-09-14T14:47:22.907 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:47:22.907 [Cloud] Dequeued cloud request. 2026-09-14T14:47:22.907 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:47:22.985 [Cloud] End of cloud request. 2026-09-14T14:47:23.485 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:47:45.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:47:45.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:47:45.297 [Cloud] Queued cloud request. 2026-09-14T14:47:45.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:47:45.297 [Cloud] Dequeued cloud request. 2026-09-14T14:47:45.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:47:45.375 [Cloud] End of cloud request. 2026-09-14T14:47:45.891 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:49:16.688 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:49:16.688 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:49:16.688 [Cloud] Queued cloud request. 2026-09-14T14:49:16.688 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:49:16.688 [Cloud] Dequeued cloud request. 2026-09-14T14:49:16.688 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:49:16.875 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8A04A458-58D8-97EB-24B5-B6B6B131C966} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 14:49:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T14:49:17.375 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:49:17.813 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T14:50:52.735 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:50:52.735 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:50:52.735 [Cloud] Queued cloud request. 2026-09-14T14:50:52.735 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:50:52.735 [Cloud] Dequeued cloud request. 2026-09-14T14:50:52.735 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:50:52.938 [Cloud] End of cloud request. 2026-09-14T14:50:53.454 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:52:05.266 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:52:05.266 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:52:05.266 [Cloud] Queued cloud request. 2026-09-14T14:52:05.266 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:52:05.281 [Cloud] Dequeued cloud request. 2026-09-14T14:52:05.281 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:52:05.485 [Cloud] End of cloud request. 2026-09-14T14:52:06.000 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:55:29.469 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:55:29.469 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:55:29.469 [Cloud] Queued cloud request. 2026-09-14T14:55:29.469 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:55:29.469 [Cloud] Dequeued cloud request. 2026-09-14T14:55:29.469 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:55:30.000 [Cloud] End of cloud request. 2026-09-14T14:55:30.500 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T14:56:50.891 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T14:56:50.891 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T14:56:50.891 [Cloud] Queued cloud request. 2026-09-14T14:56:50.891 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T14:56:50.891 [Cloud] Dequeued cloud request. 2026-09-14T14:56:50.891 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T14:56:51.094 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CB3A20D6-0DFE-0345-8B09-CBA564030C17} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 14:56:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T14:56:51.594 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:00:20.609 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:00:20.609 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:00:20.609 [Cloud] Queued cloud request. 2026-09-14T15:00:20.609 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:00:20.609 [Cloud] Dequeued cloud request. 2026-09-14T15:00:20.609 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:00:20.797 [Cloud] End of cloud request. 2026-09-14T15:00:21.313 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:03:59.234 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:03:59.234 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:03:59.234 [Cloud] Queued cloud request. 2026-09-14T15:03:59.234 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:03:59.234 [Cloud] Dequeued cloud request. 2026-09-14T15:03:59.234 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:03:59.391 [Cloud] End of cloud request. 2026-09-14T15:03:59.906 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:04:22.812 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T15:05:07.641 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:05:07.641 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:05:07.641 [Cloud] Queued cloud request. 2026-09-14T15:05:07.641 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:05:07.641 [Cloud] Dequeued cloud request. 2026-09-14T15:05:07.844 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:05:17.937 [Cloud] End of cloud request. 2026-09-14T15:05:18.453 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:09:59.281 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:09:59.281 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:09:59.281 [Cloud] Queued cloud request. 2026-09-14T15:09:59.281 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:09:59.281 [Cloud] Dequeued cloud request. 2026-09-14T15:09:59.281 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:09:59.875 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D8227780-8279-F436-1185-0A73DB6D6F48} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 15:09:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T15:10:00.375 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:13:31.203 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:13:31.203 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:13:31.203 [Cloud] Queued cloud request. 2026-09-14T15:13:31.203 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:13:31.203 [Cloud] Dequeued cloud request. 2026-09-14T15:13:31.203 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:13:31.359 [Cloud] End of cloud request. 2026-09-14T15:13:31.859 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:15:22.906 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:15:22.906 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:15:22.906 [Cloud] Queued cloud request. 2026-09-14T15:15:22.906 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:15:22.906 [Cloud] Dequeued cloud request. 2026-09-14T15:15:22.906 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:15:23.078 [Cloud] End of cloud request. 2026-09-14T15:15:23.593 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:19:27.812 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T15:24:16.859 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:24:16.859 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:24:16.859 [Cloud] Queued cloud request. 2026-09-14T15:24:16.859 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:24:17.109 [Cloud] Dequeued cloud request. 2026-09-14T15:24:17.109 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:24:17.281 [Cloud] End of cloud request. 2026-09-14T15:24:17.796 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:24:48.827 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:24:48.827 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:24:48.827 [Cloud] Queued cloud request. 2026-09-14T15:24:48.827 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:24:48.827 [Cloud] Dequeued cloud request. 2026-09-14T15:24:48.827 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:24:48.952 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F174CE1-1013-9DBC-E994-44090B2D504A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 15:24:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T15:24:49.468 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:24:58.031 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:24:58.031 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:24:58.031 [Cloud] Queued cloud request. 2026-09-14T15:24:58.031 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:24:58.031 [Cloud] Dequeued cloud request. 2026-09-14T15:24:58.031 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:24:58.140 [Cloud] End of cloud request. 2026-09-14T15:24:58.640 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:28:46.905 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 41373, Count: 1859, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T15:28:46.905 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 35107, Count: 1932, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-14T15:28:46.905 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-14T15:28:46.905 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1033, Count: 57, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-14T15:28:46.905 ProcessImageName: WmiPrvSE.exe, Pid: 2908, TotalTime: 708, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-14T15:28:46.905 ProcessImageName: WmiPrvSE.exe, Pid: 1432, TotalTime: 348, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 35% 2026-09-14T15:28:46.905 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-14T15:28:46.905 ProcessImageName: powershell.exe, Pid: 5432, TotalTime: 293, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-14T15:28:46.905 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T15:28:46.905 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-14T15:28:46.905 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T15:28:46.905 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-14T15:28:46.905 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-14T15:28:46.905 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-14edf-2.MAD, EstimatedImpact: 0% 2026-09-14T15:28:46.905 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-14T15:28:46.905 ProcessImageName: DeviceCensus.exe, Pid: 5068, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 6% 2026-09-14T15:28:46.905 ProcessImageName: mysqldump.exe, Pid: 7272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-14T15:28:46.905 ProcessImageName: cmd.exe, Pid: 6656, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-14T15:28:46.905 ProcessImageName: python.exe, Pid: 6112, TotalTime: 45, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-14T15:28:46.905 ProcessImageName: powershell.exe, Pid: 2876, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-14T15:28:46.905 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-14T15:29:26.827 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:29:26.827 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:29:26.827 [Cloud] Queued cloud request. 2026-09-14T15:29:26.827 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:29:26.827 [Cloud] Dequeued cloud request. 2026-09-14T15:29:26.827 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:29:27.030 [Cloud] End of cloud request. 2026-09-14T15:29:27.546 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:33:49.233 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:33:49.233 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:33:49.233 [Cloud] Queued cloud request. 2026-09-14T15:33:49.233 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:33:49.233 [Cloud] Dequeued cloud request. 2026-09-14T15:33:49.249 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:33:49.436 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B101F339-0EEA-E763-D716-9458F52D10FE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 15:33:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T15:33:49.936 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:34:32.811 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T15:36:11.140 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:36:11.140 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:36:11.140 [Cloud] Queued cloud request. 2026-09-14T15:36:11.140 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:36:11.140 [Cloud] Dequeued cloud request. 2026-09-14T15:36:11.140 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:36:11.343 [Cloud] End of cloud request. 2026-09-14T15:36:11.843 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:40:03.764 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:40:03.764 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:40:03.764 [Cloud] Queued cloud request. 2026-09-14T15:40:03.764 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:40:03.780 [Cloud] Dequeued cloud request. 2026-09-14T15:40:03.780 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:40:03.952 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5844A317-1452-47E0-9BE6-EC6D14E542FE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 15:40:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T15:40:04.452 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:40:40.983 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:40:40.983 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:40:40.983 [Cloud] Queued cloud request. 2026-09-14T15:40:40.983 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:40:40.999 [Cloud] Dequeued cloud request. 2026-09-14T15:40:40.999 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:40:41.077 [Cloud] End of cloud request. 2026-09-14T15:40:41.592 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:43:47.983 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:43:47.983 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:43:47.983 [Cloud] Queued cloud request. 2026-09-14T15:43:47.983 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:43:47.983 [Cloud] Dequeued cloud request. 2026-09-14T15:43:47.983 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:43:48.170 [Cloud] End of cloud request. 2026-09-14T15:43:48.670 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:43:56.436 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:43:56.436 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:43:56.436 [Cloud] Queued cloud request. 2026-09-14T15:43:56.436 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:43:56.436 [Cloud] Dequeued cloud request. 2026-09-14T15:43:56.436 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:43:56.514 [Cloud] End of cloud request. 2026-09-14T15:43:57.014 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T15:49:37.811 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T15:51:23.217 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T15:51:23.217 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T15:51:23.217 [Cloud] Queued cloud request. 2026-09-14T15:51:23.217 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T15:51:23.358 [Cloud] Dequeued cloud request. 2026-09-14T15:51:23.545 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T15:51:23.733 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{14AC5A90-55D1-2903-2F24-0E219BBBB1DF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 15:51:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T15:51:24.233 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:00:54.982 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:00:54.982 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:00:54.982 [Cloud] Queued cloud request. 2026-09-14T16:00:54.982 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:00:54.982 [Cloud] Dequeued cloud request. 2026-09-14T16:00:54.982 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:00:55.154 [Cloud] End of cloud request. 2026-09-14T16:00:55.654 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:02:06.841 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:02:06.841 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:02:06.841 [Cloud] Queued cloud request. 2026-09-14T16:02:06.841 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:02:06.841 [Cloud] Dequeued cloud request. 2026-09-14T16:02:06.857 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:02:07.076 [Cloud] End of cloud request. 2026-09-14T16:02:07.591 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:04:42.810 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T16:19:47.810 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T16:20:51.294 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:20:51.294 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:20:51.294 [Cloud] Queued cloud request. 2026-09-14T16:20:51.294 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:20:51.294 [Cloud] Dequeued cloud request. 2026-09-14T16:20:51.294 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:20:51.450 [Cloud] End of cloud request. 2026-09-14T16:20:51.950 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:27:09.763 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:27:09.763 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:27:09.763 [Cloud] Queued cloud request. 2026-09-14T16:27:09.763 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:27:09.935 [Cloud] Dequeued cloud request. 2026-09-14T16:27:09.935 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:27:10.091 [Cloud] End of cloud request. 2026-09-14T16:27:10.606 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:30:33.637 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:30:33.637 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:30:33.637 [Cloud] Queued cloud request. 2026-09-14T16:30:33.637 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:30:33.637 [Cloud] Dequeued cloud request. 2026-09-14T16:30:33.637 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:30:33.778 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F11F1CF5-81E5-5F8A-819F-6F2E035205BC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 16:30:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T16:30:34.278 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:33:13.825 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:33:13.825 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:33:13.825 [Cloud] Queued cloud request. 2026-09-14T16:33:13.825 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:33:13.825 [Cloud] Dequeued cloud request. 2026-09-14T16:33:13.825 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:33:14.028 [Cloud] End of cloud request. 2026-09-14T16:33:14.544 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:33:21.794 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:33:21.794 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:33:21.794 [Cloud] Queued cloud request. 2026-09-14T16:33:21.794 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:33:21.794 [Cloud] Dequeued cloud request. 2026-09-14T16:33:21.794 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:33:21.887 [Cloud] End of cloud request. 2026-09-14T16:33:22.387 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:34:52.809 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T16:39:37.121 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:39:37.121 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:39:37.121 [Cloud] Queued cloud request. 2026-09-14T16:39:37.121 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:39:37.121 [Cloud] Dequeued cloud request. 2026-09-14T16:39:37.121 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:39:37.309 [Cloud] End of cloud request. 2026-09-14T16:39:37.825 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:41:02.059 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:41:02.059 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:41:02.059 [Cloud] Queued cloud request. 2026-09-14T16:41:02.059 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:41:02.059 [Cloud] Dequeued cloud request. 2026-09-14T16:41:02.059 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:41:02.246 [Cloud] End of cloud request. 2026-09-14T16:41:02.762 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:43:39.028 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:43:39.028 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:43:39.028 [Cloud] Queued cloud request. 2026-09-14T16:43:39.028 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:43:39.028 [Cloud] Dequeued cloud request. 2026-09-14T16:43:39.028 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:43:49.121 [Cloud] End of cloud request. 2026-09-14T16:43:49.637 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:45:15.434 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:45:15.434 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:45:15.434 [Cloud] Queued cloud request. 2026-09-14T16:45:15.434 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:45:15.434 [Cloud] Dequeued cloud request. 2026-09-14T16:45:15.434 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:45:15.590 [Cloud] End of cloud request. 2026-09-14T16:45:16.090 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:45:32.153 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:45:32.153 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:45:32.153 [Cloud] Queued cloud request. 2026-09-14T16:45:32.153 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:45:32.153 [Cloud] Dequeued cloud request. 2026-09-14T16:45:32.153 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:45:32.246 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F5B739E-4B7B-E403-6C4D-251F4004B335} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 16:45:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T16:45:32.746 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:49:57.809 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T16:52:43.856 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:52:43.856 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:52:43.856 [Cloud] Queued cloud request. 2026-09-14T16:52:43.856 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:52:44.012 [Cloud] Dequeued cloud request. 2026-09-14T16:52:44.012 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:52:44.246 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5781FE1B-3B41-E101-1C8A-DEC71D4B5C13} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 16:52:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T16:52:44.762 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T16:54:45.652 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T16:54:45.652 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T16:54:45.652 [Cloud] Queued cloud request. 2026-09-14T16:54:45.652 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T16:54:45.652 [Cloud] Dequeued cloud request. 2026-09-14T16:54:45.652 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T16:54:45.856 [Cloud] End of cloud request. 2026-09-14T16:54:46.356 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:05:02.808 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T17:09:37.511 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:09:37.511 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:09:37.511 [Cloud] Queued cloud request. 2026-09-14T17:09:37.511 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:09:37.511 [Cloud] Dequeued cloud request. 2026-09-14T17:09:37.511 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:09:37.667 [Cloud] End of cloud request. 2026-09-14T17:09:38.183 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:10:40.402 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:10:40.402 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:10:40.402 [Cloud] Queued cloud request. 2026-09-14T17:10:40.402 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:10:40.417 [Cloud] Dequeued cloud request. 2026-09-14T17:10:40.417 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:10:40.558 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1976E181-14F3-26C2-5748-E57D6AB7F01B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 17:10:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T17:10:41.074 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:11:00.245 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:11:00.245 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:11:00.245 [Cloud] Queued cloud request. 2026-09-14T17:11:00.245 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:11:00.245 [Cloud] Dequeued cloud request. 2026-09-14T17:11:00.245 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:11:00.324 [Cloud] End of cloud request. 2026-09-14T17:11:00.824 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:11:15.089 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:11:15.089 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:11:15.089 [Cloud] Queued cloud request. 2026-09-14T17:11:15.089 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:11:15.089 [Cloud] Dequeued cloud request. 2026-09-14T17:11:15.089 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:11:15.183 [Cloud] End of cloud request. 2026-09-14T17:11:15.699 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:12:07.589 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:12:07.589 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:12:07.589 [Cloud] Queued cloud request. 2026-09-14T17:12:07.589 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:12:07.589 [Cloud] Dequeued cloud request. 2026-09-14T17:12:07.589 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:12:07.683 [Cloud] End of cloud request. 2026-09-14T17:12:08.183 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:16:29.011 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:16:29.011 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:16:29.011 [Cloud] Queued cloud request. 2026-09-14T17:16:29.011 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:16:29.011 [Cloud] Dequeued cloud request. 2026-09-14T17:16:29.011 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:16:29.167 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{79E9026E-E59F-A67F-1384-A9FE6E01FD48} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 17:16:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T17:16:29.683 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:20:07.808 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T17:23:34.386 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:23:34.386 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:23:34.386 [Cloud] Queued cloud request. 2026-09-14T17:23:34.386 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:23:34.386 [Cloud] Dequeued cloud request. 2026-09-14T17:23:34.386 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:23:34.558 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C9703D52-3546-FBF7-B5C4-56E580D33CA8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 17:23:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T17:23:35.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:25:52.854 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:25:52.854 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:25:52.854 [Cloud] Queued cloud request. 2026-09-14T17:25:52.854 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:25:52.854 [Cloud] Dequeued cloud request. 2026-09-14T17:25:52.854 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:25:53.011 [Cloud] End of cloud request. 2026-09-14T17:25:53.511 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:26:50.042 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:26:50.042 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:26:50.042 [Cloud] Queued cloud request. 2026-09-14T17:26:50.042 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:26:50.042 [Cloud] Dequeued cloud request. 2026-09-14T17:26:50.042 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:26:50.120 [Cloud] End of cloud request. 2026-09-14T17:26:50.636 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:28:46.901 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 45572, Count: 2035, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T17:28:46.901 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 35291, Count: 1950, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-14T17:28:46.901 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-14T17:28:46.901 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1157, Count: 61, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-14T17:28:46.901 ProcessImageName: WmiPrvSE.exe, Pid: 2908, TotalTime: 708, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-14T17:28:46.901 ProcessImageName: WmiPrvSE.exe, Pid: 1432, TotalTime: 348, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 35% 2026-09-14T17:28:46.901 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-14T17:28:46.901 ProcessImageName: powershell.exe, Pid: 5432, TotalTime: 293, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-14T17:28:46.901 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T17:28:46.901 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-14T17:28:46.901 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 136, Count: 58, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-150ca-0.MAI, EstimatedImpact: 0% 2026-09-14T17:28:46.901 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T17:28:46.901 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-14T17:28:46.901 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-14T17:28:46.901 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-14T17:28:46.901 ProcessImageName: DeviceCensus.exe, Pid: 5068, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 6% 2026-09-14T17:28:46.901 ProcessImageName: mysqldump.exe, Pid: 7272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-14T17:28:46.901 ProcessImageName: cmd.exe, Pid: 6656, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-14T17:28:46.901 ProcessImageName: python.exe, Pid: 6112, TotalTime: 45, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-14T17:28:46.901 ProcessImageName: powershell.exe, Pid: 2876, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-14T17:28:46.901 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-14T17:30:32.698 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:30:32.698 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:30:32.698 [Cloud] Queued cloud request. 2026-09-14T17:30:32.698 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:30:32.698 [Cloud] Dequeued cloud request. 2026-09-14T17:30:32.698 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:30:32.838 [Cloud] End of cloud request. 2026-09-14T17:30:33.338 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:30:35.338 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:30:35.338 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:30:35.338 [Cloud] Queued cloud request. 2026-09-14T17:30:35.338 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:30:35.338 [Cloud] Dequeued cloud request. 2026-09-14T17:30:35.338 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:30:45.354 [Cloud] End of cloud request. 2026-09-14T17:30:45.869 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:35:12.807 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T17:36:31.385 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:36:31.385 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:36:31.385 [Cloud] Queued cloud request. 2026-09-14T17:36:31.385 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:36:31.385 [Cloud] Dequeued cloud request. 2026-09-14T17:36:31.385 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:36:31.604 [Cloud] End of cloud request. 2026-09-14T17:36:32.104 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:48:26.322 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:48:26.322 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:48:26.322 [Cloud] Queued cloud request. 2026-09-14T17:48:26.322 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:48:26.322 [Cloud] Dequeued cloud request. 2026-09-14T17:48:26.322 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:48:26.510 [Cloud] End of cloud request. 2026-09-14T17:48:27.010 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:49:41.135 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:49:41.135 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:49:41.135 [Cloud] Queued cloud request. 2026-09-14T17:49:41.135 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:49:41.135 [Cloud] Dequeued cloud request. 2026-09-14T17:49:41.135 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:49:48.353 [Cloud] End of cloud request. 2026-09-14T17:49:48.853 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:50:17.806 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T17:50:44.166 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:50:44.166 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:50:44.166 [Cloud] Queued cloud request. 2026-09-14T17:50:44.166 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:50:44.166 [Cloud] Dequeued cloud request. 2026-09-14T17:50:44.166 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:50:44.260 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{01E693B6-7210-4A88-0220-37A8B1D9E0B5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 17:50:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T17:50:44.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:55:46.650 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:55:46.650 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:55:46.650 [Cloud] Queued cloud request. 2026-09-14T17:55:46.650 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:55:46.650 [Cloud] Dequeued cloud request. 2026-09-14T17:55:46.650 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:55:46.869 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B26A0D55-8827-CE49-F987-D3ADAD289DBD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 17:55:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T17:55:47.369 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:57:35.291 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:57:35.291 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:57:35.291 [Cloud] Queued cloud request. 2026-09-14T17:57:35.291 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:57:35.291 [Cloud] Dequeued cloud request. 2026-09-14T17:57:35.306 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:57:35.494 [Cloud] End of cloud request. 2026-09-14T17:57:36.009 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T17:58:16.572 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T17:58:16.572 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T17:58:16.572 [Cloud] Queued cloud request. 2026-09-14T17:58:16.572 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T17:58:16.572 [Cloud] Dequeued cloud request. 2026-09-14T17:58:16.572 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T17:58:16.665 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{18028A4C-7146-AF98-0F2B-A2DFEBFB93FB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 17:58:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T17:58:17.166 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:04:43.072 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:04:43.072 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:04:43.072 [Cloud] Queued cloud request. 2026-09-14T18:04:43.072 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:04:43.072 [Cloud] Dequeued cloud request. 2026-09-14T18:04:43.072 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:04:43.228 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2DF0AA9D-141E-9CEF-21C0-D633A7329AA6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 18:04:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T18:04:43.728 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:05:22.806 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T18:11:15.024 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:11:15.024 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:11:15.024 [Cloud] Queued cloud request. 2026-09-14T18:11:15.024 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:11:15.024 [Cloud] Dequeued cloud request. 2026-09-14T18:11:15.040 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:11:23.384 [Cloud] End of cloud request. 2026-09-14T18:11:23.884 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:12:03.868 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:12:03.868 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:12:03.868 [Cloud] Queued cloud request. 2026-09-14T18:12:03.868 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:12:03.868 [Cloud] Dequeued cloud request. 2026-09-14T18:12:03.868 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:12:03.962 [Cloud] End of cloud request. 2026-09-14T18:12:04.462 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:12:36.462 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:12:36.462 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:12:36.462 [Cloud] Queued cloud request. 2026-09-14T18:12:36.462 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:12:36.462 [Cloud] Dequeued cloud request. 2026-09-14T18:12:36.462 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:12:36.556 [Cloud] End of cloud request. 2026-09-14T18:12:37.056 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:14:27.368 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:14:27.368 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:14:27.368 [Cloud] Queued cloud request. 2026-09-14T18:14:27.368 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:14:27.368 [Cloud] Dequeued cloud request. 2026-09-14T18:14:27.368 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:14:27.524 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9E43AFE4-5C63-C8AB-6508-0B43207F14BA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 18:14:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T18:14:28.024 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:20:27.809 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T18:23:30.465 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:23:30.481 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:23:30.481 [Cloud] Queued cloud request. 2026-09-14T18:23:30.481 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:23:30.481 [Cloud] Dequeued cloud request. 2026-09-14T18:23:30.481 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:23:30.637 [Cloud] End of cloud request. 2026-09-14T18:23:31.153 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:35:32.809 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T18:38:35.215 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:38:35.215 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:38:35.215 [Cloud] Queued cloud request. 2026-09-14T18:38:35.215 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:38:35.371 [Cloud] Dequeued cloud request. 2026-09-14T18:38:35.371 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:38:35.574 [Cloud] End of cloud request. 2026-09-14T18:38:36.074 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:39:30.355 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:39:30.355 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:39:30.355 [Cloud] Queued cloud request. 2026-09-14T18:39:30.355 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:39:30.355 [Cloud] Dequeued cloud request. 2026-09-14T18:39:30.371 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:39:30.449 [Cloud] End of cloud request. 2026-09-14T18:39:30.949 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:41:04.699 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:41:04.699 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:41:04.699 [Cloud] Queued cloud request. 2026-09-14T18:41:04.699 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:41:04.699 [Cloud] Dequeued cloud request. 2026-09-14T18:41:04.699 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:41:04.886 [Cloud] End of cloud request. 2026-09-14T18:41:05.402 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:41:36.496 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:41:36.496 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:41:36.496 [Cloud] Queued cloud request. 2026-09-14T18:41:36.496 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:41:36.496 [Cloud] Dequeued cloud request. 2026-09-14T18:41:36.496 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:41:36.589 [Cloud] End of cloud request. 2026-09-14T18:41:37.089 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:42:21.418 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:42:21.418 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:42:21.418 [Cloud] Queued cloud request. 2026-09-14T18:42:21.418 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:42:21.418 [Cloud] Dequeued cloud request. 2026-09-14T18:42:21.418 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:42:21.761 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C3EBDBA5-3531-EFD9-2E30-75D02F494D97} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 18:42:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T18:42:22.261 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:43:50.839 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:43:50.839 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:43:50.839 [Cloud] Queued cloud request. 2026-09-14T18:43:50.839 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:43:50.855 [Cloud] Dequeued cloud request. 2026-09-14T18:43:50.855 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:43:51.042 [Cloud] End of cloud request. 2026-09-14T18:43:51.543 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:47:58.355 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:47:58.355 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:47:58.355 [Cloud] Queued cloud request. 2026-09-14T18:47:58.355 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:47:58.355 [Cloud] Dequeued cloud request. 2026-09-14T18:47:58.370 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:47:58.558 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6A70247E-F9CE-CDA8-ECC5-B87AD7EC1538} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 18:47:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T18:47:59.074 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:48:23.980 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:48:23.980 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:48:23.980 [Cloud] Queued cloud request. 2026-09-14T18:48:23.980 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:48:23.980 [Cloud] Dequeued cloud request. 2026-09-14T18:48:23.980 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:48:24.074 [Cloud] End of cloud request. 2026-09-14T18:48:24.589 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:50:03.261 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:50:03.261 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:50:03.261 [Cloud] Queued cloud request. 2026-09-14T18:50:03.261 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:50:03.261 [Cloud] Dequeued cloud request. 2026-09-14T18:50:03.261 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:50:03.402 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D27350A6-768B-7316-24C8-A1BAA8FAAE2F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 18:50:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T18:50:03.902 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:50:37.808 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T18:55:30.198 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:55:30.198 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:55:30.198 [Cloud] Queued cloud request. 2026-09-14T18:55:30.198 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:55:30.198 [Cloud] Dequeued cloud request. 2026-09-14T18:55:30.370 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:55:30.542 [Cloud] End of cloud request. 2026-09-14T18:55:31.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:56:11.855 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:56:11.870 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:56:11.870 [Cloud] Queued cloud request. 2026-09-14T18:56:11.870 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:56:11.870 [Cloud] Dequeued cloud request. 2026-09-14T18:56:11.870 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:56:11.948 [Cloud] End of cloud request. 2026-09-14T18:56:12.448 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:56:16.417 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:56:16.417 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:56:16.417 [Cloud] Queued cloud request. 2026-09-14T18:56:16.417 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:56:16.417 [Cloud] Dequeued cloud request. 2026-09-14T18:56:16.417 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:56:16.511 [Cloud] End of cloud request. 2026-09-14T18:56:17.011 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:56:27.339 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:56:27.339 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:56:27.339 [Cloud] Queued cloud request. 2026-09-14T18:56:27.339 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:56:27.339 [Cloud] Dequeued cloud request. 2026-09-14T18:56:27.339 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:56:27.417 [Cloud] End of cloud request. 2026-09-14T18:56:27.917 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:56:38.323 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:56:38.323 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:56:38.323 [Cloud] Queued cloud request. 2026-09-14T18:56:38.323 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:56:38.323 [Cloud] Dequeued cloud request. 2026-09-14T18:56:38.323 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:56:38.417 [Cloud] End of cloud request. 2026-09-14T18:56:38.933 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:56:53.995 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:56:53.995 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:56:53.995 [Cloud] Queued cloud request. 2026-09-14T18:56:53.995 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:56:53.995 [Cloud] Dequeued cloud request. 2026-09-14T18:56:53.995 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:56:54.073 [Cloud] End of cloud request. 2026-09-14T18:56:54.589 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:58:53.417 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:58:53.417 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:58:53.417 [Cloud] Queued cloud request. 2026-09-14T18:58:53.417 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:58:53.417 [Cloud] Dequeued cloud request. 2026-09-14T18:58:53.417 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:58:53.558 [Cloud] End of cloud request. 2026-09-14T18:58:54.073 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T18:59:40.354 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T18:59:40.354 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T18:59:40.354 [Cloud] Queued cloud request. 2026-09-14T18:59:40.354 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T18:59:40.354 [Cloud] Dequeued cloud request. 2026-09-14T18:59:40.370 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T18:59:40.479 [Cloud] End of cloud request. 2026-09-14T18:59:40.995 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:05:42.807 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T19:08:51.463 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:08:51.463 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:08:51.463 [Cloud] Queued cloud request. 2026-09-14T19:08:51.463 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:08:51.463 [Cloud] Dequeued cloud request. 2026-09-14T19:08:51.479 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:08:51.760 [Cloud] End of cloud request. 2026-09-14T19:08:52.260 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:12:00.182 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:12:00.182 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:12:00.182 [Cloud] Queued cloud request. 2026-09-14T19:12:00.182 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:12:00.182 [Cloud] Dequeued cloud request. 2026-09-14T19:12:00.182 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:12:00.369 [Cloud] End of cloud request. 2026-09-14T19:12:00.885 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:12:12.557 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:12:12.557 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:12:12.557 [Cloud] Queued cloud request. 2026-09-14T19:12:12.557 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:12:12.557 [Cloud] Dequeued cloud request. 2026-09-14T19:12:12.557 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:12:12.651 [Cloud] End of cloud request. 2026-09-14T19:12:13.166 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:14:12.073 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:14:12.073 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:14:12.073 [Cloud] Queued cloud request. 2026-09-14T19:14:12.073 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:14:12.073 [Cloud] Dequeued cloud request. 2026-09-14T19:14:12.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:14:12.260 [Cloud] End of cloud request. 2026-09-14T19:14:12.776 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:15:29.713 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:15:29.713 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:15:29.713 [Cloud] Queued cloud request. 2026-09-14T19:15:29.713 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:15:29.713 [Cloud] Dequeued cloud request. 2026-09-14T19:15:29.729 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:15:29.916 [Cloud] End of cloud request. 2026-09-14T19:15:30.432 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:19:39.353 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:19:39.353 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:19:39.353 [Cloud] Queued cloud request. 2026-09-14T19:19:39.353 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:19:39.353 [Cloud] Dequeued cloud request. 2026-09-14T19:19:39.353 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:19:39.556 [Cloud] End of cloud request. 2026-09-14T19:19:40.072 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:20:47.806 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T19:24:26.681 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:24:26.681 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:24:26.681 [Cloud] Queued cloud request. 2026-09-14T19:24:26.681 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:24:26.681 [Cloud] Dequeued cloud request. 2026-09-14T19:24:26.681 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:24:26.869 [Cloud] End of cloud request. 2026-09-14T19:24:27.369 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:25:07.103 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:25:07.103 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:25:07.103 [Cloud] Queued cloud request. 2026-09-14T19:25:07.103 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:25:07.103 [Cloud] Dequeued cloud request. 2026-09-14T19:25:07.103 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:25:07.181 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2EBBD541-03A4-7180-3E21-362BF926422E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 19:25:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T19:25:07.681 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:26:16.431 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:26:16.431 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:26:16.431 [Cloud] Queued cloud request. 2026-09-14T19:26:16.431 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:26:16.431 [Cloud] Dequeued cloud request. 2026-09-14T19:26:16.431 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:26:16.619 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{835B01AB-78F4-6ED2-6D77-35323CED46F4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 19:26:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T19:26:17.134 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:27:41.150 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:27:41.150 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:27:41.150 [Cloud] Queued cloud request. 2026-09-14T19:27:41.150 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:27:41.150 [Cloud] Dequeued cloud request. 2026-09-14T19:27:41.150 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:27:51.290 [Cloud] End of cloud request. 2026-09-14T19:27:51.790 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:28:17.806 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-14T19:28:17.837 Job Notification: New process added to job (5824) 2026-09-14T19:28:17.853 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-14T19:28:17.853 Aggressive catchup quick scan threshold: 692445842103 / 25920000000000 2026-09-14T19:28:17.853 Job Notification: New process added to job (1184) 2026-09-14T19:28:17.868 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:5824] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:1184]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-14T19:28:18.040 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-14T19:28:18.040 Job Notification: New process added to job (1104) 2026-09-14T19:28:18.056 Job Notification: New process added to job (5796) 2026-09-14T19:28:18.107 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:1104] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:5796]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-14T19:28:18.197 Job Notification: New process added to job (4944) 2026-09-14T19:28:18.212 Task(GetDeviceTicket -AccessKey E7A8A6A6-625E-7997-CED3-239B1E548D8D ) launched as network service 2026-09-14T19:28:18.384 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-14T19:28:18.384 [RTP] Duplicating the current plugin configuration object... 2026-09-14T19:28:18.384 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-14T19:28:18.384 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-14T19:28:18.384 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-14T19:28:18.384 [RTP] No config change detected. Not updating plugin configuration. 2026-09-14T19:28:18.384 [RTP] No config changes found. No configuration switch. 2026-09-14T19:28:18.384 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-14T19:28:18.947 Job Notification: Process exited from job (4944) 2026-09-14T19:28:19.150 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-14T19:28:19.150 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:28:19.150 [Cloud] Queued cloud request. 2026-09-14T19:28:19.150 [Cloud] Dequeued cloud request. 2026-09-14T19:28:19.150 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:28:19.197 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-14T19:28:19.197 [Cloud] End of cloud request. 2026-09-14T19:28:19.665 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:28:38.634 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\F122DAA1-2087-47C7-AD35-0EA3FB35E740690.1dd447f3ca057f5 2026-09-14T19:28:38.712 Verifying engine and signature files (source: 0) ... 2026-09-14T19:28:38.712 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1}\mpengine.dll] due to PPL. 2026-09-14T19:28:38.712 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1}\mpasbase.vdm]. File not in cache (0x1) 2026-09-14T19:28:39.884 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1}\mpasbase.vdm] 2026-09-14T19:28:39.884 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-14T19:28:39.900 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1}\mpasdlta.vdm] 2026-09-14T19:28:39.900 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1}\mpavbase.vdm]. File not in cache (0x1) 2026-09-14T19:28:40.415 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1}\mpavbase.vdm] 2026-09-14T19:28:40.415 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-14T19:28:40.431 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1}\mpavdlta.vdm] 2026-09-14T19:28:40.650 [Engine] IsHybridMode: 0 2026-09-14T19:28:40.650 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-14T19:28:40.665 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-B2AF7CF866398E110D96070A80B64434E906AFAF.bin): 0x00000002 2026-09-14T19:28:40.665 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-B2AF7CF866398E110D96070A80B64434E906AFAF.bin) 2026-09-14T19:28:40.665 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-14T19:28:40.665 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-14T19:28:40.665 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-14T19:28:40.665 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff 2026-09-14T19:28:46.900 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 49940, Count: 2204, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T19:28:46.900 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 36292, Count: 2019, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-14T19:28:46.900 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-14T19:28:46.900 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1249, Count: 67, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-14T19:28:46.900 ProcessImageName: WmiPrvSE.exe, Pid: 2908, TotalTime: 708, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-14T19:28:46.900 ProcessImageName: WmiPrvSE.exe, Pid: 1432, TotalTime: 348, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 35% 2026-09-14T19:28:46.900 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-14T19:28:46.900 ProcessImageName: powershell.exe, Pid: 5432, TotalTime: 293, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-14T19:28:46.900 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T19:28:46.900 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 166, Count: 62, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-150ca-0.MAI, EstimatedImpact: 0% 2026-09-14T19:28:46.900 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-14T19:28:46.900 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-14T19:28:46.900 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T19:28:46.900 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-14T19:28:46.900 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-14T19:28:46.900 ProcessImageName: DeviceCensus.exe, Pid: 5068, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 6% 2026-09-14T19:28:46.900 ProcessImageName: mysqldump.exe, Pid: 7272, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-14T19:28:46.900 ProcessImageName: cmd.exe, Pid: 6656, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-14T19:28:46.900 ProcessImageName: python.exe, Pid: 6112, TotalTime: 45, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-14T19:28:46.900 ProcessImageName: powershell.exe, Pid: 2876, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-14T19:28:46.900 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-14T19:28:53.197 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-14T19:28:53.197 [AutoExclusion] Applied roles from cache. 2026-09-14T19:28:53.197 [AutoExclusion] Started roles monitoring. 2026-09-14T19:28:53.322 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF68AB020, lRefCount: 6, hr=0 2026-09-14T19:28:53.322 [Engine] New active engine 00007FFCF4ABB020 replacing engine 00007FFCF68AB020. Number of active engines: 2 2026-09-14T19:28:53.337 EngineInit:Global ASOC is enabled 2026-09-14T19:28:53.337 EngineInit:ASOO is enabled for developer volumes 2026-09-14T19:28:53.447 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.462 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-14T19:28:53.493 MpWriteUupSignatureVersion 1.459.209.0, hr = 0 2026-09-14T19:28:53.493 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-14T19:28:53.525 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-14T19:28:53.525 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-14T19:28:53.525 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-14T19:28:53.525 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-14T19:28:53.556 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-14T19:28:53.556 [Plugin] Initializing RTP plugin state... 2026-09-14T19:28:53.556 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-14T19:28:53.556 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎13‎-‎2026 21:28:47 Last Perf:‎09‎-‎13‎-‎2026 21:28:47 First RTP Scan:‎09‎-‎13‎-‎2026 21:28:47 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1292 Misses:7799 BM Queue:0,29,0 Proc:0,26,0 File:0,29,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:5858006 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:-1293149822 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:15138 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:784458 TotalHits:22738007 InstanceCacheInserts:453430 InstanceCacheUpdates:0 InstanceCacheDeletes:68816 InstanceCacheHits:16861 InstanceCacheMisses:808692 InstanceCacheOverflows:367691 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:5ms (8792/1476) Success: 1476, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-14T19:28:53.556 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1} 2026-09-14T19:28:53.556 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D}\mpasbase.vdm in use, hr=0x80070020 2026-09-14T19:28:53.556 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-14T19:28:53.556 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7187F906-E6EF-4D9E-86E9-7992EBADEB8C} removed 2026-09-14T19:28:53.556 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-14T19:28:53.556 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-14T19:28:53.556 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-14T19:28:53.556 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-14T19:28:53.556 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-14-2026 19:28:53 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-14-2026 19:28:53 2026-09-14T19:28:53.556 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-14T19:28:53.556 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-14T19:28:53.556 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-14T19:28:53.556 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-14T19:28:53.572 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:28:53.572 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-14T19:28:53.572 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-14T19:28:53.572 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-14T19:28:53.572 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-14T19:28:53.572 MdCoreSvc is supported in this platform and OS Signature updated on 09-14-2026 19:28:53 Product Version: 4.18.26080.3 Service Version: 4.18.26080.3 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.209.0 AV Signature Version: 1.459.209.0 ************************************************************ 2026-09-14T19:28:53.572 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-14T19:28:53.572 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\F122DAA1-2087-47C7-AD35-0EA3FB35E740690.1dd447f3ca057f5 2026-09-14T19:28:53.587 Process scan (postsignatureupdatescan) started. 2026-09-14T19:28:53.634 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-14T19:28:53.634 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-14-2026 19:28:53 ************************************************************ 2026-09-14T19:28:53.853 Job Notification: Process exited from job (1104) 2026-09-14T19:28:53.853 Job Notification: Process exited from job (5824) 2026-09-14T19:28:53.868 Job Notification: Process exited from job (5796) 2026-09-14T19:28:53.868 Job Notification: Process exited from job (1184) 2026-09-14T19:28:53.915 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-14T19:28:53.915 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-14T19:28:53.915 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-14T19:28:53.915 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-14T19:28:53.915 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-14T19:28:53.915 [Engine] Engine 00007FFCF68AB020 no longer in use. Number of active engines: 1 2026-09-14T19:28:53.915 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-14T19:28:53.915 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-14T19:28:54.009 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-14T19:28:54.009 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-14T19:28:54.009 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-14T19:28:54.415 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 49940, Count: 2204, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T19:28:54.415 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 36292, Count: 2019, MaxTime: 500, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-14T19:28:54.415 ProcessImageName: powershell.exe, Pid: 3412, TotalTime: 1478, Count: 91, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 34% 2026-09-14T19:28:54.415 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1249, Count: 67, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-14T19:28:54.415 ProcessImageName: WmiPrvSE.exe, Pid: 2908, TotalTime: 708, Count: 26, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-14T19:28:54.415 ProcessImageName: WmiPrvSE.exe, Pid: 1432, TotalTime: 348, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf->(UTF-16LE), EstimatedImpact: 35% 2026-09-14T19:28:54.415 ProcessImageName: powershell.exe, Pid: 7584, TotalTime: 310, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-14T19:28:54.415 ProcessImageName: powershell.exe, Pid: 5432, TotalTime: 293, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-14T19:28:54.415 ProcessImageName: WmiPrvSE.exe, Pid: 4140, TotalTime: 232, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T19:28:54.415 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 166, Count: 62, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-150ca-0.MAI, EstimatedImpact: 0% 2026-09-14T19:28:54.415 ProcessImageName: python.exe, Pid: 6896, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-14T19:28:54.415 ProcessImageName: taskhostw.exe, Pid: 1132, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-14T19:28:54.415 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T19:28:54.478 [Engine] RSIG_UNLOADENGINE, 00007FFCF68AB020, err=0x0 2026-09-14T19:28:54.525 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1FF57CF0-7BE7-4691-A7B4-6A6558B4283D} removed 2026-09-14T19:29:02.087 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:29:02.087 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:29:02.087 [Cloud] Queued cloud request. 2026-09-14T19:29:02.087 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:29:02.087 [Cloud] Dequeued cloud request. 2026-09-14T19:29:02.087 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:29:02.165 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2EBA3844-F46C-2F68-1310-BC1361F35156} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 19:29:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T19:29:02.665 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:29:09.900 Process scan (postsignatureupdatescan) completed. 2026-09-14T19:33:53.431 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-14T19:35:52.806 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T19:37:16.602 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:37:16.602 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:37:16.602 [Cloud] Queued cloud request. 2026-09-14T19:37:16.602 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:37:16.602 [Cloud] Dequeued cloud request. 2026-09-14T19:37:16.602 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:37:16.774 [Cloud] End of cloud request. 2026-09-14T19:37:17.274 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:44:42.598 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:44:42.598 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:44:42.598 [Cloud] Queued cloud request. 2026-09-14T19:44:42.598 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:44:42.598 [Cloud] Dequeued cloud request. 2026-09-14T19:44:42.598 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:44:42.754 [Cloud] End of cloud request. 2026-09-14T19:44:43.270 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:45:54.942 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:45:54.942 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:45:54.942 [Cloud] Queued cloud request. 2026-09-14T19:45:54.942 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:45:55.207 [Cloud] Dequeued cloud request. 2026-09-14T19:45:55.364 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:45:55.661 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A8D7B842-537B-49CF-48EF-613111EC0823} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 19:45:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T19:45:56.161 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:46:49.036 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:46:49.036 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:46:49.036 [Cloud] Queued cloud request. 2026-09-14T19:46:49.036 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:46:49.036 [Cloud] Dequeued cloud request. 2026-09-14T19:46:49.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:46:49.129 [Cloud] End of cloud request. 2026-09-14T19:46:49.629 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:50:57.801 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T19:55:53.207 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:55:53.207 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:55:53.207 [Cloud] Queued cloud request. 2026-09-14T19:55:53.207 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:55:53.207 [Cloud] Dequeued cloud request. 2026-09-14T19:55:53.223 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:55:53.411 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{184689EE-16C7-53D7-4912-DD96E497B832} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 19:55:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T19:55:53.911 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:57:35.363 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:57:35.363 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:57:35.363 [Cloud] Queued cloud request. 2026-09-14T19:57:35.363 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:57:35.379 [Cloud] Dequeued cloud request. 2026-09-14T19:57:35.379 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:57:35.551 [Cloud] End of cloud request. 2026-09-14T19:57:36.066 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T19:59:55.473 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T19:59:55.473 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T19:59:55.473 [Cloud] Queued cloud request. 2026-09-14T19:59:55.473 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T19:59:55.473 [Cloud] Dequeued cloud request. 2026-09-14T19:59:55.473 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T19:59:55.660 [Cloud] End of cloud request. 2026-09-14T19:59:56.160 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:01:31.301 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:01:31.301 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:01:31.301 [Cloud] Queued cloud request. 2026-09-14T20:01:31.301 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:01:31.457 [Cloud] Dequeued cloud request. 2026-09-14T20:01:31.629 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:01:31.801 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DA768308-3107-D635-4CDC-A3DC9743527A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 20:01:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T20:01:32.316 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:06:02.801 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T20:07:31.613 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:07:31.613 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:07:31.613 [Cloud] Queued cloud request. 2026-09-14T20:07:31.613 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:07:31.613 [Cloud] Dequeued cloud request. 2026-09-14T20:07:31.613 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:07:31.785 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F18E4501-8011-14D2-5689-3DD76B9D9B09} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 20:07:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T20:07:32.285 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:09:35.644 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:09:35.644 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:09:35.644 [Cloud] Queued cloud request. 2026-09-14T20:09:35.644 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:09:35.644 [Cloud] Dequeued cloud request. 2026-09-14T20:09:35.644 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:09:35.785 [Cloud] End of cloud request. 2026-09-14T20:09:36.285 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:11:52.269 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:11:52.269 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:11:52.269 [Cloud] Queued cloud request. 2026-09-14T20:11:52.269 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:11:52.269 [Cloud] Dequeued cloud request. 2026-09-14T20:11:52.269 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:11:52.425 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DC7D34C4-8A31-69FC-4F0E-2A7A301BC7D7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 20:11:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T20:11:52.925 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:12:28.363 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:12:28.363 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:12:28.363 [Cloud] Queued cloud request. 2026-09-14T20:12:28.363 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:12:28.363 [Cloud] Dequeued cloud request. 2026-09-14T20:12:28.519 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:12:28.613 [Cloud] End of cloud request. 2026-09-14T20:12:29.113 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:16:06.800 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:16:06.800 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:16:06.800 [Cloud] Queued cloud request. 2026-09-14T20:16:06.800 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:16:06.800 [Cloud] Dequeued cloud request. 2026-09-14T20:16:06.800 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:16:06.956 [Cloud] End of cloud request. 2026-09-14T20:16:07.456 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:17:37.284 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:17:37.284 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:17:37.284 [Cloud] Queued cloud request. 2026-09-14T20:17:37.284 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:17:37.284 [Cloud] Dequeued cloud request. 2026-09-14T20:17:37.284 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:17:37.425 [Cloud] End of cloud request. 2026-09-14T20:17:37.940 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:18:46.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:18:46.643 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:18:46.643 [Cloud] Queued cloud request. 2026-09-14T20:18:46.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:18:46.643 [Cloud] Dequeued cloud request. 2026-09-14T20:18:46.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{FF49F3B2-7E07-2EF7-DA1C-7005AF03C3E9} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 20:18:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T20:18:56.753 [Cloud] End of cloud request. 2026-09-14T20:18:57.253 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:20:58.831 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:20:58.831 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:20:58.831 [Cloud] Queued cloud request. 2026-09-14T20:20:58.831 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:20:58.831 [Cloud] Dequeued cloud request. 2026-09-14T20:20:58.831 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:20:58.987 [Cloud] End of cloud request. 2026-09-14T20:20:59.503 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:21:07.800 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T20:21:22.956 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:21:22.956 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:21:22.956 [Cloud] Queued cloud request. 2026-09-14T20:21:22.956 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:21:22.956 [Cloud] Dequeued cloud request. 2026-09-14T20:21:22.956 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:21:28.706 [Cloud] End of cloud request. 2026-09-14T20:21:29.206 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:26:53.565 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:26:53.565 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:26:53.565 [Cloud] Queued cloud request. 2026-09-14T20:26:53.565 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:26:53.565 [Cloud] Dequeued cloud request. 2026-09-14T20:26:53.565 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:26:53.737 [Cloud] End of cloud request. 2026-09-14T20:26:54.237 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:27:52.112 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:27:52.112 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:27:52.112 [Cloud] Queued cloud request. 2026-09-14T20:27:52.112 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:27:52.112 [Cloud] Dequeued cloud request. 2026-09-14T20:27:52.112 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:27:52.205 [Cloud] End of cloud request. 2026-09-14T20:27:52.705 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:29:23.315 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:29:23.315 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:29:23.315 [Cloud] Queued cloud request. 2026-09-14T20:29:23.315 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:29:23.315 [Cloud] Dequeued cloud request. 2026-09-14T20:29:23.315 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:29:23.737 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E216BB49-B5FD-AB43-AC1B-714903B2CC65} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 20:29:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T20:29:24.252 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:31:17.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:31:17.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:31:17.049 [Cloud] Queued cloud request. 2026-09-14T20:31:17.049 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:31:17.049 [Cloud] Dequeued cloud request. 2026-09-14T20:31:17.049 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:31:17.221 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2B0D9C5F-7C98-1ACC-7238-B9BB27B81D40} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 20:31:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T20:31:17.737 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:36:12.799 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T20:45:26.423 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:45:26.423 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:45:26.439 [Cloud] Queued cloud request. 2026-09-14T20:45:26.439 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:45:26.595 [Cloud] Dequeued cloud request. 2026-09-14T20:45:26.595 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:45:26.767 [Cloud] End of cloud request. 2026-09-14T20:45:27.283 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:49:53.001 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:49:53.001 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:49:53.001 [Cloud] Queued cloud request. 2026-09-14T20:49:53.001 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:49:53.001 [Cloud] Dequeued cloud request. 2026-09-14T20:49:53.017 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:49:53.189 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C70A20AA-804D-03B8-5EDA-E1F2B7B4F85C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 20:49:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T20:49:53.689 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:51:17.798 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T20:51:31.908 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:51:31.908 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:51:31.908 [Cloud] Queued cloud request. 2026-09-14T20:51:31.908 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:51:31.908 [Cloud] Dequeued cloud request. 2026-09-14T20:51:31.923 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:51:32.064 [Cloud] End of cloud request. 2026-09-14T20:51:32.564 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:52:24.470 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:52:24.470 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:52:24.470 [Cloud] Queued cloud request. 2026-09-14T20:52:24.470 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:52:24.470 [Cloud] Dequeued cloud request. 2026-09-14T20:52:24.470 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:52:24.564 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3F87A7E2-B7FF-562C-C699-9F0F50A86EC9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 20:52:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T20:52:25.079 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:52:33.064 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:52:33.064 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:52:33.064 [Cloud] Queued cloud request. 2026-09-14T20:52:33.064 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:52:33.064 [Cloud] Dequeued cloud request. 2026-09-14T20:52:33.064 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:52:33.158 [Cloud] End of cloud request. 2026-09-14T20:52:33.658 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:54:21.345 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:54:21.345 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:54:21.345 [Cloud] Queued cloud request. 2026-09-14T20:54:21.345 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:54:21.345 [Cloud] Dequeued cloud request. 2026-09-14T20:54:21.361 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:54:21.501 [Cloud] End of cloud request. 2026-09-14T20:54:22.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:56:51.001 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:56:51.001 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:56:51.001 [Cloud] Queued cloud request. 2026-09-14T20:56:51.001 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:56:51.001 [Cloud] Dequeued cloud request. 2026-09-14T20:56:51.001 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:56:51.251 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E7963AF9-5063-29FE-3F45-409C260D273C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 20:56:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T20:56:51.751 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T20:59:56.704 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T20:59:56.704 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T20:59:56.704 [Cloud] Queued cloud request. 2026-09-14T20:59:56.704 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T20:59:56.704 [Cloud] Dequeued cloud request. 2026-09-14T20:59:56.704 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T20:59:56.860 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6BD578E9-DC66-9389-41F2-A89B3476CC6A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 20:59:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T20:59:57.376 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:06:22.797 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T21:06:54.954 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:06:54.954 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:06:54.954 [Cloud] Queued cloud request. 2026-09-14T21:06:54.954 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:06:54.954 [Cloud] Dequeued cloud request. 2026-09-14T21:06:54.954 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:06:55.094 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D9878C50-5806-5799-9ED5-908BC64B63B7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 21:06:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T21:06:55.610 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:07:55.782 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:07:55.782 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:07:55.782 [Cloud] Queued cloud request. 2026-09-14T21:07:55.782 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:07:55.797 [Cloud] Dequeued cloud request. 2026-09-14T21:07:55.797 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:07:55.938 [Cloud] End of cloud request. 2026-09-14T21:07:56.438 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:08:39.813 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\IDR_XML_DEFAULT_TRANSFORM[1]. Process: \Device\HarddiskVolume2\Windows\System32\taskhostw.exe, Status: 0xc0000001, State: 0, ScanRequest #5891667, FileId: 0x2300000003a679, Reason: OnClose, IoStatusBlockForNewFile: 0x3, DesiredAccess:0x0, FileAttributes:0x2020, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-14T21:09:44.344 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:09:44.344 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:09:44.344 [Cloud] Queued cloud request. 2026-09-14T21:09:44.344 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:09:44.344 [Cloud] Dequeued cloud request. 2026-09-14T21:09:44.344 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:09:44.500 [Cloud] End of cloud request. 2026-09-14T21:09:45.000 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:11:39.750 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:11:39.750 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:11:39.750 [Cloud] Queued cloud request. 2026-09-14T21:11:39.750 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:11:39.750 [Cloud] Dequeued cloud request. 2026-09-14T21:11:39.750 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:11:39.891 [Cloud] End of cloud request. 2026-09-14T21:11:40.391 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:14:46.157 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:14:46.157 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:14:46.157 [Cloud] Queued cloud request. 2026-09-14T21:14:46.157 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:14:46.157 [Cloud] Dequeued cloud request. 2026-09-14T21:14:46.157 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:14:46.313 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FC07C05F-FDF4-E694-C415-B82A36F3627A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 21:14:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T21:14:46.813 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:18:04.359 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:18:04.359 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:18:04.359 [Cloud] Queued cloud request. 2026-09-14T21:18:04.359 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:18:04.359 [Cloud] Dequeued cloud request. 2026-09-14T21:18:04.359 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:18:04.515 [Cloud] End of cloud request. 2026-09-14T21:18:05.015 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:20:26.625 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:20:26.625 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:20:26.625 [Cloud] Queued cloud request. 2026-09-14T21:20:26.625 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:20:26.625 [Cloud] Dequeued cloud request. 2026-09-14T21:20:26.625 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:20:26.812 [Cloud] End of cloud request. 2026-09-14T21:20:27.328 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:20:37.703 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:20:37.703 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:20:37.703 [Cloud] Queued cloud request. 2026-09-14T21:20:37.703 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:20:37.703 [Cloud] Dequeued cloud request. 2026-09-14T21:20:37.703 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:20:37.781 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1F41FE51-6E0C-DE0C-CA69-8AAEC89F4EBA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 21:20:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T21:20:38.281 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:21:18.296 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:21:18.296 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:21:18.296 [Cloud] Queued cloud request. 2026-09-14T21:21:18.296 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:21:18.296 [Cloud] Dequeued cloud request. 2026-09-14T21:21:18.296 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:21:18.375 [Cloud] End of cloud request. 2026-09-14T21:21:18.875 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:21:27.796 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T21:21:35.375 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:21:35.375 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:21:35.375 [Cloud] Queued cloud request. 2026-09-14T21:21:35.375 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:21:35.375 [Cloud] Dequeued cloud request. 2026-09-14T21:21:35.375 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:21:35.468 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6DC99F32-58B1-CA8F-208C-104E8E89DABA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 21:21:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T21:21:35.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:24:24.655 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:24:24.655 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:24:24.655 [Cloud] Queued cloud request. 2026-09-14T21:24:24.655 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:24:24.655 [Cloud] Dequeued cloud request. 2026-09-14T21:24:24.655 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:24:24.859 [Cloud] End of cloud request. 2026-09-14T21:24:25.359 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:25:35.671 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:25:35.671 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:25:35.687 [Cloud] Queued cloud request. 2026-09-14T21:25:35.687 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:25:35.843 [Cloud] Dequeued cloud request. 2026-09-14T21:25:36.109 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:25:36.296 [Cloud] End of cloud request. 2026-09-14T21:25:36.812 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:26:37.749 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:26:37.749 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:26:37.749 [Cloud] Queued cloud request. 2026-09-14T21:26:37.749 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:26:37.749 [Cloud] Dequeued cloud request. 2026-09-14T21:26:37.749 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:26:37.937 [Cloud] End of cloud request. 2026-09-14T21:26:38.452 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:27:04.890 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:27:04.890 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:27:04.890 [Cloud] Queued cloud request. 2026-09-14T21:27:04.890 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:27:04.890 [Cloud] Dequeued cloud request. 2026-09-14T21:27:04.890 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:27:04.968 [Cloud] End of cloud request. 2026-09-14T21:27:05.468 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:27:12.234 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:27:12.234 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:27:12.234 [Cloud] Queued cloud request. 2026-09-14T21:27:12.234 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:27:12.234 [Cloud] Dequeued cloud request. 2026-09-14T21:27:12.234 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:27:12.312 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3484A1C5-67AB-C3B7-C4B1-C33645BF3279} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 21:27:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T21:27:12.827 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:27:48.671 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:27:48.671 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:27:48.671 [Cloud] Queued cloud request. 2026-09-14T21:27:48.671 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:27:48.671 [Cloud] Dequeued cloud request. 2026-09-14T21:27:48.671 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{315119D4-A0EF-7AA2-EDD3-66477213BA32} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 21:27:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T21:27:48.780 [Cloud] End of cloud request. 2026-09-14T21:27:49.280 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:28:38.921 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:28:38.921 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:28:38.921 [Cloud] Queued cloud request. 2026-09-14T21:28:38.921 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:28:38.921 [Cloud] Dequeued cloud request. 2026-09-14T21:28:38.937 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:28:39.015 [Cloud] End of cloud request. 2026-09-14T21:28:39.515 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:28:53.327 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 5344, Count: 335, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\team.php, EstimatedImpact: 0% 2026-09-14T21:28:53.327 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 4296, Count: 174, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T21:28:53.327 ProcessImageName: powershell.exe, Pid: 3540, TotalTime: 1804, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 39% 2026-09-14T21:28:53.327 ProcessImageName: WmiPrvSE.exe, Pid: 7368, TotalTime: 248, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T21:28:53.327 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 184, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-14T21:28:53.327 ProcessImageName: taskhostw.exe, Pid: 3436, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-14T21:28:53.327 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T21:28:53.327 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-14T21:28:53.327 ProcessImageName: taskhostw.exe, Pid: 6236, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-14T21:28:53.327 ProcessImageName: ngentask.exe, Pid: 8092, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-14T21:29:43.093 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:29:43.093 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:29:43.093 [Cloud] Queued cloud request. 2026-09-14T21:29:43.093 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:29:43.093 [Cloud] Dequeued cloud request. 2026-09-14T21:29:43.093 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:29:51.108 [Cloud] End of cloud request. 2026-09-14T21:29:51.608 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:31:50.952 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:31:50.952 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:31:50.952 [Cloud] Queued cloud request. 2026-09-14T21:31:50.952 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:31:50.952 [Cloud] Dequeued cloud request. 2026-09-14T21:31:50.968 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:31:51.108 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C437C537-2736-54B0-391E-1E55CD8B09B1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 21:31:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T21:31:51.608 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:36:04.936 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:36:04.936 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:36:04.936 [Cloud] Queued cloud request. 2026-09-14T21:36:04.936 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:36:04.936 [Cloud] Dequeued cloud request. 2026-09-14T21:36:05.124 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:36:05.264 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DE8FEA29-9DE7-96FF-BD43-305AF1D95397} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 21:36:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T21:36:05.764 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:36:32.796 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T21:41:27.452 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:41:27.452 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:41:27.452 [Cloud] Queued cloud request. 2026-09-14T21:41:27.452 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:41:27.452 [Cloud] Dequeued cloud request. 2026-09-14T21:41:27.452 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:41:27.608 [Cloud] End of cloud request. 2026-09-14T21:41:28.108 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:46:19.686 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:46:19.686 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:46:19.686 [Cloud] Queued cloud request. 2026-09-14T21:46:19.686 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:46:19.686 [Cloud] Dequeued cloud request. 2026-09-14T21:46:19.686 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:46:19.842 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DF628CD2-3F0A-85D5-5C16-F49FDC3D8063} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 21:46:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T21:46:20.342 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:46:45.733 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:46:45.733 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:46:45.733 [Cloud] Queued cloud request. 2026-09-14T21:46:45.733 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:46:45.733 [Cloud] Dequeued cloud request. 2026-09-14T21:46:45.733 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:46:45.811 [Cloud] End of cloud request. 2026-09-14T21:46:46.311 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:51:37.795 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T21:56:06.060 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:56:06.060 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:56:06.060 [Cloud] Queued cloud request. 2026-09-14T21:56:06.060 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:56:06.060 [Cloud] Dequeued cloud request. 2026-09-14T21:56:06.060 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:56:06.263 [Cloud] End of cloud request. 2026-09-14T21:56:06.779 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T21:57:21.919 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T21:57:21.919 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T21:57:21.919 [Cloud] Queued cloud request. 2026-09-14T21:57:21.919 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T21:57:21.919 [Cloud] Dequeued cloud request. 2026-09-14T21:57:21.919 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T21:57:22.076 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{88B4DBFF-2FDB-3264-5071-2F981E099384} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 21:57:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T21:57:22.576 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:00:02.091 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:00:02.091 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:00:02.091 [Cloud] Queued cloud request. 2026-09-14T22:00:02.091 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:00:02.091 [Cloud] Dequeued cloud request. 2026-09-14T22:00:02.091 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:00:09.185 [Cloud] End of cloud request. 2026-09-14T22:00:09.700 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:06:42.794 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T22:10:23.575 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:10:23.575 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:10:23.575 [Cloud] Queued cloud request. 2026-09-14T22:10:23.575 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:10:23.575 [Cloud] Dequeued cloud request. 2026-09-14T22:10:23.575 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:10:23.809 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{576DD18B-1D66-B037-24CA-15C185B45B07} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 22:10:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T22:10:24.309 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:11:36.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:11:36.700 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:11:36.700 [Cloud] Queued cloud request. 2026-09-14T22:11:36.700 [Cloud] Dequeued cloud request. 2026-09-14T22:11:36.700 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:11:36.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:11:36.872 [Cloud] End of cloud request. 2026-09-14T22:11:37.387 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:12:26.215 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:12:26.215 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:12:26.215 [Cloud] Queued cloud request. 2026-09-14T22:12:26.215 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:12:26.215 [Cloud] Dequeued cloud request. 2026-09-14T22:12:26.215 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:12:36.247 [Cloud] End of cloud request. 2026-09-14T22:12:36.747 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:13:05.075 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:13:05.075 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:13:05.075 [Cloud] Queued cloud request. 2026-09-14T22:13:05.075 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:13:05.075 [Cloud] Dequeued cloud request. 2026-09-14T22:13:05.075 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:13:05.169 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{29EA65C3-DD16-CD01-40BA-16382E07221B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 22:13:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T22:13:05.684 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:13:54.512 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:13:54.512 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:13:54.512 [Cloud] Queued cloud request. 2026-09-14T22:13:54.512 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:13:54.512 [Cloud] Dequeued cloud request. 2026-09-14T22:13:54.512 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:13:54.590 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{346B5399-F91E-08E3-8238-E3DE716410DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 22:13:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T22:13:55.106 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:15:35.747 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:15:35.747 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:15:35.747 [Cloud] Queued cloud request. 2026-09-14T22:15:35.747 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:15:35.747 [Cloud] Dequeued cloud request. 2026-09-14T22:15:35.747 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:15:35.934 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{202E858E-A3A6-933B-9398-2AB772BCDFDF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 22:15:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T22:15:36.450 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:21:47.793 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T22:29:17.167 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:29:17.167 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:29:17.167 [Cloud] Queued cloud request. 2026-09-14T22:29:17.167 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:29:17.167 [Cloud] Dequeued cloud request. 2026-09-14T22:29:17.183 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:29:18.230 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{94357160-DFE7-FA6D-3259-5984597CD64B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 22:29:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T22:29:18.730 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:35:06.886 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:35:06.886 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:35:06.886 [Cloud] Queued cloud request. 2026-09-14T22:35:06.886 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:35:06.886 [Cloud] Dequeued cloud request. 2026-09-14T22:35:06.886 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:35:07.074 [Cloud] End of cloud request. 2026-09-14T22:35:07.574 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:35:09.324 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:35:09.324 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:35:09.324 [Cloud] Queued cloud request. 2026-09-14T22:35:09.324 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:35:09.324 [Cloud] Dequeued cloud request. 2026-09-14T22:35:09.324 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:35:09.417 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{67DF686D-FBB1-F590-2D77-E8992761DFA9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 22:35:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T22:35:09.933 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:35:15.089 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:35:15.089 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:35:15.089 [Cloud] Queued cloud request. 2026-09-14T22:35:15.089 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:35:15.089 [Cloud] Dequeued cloud request. 2026-09-14T22:35:15.089 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:35:15.167 [Cloud] End of cloud request. 2026-09-14T22:35:15.667 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:36:41.198 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:36:41.198 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:36:41.198 [Cloud] Queued cloud request. 2026-09-14T22:36:41.198 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:36:41.198 [Cloud] Dequeued cloud request. 2026-09-14T22:36:41.198 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:36:41.402 [Cloud] End of cloud request. 2026-09-14T22:36:41.917 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:36:52.792 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T22:38:24.651 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:38:24.651 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:38:24.651 [Cloud] Queued cloud request. 2026-09-14T22:38:24.651 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:38:24.651 [Cloud] Dequeued cloud request. 2026-09-14T22:38:24.651 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:38:24.854 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7496A069-6E52-2CEA-C31D-7D1723B6909E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 22:38:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T22:38:25.354 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:39:50.010 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:39:50.010 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:39:50.010 [Cloud] Queued cloud request. 2026-09-14T22:39:50.010 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:39:50.010 [Cloud] Dequeued cloud request. 2026-09-14T22:39:50.010 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:39:50.167 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C372D213-3230-47E9-F467-5A4B9183C0E8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 22:39:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T22:39:50.682 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:42:49.042 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:42:49.042 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:42:49.042 [Cloud] Queued cloud request. 2026-09-14T22:42:49.042 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:42:49.042 [Cloud] Dequeued cloud request. 2026-09-14T22:42:49.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:42:49.198 [Cloud] End of cloud request. 2026-09-14T22:42:49.714 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:49:20.572 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:49:20.572 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:49:20.572 [Cloud] Queued cloud request. 2026-09-14T22:49:20.572 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:49:20.729 [Cloud] Dequeued cloud request. 2026-09-14T22:49:20.885 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:49:21.026 [Cloud] End of cloud request. 2026-09-14T22:49:21.526 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{830B5FAF-5573-51DC-A6F9-FE8D971EEB70} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-14-2026 22:50:26 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T22:50:27.541 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:50:27.541 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:50:27.541 [Cloud] Queued cloud request. 2026-09-14T22:50:27.541 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:50:27.541 [Cloud] Dequeued cloud request. 2026-09-14T22:50:27.541 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:50:27.869 [Cloud] End of cloud request. 2026-09-14T22:50:28.369 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:51:57.791 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T22:52:21.135 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:52:21.135 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:52:21.135 [Cloud] Queued cloud request. 2026-09-14T22:52:21.135 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:52:21.135 [Cloud] Dequeued cloud request. 2026-09-14T22:52:21.135 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:52:21.322 [Cloud] End of cloud request. 2026-09-14T22:52:21.838 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:56:34.791 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:56:34.791 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:56:34.791 [Cloud] Queued cloud request. 2026-09-14T22:56:34.791 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:56:34.791 [Cloud] Dequeued cloud request. 2026-09-14T22:56:34.963 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:56:36.666 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A896FE7A-F197-29AF-C438-ADB4FEB8E323} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 22:56:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T22:56:37.182 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T22:59:44.900 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T22:59:44.900 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T22:59:44.900 [Cloud] Queued cloud request. 2026-09-14T22:59:44.900 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T22:59:44.900 [Cloud] Dequeued cloud request. 2026-09-14T22:59:44.900 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T22:59:48.447 [Cloud] End of cloud request. 2026-09-14T22:59:48.947 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:03:22.806 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:03:22.806 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:03:22.806 [Cloud] Queued cloud request. 2026-09-14T23:03:22.806 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:03:22.806 [Cloud] Dequeued cloud request. 2026-09-14T23:03:22.806 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:03:23.009 [Cloud] End of cloud request. 2026-09-14T23:03:23.525 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:07:02.790 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T23:07:21.884 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:07:21.884 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:07:21.884 [Cloud] Queued cloud request. 2026-09-14T23:07:21.884 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:07:21.884 [Cloud] Dequeued cloud request. 2026-09-14T23:07:21.884 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:07:22.087 [Cloud] End of cloud request. 2026-09-14T23:07:22.587 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:09:45.009 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:09:45.009 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:09:45.009 [Cloud] Queued cloud request. 2026-09-14T23:09:45.009 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:09:45.009 [Cloud] Dequeued cloud request. 2026-09-14T23:09:45.024 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:09:45.399 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B001647C-BDAB-6AFE-731A-20A6C6AE3766} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 23:09:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T23:09:45.899 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:11:32.196 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:11:32.196 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:11:32.196 [Cloud] Queued cloud request. 2026-09-14T23:11:32.196 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:11:32.196 [Cloud] Dequeued cloud request. 2026-09-14T23:11:32.212 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:11:42.352 [Cloud] End of cloud request. 2026-09-14T23:11:42.852 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:15:48.477 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:15:48.477 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:15:48.477 [Cloud] Queued cloud request. 2026-09-14T23:15:48.477 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:15:48.477 [Cloud] Dequeued cloud request. 2026-09-14T23:15:48.633 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:15:48.821 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1FCD0912-335A-D00D-8FE2-38A99638B569} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 23:15:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T23:15:49.321 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:22:07.789 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T23:23:34.039 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:23:34.039 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:23:34.039 [Cloud] Queued cloud request. 2026-09-14T23:23:34.039 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:23:34.039 [Cloud] Dequeued cloud request. 2026-09-14T23:23:34.039 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:23:34.211 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25807B6D-0B12-933F-7F66-C8342A5810A8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 23:23:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T23:23:34.711 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:25:03.555 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:25:03.555 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:25:03.555 [Cloud] Queued cloud request. 2026-09-14T23:25:03.555 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:25:03.555 [Cloud] Dequeued cloud request. 2026-09-14T23:25:03.555 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:25:03.742 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AF7BA348-1141-DD90-ABB6-C957CE6D8933} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 23:25:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T23:25:04.242 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:28:53.336 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 8900, Count: 605, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\team.php, EstimatedImpact: 0% 2026-09-14T23:28:53.336 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 7132, Count: 297, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-14T23:28:53.336 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 2371, Count: 109, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-14T23:28:53.336 ProcessImageName: powershell.exe, Pid: 3540, TotalTime: 1804, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 39% 2026-09-14T23:28:53.336 ProcessImageName: AgentShellService.exe, Pid: 5036, TotalTime: 792, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-14T23:28:53.336 ProcessImageName: WmiPrvSE.exe, Pid: 6092, TotalTime: 736, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-14T23:28:53.336 ProcessImageName: WmiPrvSE.exe, Pid: 7368, TotalTime: 248, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-14T23:28:53.336 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 245, Count: 12, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-14T23:28:53.336 ProcessImageName: taskhostw.exe, Pid: 3436, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-14T23:28:53.336 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-14T23:28:53.336 ProcessImageName: powershell.exe, Pid: 6496, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rwprwnp5.upt.psm1, EstimatedImpact: 0% 2026-09-14T23:28:53.336 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-14T23:28:53.336 ProcessImageName: taskhostw.exe, Pid: 6236, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-14T23:28:53.336 ProcessImageName: ngentask.exe, Pid: 8092, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-14T23:35:33.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:35:33.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:35:33.304 [Cloud] Queued cloud request. 2026-09-14T23:35:33.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:35:33.304 [Cloud] Dequeued cloud request. 2026-09-14T23:35:33.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:35:33.476 [Cloud] End of cloud request. 2026-09-14T23:35:33.976 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:37:12.788 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T23:38:36.225 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:38:36.225 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:38:36.225 [Cloud] Queued cloud request. 2026-09-14T23:38:36.225 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:38:36.397 [Cloud] Dequeued cloud request. 2026-09-14T23:38:36.397 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:38:36.538 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C3D59474-0889-0034-1DE1-2B6C32E56CC5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 23:38:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T23:38:37.054 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:41:29.413 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:41:29.413 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:41:29.413 [Cloud] Queued cloud request. 2026-09-14T23:41:29.413 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:41:29.413 [Cloud] Dequeued cloud request. 2026-09-14T23:41:29.413 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:41:29.569 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{50384ED0-3B1A-BD59-6512-E028DECE7EA6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 23:41:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T23:41:30.069 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:48:59.569 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:48:59.569 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:48:59.569 [Cloud] Queued cloud request. 2026-09-14T23:48:59.569 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:48:59.569 [Cloud] Dequeued cloud request. 2026-09-14T23:48:59.569 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:48:59.741 [Cloud] End of cloud request. 2026-09-14T23:49:00.241 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:52:07.443 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:52:07.443 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:52:07.443 [Cloud] Queued cloud request. 2026-09-14T23:52:07.443 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:52:07.600 [Cloud] Dequeued cloud request. 2026-09-14T23:52:07.600 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:52:07.740 [Cloud] End of cloud request. 2026-09-14T23:52:08.240 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:52:17.787 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-14T23:53:52.209 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:53:52.209 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:53:52.209 [Cloud] Queued cloud request. 2026-09-14T23:53:52.209 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:53:52.209 [Cloud] Dequeued cloud request. 2026-09-14T23:53:52.209 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:53:52.396 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DB3A642E-6682-5D3F-84E0-CFAE41AB6BEB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-14-2026 23:53:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-14T23:53:52.897 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:55:54.162 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:55:54.162 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:55:54.162 [Cloud] Queued cloud request. 2026-09-14T23:55:54.162 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:55:54.162 [Cloud] Dequeued cloud request. 2026-09-14T23:55:54.162 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:55:54.318 [Cloud] End of cloud request. 2026-09-14T23:55:54.834 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-14T23:58:41.005 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-14T23:58:41.005 [Cloud] Start of cloud request. Passive mode: 0 2026-09-14T23:58:41.005 [Cloud] Queued cloud request. 2026-09-14T23:58:41.005 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-14T23:58:41.005 [Cloud] Dequeued cloud request. 2026-09-14T23:58:41.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-14T23:58:41.162 [Cloud] End of cloud request. 2026-09-14T23:58:41.662 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:07:22.786 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T00:07:46.302 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:07:46.302 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:07:46.302 [Cloud] Queued cloud request. 2026-09-15T00:07:46.302 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:07:46.302 [Cloud] Dequeued cloud request. 2026-09-15T00:07:46.302 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:07:46.505 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3D983F78-E779-5693-FCF7-37E469AA63EA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 00:07:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T00:07:47.005 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:09:20.614 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:09:20.614 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:09:20.614 [Cloud] Queued cloud request. 2026-09-15T00:09:20.614 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:09:20.614 [Cloud] Dequeued cloud request. 2026-09-15T00:09:20.630 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:09:20.802 [Cloud] End of cloud request. 2026-09-15T00:09:21.317 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:12:50.520 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:12:50.520 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:12:50.520 [Cloud] Queued cloud request. 2026-09-15T00:12:50.520 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:12:50.520 [Cloud] Dequeued cloud request. 2026-09-15T00:12:50.520 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:12:50.770 [Cloud] End of cloud request. 2026-09-15T00:12:51.270 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:12:54.348 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:12:54.348 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:12:54.348 [Cloud] Queued cloud request. 2026-09-15T00:12:54.348 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:12:54.348 [Cloud] Dequeued cloud request. 2026-09-15T00:12:54.348 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:12:54.427 [Cloud] End of cloud request. 2026-09-15T00:12:54.927 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:14:13.286 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:15148515-7699-435E-BC81-6F1F246F1F87, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-15T00:14:13.286 Scheduled scan with Id 15148515-7699-435E-BC81-6F1F246F1F87 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-15T00:14:13.302 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-15T00:14:13.302 [SFC] System file cache build is not needed (already completed) 2026-09-15T00:14:38.567 Engine:Triggered AR EMS scan 2026-09-15T00:14:38.567 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.598 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.614 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.614 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.614 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.645 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.645 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.661 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.677 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.677 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.677 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.677 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.692 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.692 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.692 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.708 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.724 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.739 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.739 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.755 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.755 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.770 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.770 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.770 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.770 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.786 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.802 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.817 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.833 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.833 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.833 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.848 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.848 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.864 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.880 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.880 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.895 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.895 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.911 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.911 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.911 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.927 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.927 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.942 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.942 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.958 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.958 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.973 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.973 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:38.989 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:39.005 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:39.020 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:39.036 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:39.036 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:39.067 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:39.083 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:39.098 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:39.114 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:39.130 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:39.145 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:14:39.145 Engine:EMS scan for process: svchost pid: 8032, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-15T00:15:20.442 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:15:20.442 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:15:20.442 [Cloud] Queued cloud request. 2026-09-15T00:15:20.442 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:15:20.442 [Cloud] Dequeued cloud request. 2026-09-15T00:15:20.442 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:15:20.645 [Cloud] End of cloud request. 2026-09-15T00:15:21.145 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:15:24.770 QuickScan:ScanID:15148515-7699-435E-BC81-6F1F246F1F87: Quick scan finished with error 0 2026-09-15T00:15:25.286 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-15T00:15:25.286 [RTP] Duplicating the current plugin configuration object... 2026-09-15T00:15:25.286 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-15T00:15:25.286 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-15T00:15:25.286 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-15T00:15:25.286 [RTP] No config change detected. Not updating plugin configuration. 2026-09-15T00:15:25.286 [RTP] No config changes found. No configuration switch. 2026-09-15T00:15:25.286 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-15T00:16:18.692 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:16:18.692 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:16:18.692 [Cloud] Queued cloud request. 2026-09-15T00:16:18.692 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:16:18.692 [Cloud] Dequeued cloud request. 2026-09-15T00:16:18.692 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:16:18.802 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{93DF19AC-9072-814C-B465-0DE1D7EB0D35} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 00:16:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T00:16:19.317 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:22:27.785 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T00:23:14.660 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:23:14.660 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:23:14.660 [Cloud] Queued cloud request. 2026-09-15T00:23:14.660 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:23:14.660 [Cloud] Dequeued cloud request. 2026-09-15T00:23:14.660 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:23:14.910 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6E4C7382-613F-4869-8F1E-CAE7A89CF05D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 00:23:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T00:23:15.426 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:37:06.534 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:37:06.534 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:37:06.534 [Cloud] Queued cloud request. 2026-09-15T00:37:06.534 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:37:06.550 [Cloud] Dequeued cloud request. 2026-09-15T00:37:06.550 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:37:06.737 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4AE69095-FD62-B7AD-D548-FA2A4A292A5F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 00:37:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T00:37:07.237 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:37:16.612 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:37:16.612 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:37:16.612 [Cloud] Queued cloud request. 2026-09-15T00:37:16.612 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:37:16.612 [Cloud] Dequeued cloud request. 2026-09-15T00:37:16.612 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:37:16.691 [Cloud] End of cloud request. 2026-09-15T00:37:17.206 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:37:32.784 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T00:38:24.331 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:38:24.331 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:38:24.331 [Cloud] Queued cloud request. 2026-09-15T00:38:24.331 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:38:24.331 [Cloud] Dequeued cloud request. 2026-09-15T00:38:24.331 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:38:24.518 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B94A7B57-53CB-A468-A68A-B3078F56C2EF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 00:38:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T00:38:25.018 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:41:35.190 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:41:35.190 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:41:35.190 [Cloud] Queued cloud request. 2026-09-15T00:41:35.190 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:41:35.190 [Cloud] Dequeued cloud request. 2026-09-15T00:41:35.206 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:41:35.378 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CCAE589A-10FD-CA1E-CA0B-F54DAD111DE4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 00:41:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T00:41:35.878 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:46:25.549 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:46:25.549 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:46:25.549 [Cloud] Queued cloud request. 2026-09-15T00:46:25.549 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:46:25.549 [Cloud] Dequeued cloud request. 2026-09-15T00:46:25.549 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:46:25.737 [Cloud] End of cloud request. 2026-09-15T00:46:26.252 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:49:32.190 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:49:32.190 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:49:32.190 [Cloud] Queued cloud request. 2026-09-15T00:49:32.190 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:49:32.190 [Cloud] Dequeued cloud request. 2026-09-15T00:49:32.190 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:49:42.346 [Cloud] End of cloud request. 2026-09-15T00:49:42.846 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T00:52:37.783 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T00:58:36.470 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T00:58:36.470 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T00:58:36.470 [Cloud] Queued cloud request. 2026-09-15T00:58:36.470 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T00:58:36.470 [Cloud] Dequeued cloud request. 2026-09-15T00:58:36.470 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T00:58:36.673 [Cloud] End of cloud request. 2026-09-15T00:58:37.173 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:00:01.595 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969425, FileId: 0x1e00000003c58c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.595 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969426, FileId: 0x26000000039f20, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.626 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969431, FileId: 0x2000000003c58c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.626 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969432, FileId: 0x28000000039f20, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.642 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969438, FileId: 0x2a000000039f20, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.642 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969437, FileId: 0x2200000003c58c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.658 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969443, FileId: 0x2400000003c58c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.658 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969444, FileId: 0x2c000000039f20, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.673 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969449, FileId: 0x2600000003c58c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.673 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969450, FileId: 0x2e000000039f20, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.689 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969455, FileId: 0x2800000003c58c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.689 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969456, FileId: 0x30000000039f20, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.720 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969465, FileId: 0x32000000039f20, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.736 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969464, FileId: 0x2a00000003c58c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.751 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969471, FileId: 0x34000000039f20, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.751 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969470, FileId: 0x2c00000003c58c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.767 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969476, FileId: 0x2e00000003c58c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.767 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969477, FileId: 0x36000000039f20, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.783 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969483, FileId: 0x38000000039f20, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.783 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969482, FileId: 0x3000000003c58c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.798 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969488, FileId: 0x3200000003c58c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.798 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969489, FileId: 0x3a000000039f20, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.814 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969494, FileId: 0x3c000000039f20, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:00:01.814 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5969495, FileId: 0x3400000003c58c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-15T01:06:42.392 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:06:42.392 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:06:42.392 [Cloud] Queued cloud request. 2026-09-15T01:06:42.392 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:06:42.564 [Cloud] Dequeued cloud request. 2026-09-15T01:06:42.767 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:06:42.939 [Cloud] End of cloud request. 2026-09-15T01:06:43.454 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:07:42.782 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T01:10:51.923 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:10:51.938 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:10:51.938 [Cloud] Queued cloud request. 2026-09-15T01:10:51.938 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:10:51.938 [Cloud] Dequeued cloud request. 2026-09-15T01:10:51.938 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:10:52.079 [Cloud] End of cloud request. 2026-09-15T01:10:52.579 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:12:19.079 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:12:19.079 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:12:19.079 [Cloud] Queued cloud request. 2026-09-15T01:12:19.079 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:12:19.079 [Cloud] Dequeued cloud request. 2026-09-15T01:12:19.079 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:12:19.235 [Cloud] End of cloud request. 2026-09-15T01:12:19.735 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:13:24.204 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:13:24.204 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:13:24.204 [Cloud] Queued cloud request. 2026-09-15T01:13:24.204 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:13:24.204 [Cloud] Dequeued cloud request. 2026-09-15T01:13:24.220 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:13:24.360 [Cloud] End of cloud request. 2026-09-15T01:13:24.876 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:13:42.563 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:13:42.563 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:13:42.563 [Cloud] Queued cloud request. 2026-09-15T01:13:42.563 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:13:42.563 [Cloud] Dequeued cloud request. 2026-09-15T01:13:42.563 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:13:42.642 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{72221483-471A-FC27-9B28-693382CED935} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 01:13:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T01:13:43.142 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:14:03.110 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:14:03.126 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:14:03.126 [Cloud] Queued cloud request. 2026-09-15T01:14:03.126 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:14:03.126 [Cloud] Dequeued cloud request. 2026-09-15T01:14:03.126 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:14:03.204 [Cloud] End of cloud request. 2026-09-15T01:14:03.720 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:16:52.235 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:16:52.235 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:16:52.235 [Cloud] Queued cloud request. 2026-09-15T01:16:52.235 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:16:52.375 [Cloud] Dequeued cloud request. 2026-09-15T01:16:52.375 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:16:52.532 [Cloud] End of cloud request. 2026-09-15T01:16:53.047 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:18:37.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:18:37.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:18:37.297 [Cloud] Queued cloud request. 2026-09-15T01:18:37.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:18:37.297 [Cloud] Dequeued cloud request. 2026-09-15T01:18:37.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:18:37.516 [Cloud] End of cloud request. 2026-09-15T01:18:38.016 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:18:53.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:18:53.672 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:18:53.672 [Cloud] Queued cloud request. 2026-09-15T01:18:53.672 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:18:53.672 [Cloud] Dequeued cloud request. 2026-09-15T01:18:53.672 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:18:53.750 [Cloud] End of cloud request. 2026-09-15T01:18:54.250 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:21:53.063 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:21:53.063 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:21:53.063 [Cloud] Queued cloud request. 2026-09-15T01:21:53.063 [Cloud] Dequeued cloud request. 2026-09-15T01:21:53.063 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:21:53.063 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:21:53.266 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CBE95052-1CEE-7E35-BA0C-C5407E3F72BF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 01:21:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T01:21:53.766 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:22:47.781 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T01:27:50.375 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:27:50.375 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:27:50.375 [Cloud] Queued cloud request. 2026-09-15T01:27:50.375 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:27:50.375 [Cloud] Dequeued cloud request. 2026-09-15T01:27:50.375 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:27:50.562 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DD7B93F6-72DA-538A-7B1F-A7E71C511CC8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 01:27:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T01:27:51.062 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:28:18.218 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:28:18.218 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:28:18.218 [Cloud] Queued cloud request. 2026-09-15T01:28:18.218 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:28:18.218 [Cloud] Dequeued cloud request. 2026-09-15T01:28:18.218 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:28:18.312 [Cloud] End of cloud request. 2026-09-15T01:28:18.812 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:28:42.453 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:28:42.453 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:28:42.453 [Cloud] Queued cloud request. 2026-09-15T01:28:42.453 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:28:42.453 [Cloud] Dequeued cloud request. 2026-09-15T01:28:42.453 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:28:42.578 [Cloud] End of cloud request. 2026-09-15T01:28:43.093 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:28:53.343 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 11707, Count: 765, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\team.php, EstimatedImpact: 0% 2026-09-15T01:28:53.343 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 7132, Count: 297, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-15T01:28:53.343 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 6611, Count: 293, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-15T01:28:53.343 ProcessImageName: powershell.exe, Pid: 3540, TotalTime: 1804, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 39% 2026-09-15T01:28:53.343 ProcessImageName: AgentShellService.exe, Pid: 5036, TotalTime: 792, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-15T01:28:53.343 ProcessImageName: WmiPrvSE.exe, Pid: 6092, TotalTime: 736, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-15T01:28:53.343 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 597, Count: 27, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-15T01:28:53.343 ProcessImageName: WmiPrvSE.exe, Pid: 1948, TotalTime: 286, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-15T01:28:53.343 ProcessImageName: WmiPrvSE.exe, Pid: 7368, TotalTime: 248, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-15T01:28:53.343 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 107, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-15T01:28:53.343 ProcessImageName: taskhostw.exe, Pid: 3436, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-15T01:28:53.343 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-15T01:28:53.343 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2.MAI, EstimatedImpact: 24% 2026-09-15T01:28:53.343 ProcessImageName: powershell.exe, Pid: 6496, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rwprwnp5.upt.psm1, EstimatedImpact: 0% 2026-09-15T01:28:53.343 ProcessImageName: mysqldump.exe, Pid: 5888, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-15T01:28:53.343 ProcessImageName: taskhostw.exe, Pid: 6236, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-15T01:28:53.343 ProcessImageName: ngentask.exe, Pid: 8092, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-15T01:30:02.172 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:30:02.172 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:30:02.172 [Cloud] Queued cloud request. 2026-09-15T01:30:02.172 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:30:02.172 [Cloud] Dequeued cloud request. 2026-09-15T01:30:02.187 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:30:02.562 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{283F33A0-4590-FE0F-D852-9310AD087C80} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 01:30:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T01:30:03.078 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:34:50.140 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:34:50.140 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:34:50.140 [Cloud] Queued cloud request. 2026-09-15T01:34:50.140 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:34:50.140 [Cloud] Dequeued cloud request. 2026-09-15T01:34:50.140 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:34:50.281 [Cloud] End of cloud request. 2026-09-15T01:34:50.797 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:35:57.952 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:35:57.952 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:35:57.952 [Cloud] Queued cloud request. 2026-09-15T01:35:57.952 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:35:57.952 [Cloud] Dequeued cloud request. 2026-09-15T01:35:57.952 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:35:58.093 [Cloud] End of cloud request. 2026-09-15T01:35:58.593 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:36:24.031 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:36:24.031 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:36:24.031 [Cloud] Queued cloud request. 2026-09-15T01:36:24.031 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:36:24.031 [Cloud] Dequeued cloud request. 2026-09-15T01:36:24.031 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:36:24.124 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{20D6099F-D64E-F7D1-AE55-48A610375AD6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 01:36:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T01:36:24.624 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:36:58.390 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:36:58.390 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:36:58.390 [Cloud] Queued cloud request. 2026-09-15T01:36:58.390 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:36:58.390 [Cloud] Dequeued cloud request. 2026-09-15T01:36:58.390 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:36:58.468 [Cloud] End of cloud request. 2026-09-15T01:36:58.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:37:52.780 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T01:38:22.249 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:38:22.249 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:38:22.249 [Cloud] Queued cloud request. 2026-09-15T01:38:22.249 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:38:22.249 [Cloud] Dequeued cloud request. 2026-09-15T01:38:22.249 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:38:22.421 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{73C84CDF-0EB9-47AB-F595-914FDCD2AA83} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 01:38:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T01:38:22.921 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:38:47.608 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:38:47.608 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:38:47.608 [Cloud] Queued cloud request. 2026-09-15T01:38:47.608 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:38:47.608 [Cloud] Dequeued cloud request. 2026-09-15T01:38:47.608 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:38:47.687 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{55C1DEBD-A1FD-5F09-A6CD-E93CF76CA0BB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 01:38:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T01:38:48.202 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:47:46.170 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:47:46.170 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:47:46.170 [Cloud] Queued cloud request. 2026-09-15T01:47:46.170 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:47:46.170 [Cloud] Dequeued cloud request. 2026-09-15T01:47:46.186 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:47:46.373 [Cloud] End of cloud request. 2026-09-15T01:47:46.873 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:48:42.077 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:48:42.077 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:48:42.077 [Cloud] Queued cloud request. 2026-09-15T01:48:42.077 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:48:42.077 [Cloud] Dequeued cloud request. 2026-09-15T01:48:42.077 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:48:42.170 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2239F5D6-FCCA-56CA-CE6E-4F7D3FCB229E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 01:48:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T01:48:42.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:51:33.233 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:51:33.233 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:51:33.233 [Cloud] Queued cloud request. 2026-09-15T01:51:33.233 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:51:33.248 [Cloud] Dequeued cloud request. 2026-09-15T01:51:33.248 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:51:33.467 [Cloud] End of cloud request. 2026-09-15T01:51:33.967 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:52:57.780 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T01:56:22.201 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:56:22.201 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:56:22.201 [Cloud] Queued cloud request. 2026-09-15T01:56:22.201 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:56:22.201 [Cloud] Dequeued cloud request. 2026-09-15T01:56:22.201 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:56:22.389 [Cloud] End of cloud request. 2026-09-15T01:56:22.904 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:56:51.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:56:51.904 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:56:51.904 [Cloud] Queued cloud request. 2026-09-15T01:56:51.904 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:56:51.904 [Cloud] Dequeued cloud request. 2026-09-15T01:56:51.904 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:56:51.998 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E919C159-895F-10E2-8793-EBBF0004D68A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 01:56:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T01:56:52.514 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T01:57:41.326 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T01:57:41.326 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T01:57:41.326 [Cloud] Queued cloud request. 2026-09-15T01:57:41.326 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T01:57:41.326 [Cloud] Dequeued cloud request. 2026-09-15T01:57:41.326 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T01:57:41.420 [Cloud] End of cloud request. 2026-09-15T01:57:41.920 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:02:16.529 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:02:16.529 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:02:16.529 [Cloud] Queued cloud request. 2026-09-15T02:02:16.529 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:02:16.529 [Cloud] Dequeued cloud request. 2026-09-15T02:02:16.544 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:02:16.748 [Cloud] End of cloud request. 2026-09-15T02:02:17.263 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:05:37.278 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:05:37.278 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:05:37.278 [Cloud] Queued cloud request. 2026-09-15T02:05:37.278 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:05:37.278 [Cloud] Dequeued cloud request. 2026-09-15T02:05:37.294 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:05:37.466 [Cloud] End of cloud request. 2026-09-15T02:05:37.982 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:08:02.778 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T02:11:13.325 [AutoPurge] Cleanup Routine tasks have started. 2026-09-15T02:11:13.325 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-15T02:11:13.340 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-15T02:11:13.340 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-15T02:11:13.340 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-15-2026 02:11:13 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-15-2026 02:11:13 2026-09-15T02:11:13.356 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-15T02:11:13.356 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-15T02:11:13.356 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-15T02:11:13.356 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-15T02:11:13.356 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-15T02:11:13.372 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-15T02:11:13.372 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-15T02:11:13.372 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-15T02:11:13.372 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-15T02:11:13.372 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-15T02:11:13.372 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-15T02:11:13.481 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-15T02:11:13.481 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-15T02:11:13.512 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-15T02:11:13.512 [AutoPurge] Removing expired default signature package ... 2026-09-15T02:11:13.762 Job Notification: New process added to job (7068) 2026-09-15T02:11:14.497 Job Notification: Process exited from job (7068) 2026-09-15T02:11:14.559 [AutoPurge] Verification Routine tasks have ended. 2026-09-15T02:16:58.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:16:58.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:16:58.387 [Cloud] Queued cloud request. 2026-09-15T02:16:58.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:16:58.403 [Cloud] Dequeued cloud request. 2026-09-15T02:16:58.403 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:17:08.496 [Cloud] End of cloud request. 2026-09-15T02:17:08.996 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-15T02:17:09.012 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:17:09.012 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-15T02:17:09.012 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-15T02:17:09.012 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-15T02:17:09.012 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-15T02:17:09.012 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-15T02:17:09.012 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-15T02:17:09.012 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-15T02:17:09.012 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-15T02:17:09.012 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-15T02:17:09.028 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-15T02:17:09.028 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-15T02:17:09.028 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-15T02:17:09.028 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-15T02:17:09.028 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-15T02:17:09.028 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-15T02:17:09.028 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-15T02:17:09.028 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-15T02:17:09.028 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-15T02:17:09.028 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-15T02:17:09.028 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-15T02:17:09.028 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:17:09.028 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:17:09.028 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:17:09.028 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:17:11.606 [RTP] Duplicating the current plugin configuration object... 2026-09-15T02:17:11.606 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-15T02:17:11.606 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-15T02:17:11.606 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-15T02:17:11.606 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-15T02:17:11.606 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-15T02:21:53.043 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:21:53.043 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:21:53.043 [Cloud] Queued cloud request. 2026-09-15T02:21:53.043 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:21:53.043 [Cloud] Dequeued cloud request. 2026-09-15T02:21:53.059 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:21:53.199 [Cloud] End of cloud request. 2026-09-15T02:21:53.699 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:23:07.777 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T02:23:54.012 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:23:54.012 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:23:54.012 [Cloud] Queued cloud request. 2026-09-15T02:23:54.012 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:23:54.012 [Cloud] Dequeued cloud request. 2026-09-15T02:23:54.012 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:23:54.215 [Cloud] End of cloud request. 2026-09-15T02:23:54.715 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:25:51.011 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:25:51.011 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:25:51.011 [Cloud] Queued cloud request. 2026-09-15T02:25:51.011 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:25:51.011 [Cloud] Dequeued cloud request. 2026-09-15T02:25:51.011 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:25:51.199 [Cloud] End of cloud request. 2026-09-15T02:25:51.699 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:27:20.511 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:27:20.511 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:27:20.511 [Cloud] Queued cloud request. 2026-09-15T02:27:20.511 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:27:20.511 [Cloud] Dequeued cloud request. 2026-09-15T02:27:20.511 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:27:21.199 [Cloud] End of cloud request. 2026-09-15T02:27:21.714 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:29:17.777 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:29:17.777 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:29:17.777 [Cloud] Queued cloud request. 2026-09-15T02:29:17.777 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:29:17.777 [Cloud] Dequeued cloud request. 2026-09-15T02:29:17.777 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:29:18.011 [Cloud] End of cloud request. 2026-09-15T02:29:18.527 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:30:27.120 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:30:27.120 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:30:27.120 [Cloud] Queued cloud request. 2026-09-15T02:30:27.120 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:30:27.120 [Cloud] Dequeued cloud request. 2026-09-15T02:30:27.120 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:30:27.308 [Cloud] End of cloud request. 2026-09-15T02:30:27.824 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:33:11.167 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:33:11.167 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:33:11.167 [Cloud] Queued cloud request. 2026-09-15T02:33:11.167 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:33:11.167 [Cloud] Dequeued cloud request. 2026-09-15T02:33:11.167 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:33:11.370 [Cloud] End of cloud request. 2026-09-15T02:33:11.870 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:36:16.339 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:36:16.339 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:36:16.339 [Cloud] Queued cloud request. 2026-09-15T02:36:16.339 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:36:16.339 [Cloud] Dequeued cloud request. 2026-09-15T02:36:16.339 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:36:16.511 [Cloud] End of cloud request. 2026-09-15T02:36:17.011 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:38:12.776 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T02:38:13.026 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:38:13.026 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:38:13.026 [Cloud] Queued cloud request. 2026-09-15T02:38:13.026 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:38:13.026 [Cloud] Dequeued cloud request. 2026-09-15T02:38:13.042 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:38:19.229 [Cloud] End of cloud request. 2026-09-15T02:38:19.745 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:44:42.870 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:44:42.870 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:44:42.870 [Cloud] Queued cloud request. 2026-09-15T02:44:42.870 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:44:42.870 [Cloud] Dequeued cloud request. 2026-09-15T02:44:42.870 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:44:43.073 [Cloud] End of cloud request. 2026-09-15T02:44:43.589 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:45:04.620 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:45:04.620 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:45:04.620 [Cloud] Queued cloud request. 2026-09-15T02:45:04.620 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:45:04.620 [Cloud] Dequeued cloud request. 2026-09-15T02:45:04.620 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:45:04.713 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{97BDB5B5-2F8E-85CA-F2C8-55D35136EC77} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 02:45:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T02:45:05.229 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:50:53.916 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:50:53.916 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:50:53.916 [Cloud] Queued cloud request. 2026-09-15T02:50:53.916 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:50:53.932 [Cloud] Dequeued cloud request. 2026-09-15T02:50:53.932 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:50:54.119 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{60B6A05F-1F89-CA66-F662-4E9B1FD563CA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 02:50:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T02:50:54.635 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T02:53:17.775 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T02:59:50.446 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T02:59:50.446 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T02:59:50.446 [Cloud] Queued cloud request. 2026-09-15T02:59:50.446 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T02:59:50.446 [Cloud] Dequeued cloud request. 2026-09-15T02:59:50.446 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T02:59:50.634 [Cloud] End of cloud request. 2026-09-15T02:59:51.134 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:02:13.478 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:02:13.478 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:02:13.478 [Cloud] Queued cloud request. 2026-09-15T03:02:13.478 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:02:13.478 [Cloud] Dequeued cloud request. 2026-09-15T03:02:13.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:02:13.650 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{227127B4-D9DA-2A5B-068D-D6B59EEA860D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 03:02:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T03:02:14.165 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:05:18.150 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:05:18.150 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:05:18.150 [Cloud] Queued cloud request. 2026-09-15T03:05:18.150 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:05:18.150 [Cloud] Dequeued cloud request. 2026-09-15T03:05:18.150 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:05:18.306 [Cloud] End of cloud request. 2026-09-15T03:05:18.806 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:08:22.774 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T03:09:10.743 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:09:10.743 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:09:10.743 [Cloud] Queued cloud request. 2026-09-15T03:09:10.743 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:09:10.743 [Cloud] Dequeued cloud request. 2026-09-15T03:09:10.743 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:09:10.899 [Cloud] End of cloud request. 2026-09-15T03:09:11.399 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:16:16.899 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:16:16.899 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:16:16.899 [Cloud] Queued cloud request. 2026-09-15T03:16:16.899 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:16:16.899 [Cloud] Dequeued cloud request. 2026-09-15T03:16:16.899 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:16:17.071 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A86422D1-1BFE-1196-A1EA-E9170B469BAB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 03:16:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T03:16:17.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:16:32.414 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:16:32.414 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:16:32.414 [Cloud] Queued cloud request. 2026-09-15T03:16:32.414 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:16:32.571 [Cloud] Dequeued cloud request. 2026-09-15T03:16:32.727 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:16:32.820 [Cloud] End of cloud request. 2026-09-15T03:16:33.321 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:17:19.399 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:17:19.399 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:17:19.399 [Cloud] Queued cloud request. 2026-09-15T03:17:19.399 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:17:19.399 [Cloud] Dequeued cloud request. 2026-09-15T03:17:19.399 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:17:19.492 [Cloud] End of cloud request. 2026-09-15T03:17:19.992 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:20:20.430 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:20:20.430 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:20:20.430 [Cloud] Queued cloud request. 2026-09-15T03:20:20.430 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:20:20.539 [Cloud] Dequeued cloud request. 2026-09-15T03:20:20.539 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:20:20.680 [Cloud] End of cloud request. 2026-09-15T03:20:21.180 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:21:42.961 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:21:42.961 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:21:42.961 [Cloud] Queued cloud request. 2026-09-15T03:21:42.961 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:21:42.961 [Cloud] Dequeued cloud request. 2026-09-15T03:21:42.961 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:21:43.117 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0D1430A1-1B0D-B6DB-00A2-5BBEDFB54F0A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 03:21:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T03:21:43.633 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:23:27.773 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T03:23:32.804 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:23:32.804 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:23:32.804 [Cloud] Queued cloud request. 2026-09-15T03:23:32.804 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:23:32.804 [Cloud] Dequeued cloud request. 2026-09-15T03:23:32.804 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:23:32.945 [Cloud] End of cloud request. 2026-09-15T03:23:33.445 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:25:58.898 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:25:58.898 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:25:58.898 [Cloud] Queued cloud request. 2026-09-15T03:25:58.898 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:25:58.898 [Cloud] Dequeued cloud request. 2026-09-15T03:25:58.898 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:25:59.054 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{348D4B90-B0CA-A359-3FDD-60DD8F53AAA6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 03:25:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T03:25:59.554 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:28:00.554 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:28:00.554 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:28:00.554 [Cloud] Queued cloud request. 2026-09-15T03:28:00.554 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:28:00.554 [Cloud] Dequeued cloud request. 2026-09-15T03:28:00.554 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:28:10.710 [Cloud] End of cloud request. 2026-09-15T03:28:11.210 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:28:53.351 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 14444, Count: 867, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\limesurvey\index.php, EstimatedImpact: 0% 2026-09-15T03:28:53.351 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 11107, Count: 476, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-15T03:28:53.351 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 7132, Count: 297, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-15T03:28:53.351 ProcessImageName: powershell.exe, Pid: 3540, TotalTime: 1804, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 39% 2026-09-15T03:28:53.351 ProcessImageName: AgentShellService.exe, Pid: 5036, TotalTime: 792, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-15T03:28:53.351 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 781, Count: 35, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-15T03:28:53.351 ProcessImageName: WmiPrvSE.exe, Pid: 6092, TotalTime: 736, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-15T03:28:53.351 ProcessImageName: WmiPrvSE.exe, Pid: 1948, TotalTime: 286, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-15T03:28:53.351 ProcessImageName: WmiPrvSE.exe, Pid: 7368, TotalTime: 248, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-15T03:28:53.351 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 122, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-15T03:28:53.351 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-15T03:28:53.351 ProcessImageName: taskhostw.exe, Pid: 3172, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 9% 2026-09-15T03:28:53.351 ProcessImageName: taskhostw.exe, Pid: 3436, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-15T03:28:53.351 ProcessImageName: DeviceCensus.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-15T03:28:53.351 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2.MAI, EstimatedImpact: 24% 2026-09-15T03:28:53.351 ProcessImageName: powershell.exe, Pid: 6496, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rwprwnp5.upt.psm1, EstimatedImpact: 0% 2026-09-15T03:28:53.351 ProcessImageName: cmd.exe, Pid: 848, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-15T03:28:53.351 ProcessImageName: mysqldump.exe, Pid: 5888, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-15T03:28:53.351 ProcessImageName: taskhostw.exe, Pid: 6236, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-15T03:28:53.351 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-15T03:28:53.351 ProcessImageName: ngentask.exe, Pid: 8092, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-15T03:28:57.820 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:28:57.820 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:28:57.820 [Cloud] Queued cloud request. 2026-09-15T03:28:57.820 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:28:57.820 [Cloud] Dequeued cloud request. 2026-09-15T03:28:57.820 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:28:57.945 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{529FE49D-D38B-8C91-65AF-C5CD6730BC26} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 03:28:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T03:28:58.445 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:32:01.523 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:32:01.523 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:32:01.523 [Cloud] Queued cloud request. 2026-09-15T03:32:01.523 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:32:01.523 [Cloud] Dequeued cloud request. 2026-09-15T03:32:01.523 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:32:01.710 [Cloud] End of cloud request. 2026-09-15T03:32:02.210 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:32:07.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:32:07.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:32:07.304 [Cloud] Queued cloud request. 2026-09-15T03:32:07.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:32:07.304 [Cloud] Dequeued cloud request. 2026-09-15T03:32:07.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:32:07.398 [Cloud] End of cloud request. 2026-09-15T03:32:07.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:37:23.038 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:37:23.038 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:37:23.038 [Cloud] Queued cloud request. 2026-09-15T03:37:23.038 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:37:23.038 [Cloud] Dequeued cloud request. 2026-09-15T03:37:23.038 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:37:23.226 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AEF4F2E7-1627-0AF1-8695-478295FDF16C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 03:37:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T03:37:23.741 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:38:32.772 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T03:41:08.600 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:41:08.600 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:41:08.600 [Cloud] Queued cloud request. 2026-09-15T03:41:08.600 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:41:08.600 [Cloud] Dequeued cloud request. 2026-09-15T03:41:08.600 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:41:08.788 [Cloud] End of cloud request. 2026-09-15T03:41:09.303 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:42:08.616 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:42:08.616 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:42:08.616 [Cloud] Queued cloud request. 2026-09-15T03:42:08.616 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:42:08.616 [Cloud] Dequeued cloud request. 2026-09-15T03:42:08.631 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:42:08.710 [Cloud] End of cloud request. 2026-09-15T03:42:09.225 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:43:03.616 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:43:03.616 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:43:03.616 [Cloud] Queued cloud request. 2026-09-15T03:43:03.616 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:43:03.866 [Cloud] Dequeued cloud request. 2026-09-15T03:43:03.866 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:43:03.944 [Cloud] End of cloud request. 2026-09-15T03:43:04.460 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:44:12.756 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:44:12.756 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:44:12.756 [Cloud] Queued cloud request. 2026-09-15T03:44:12.756 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:44:12.756 [Cloud] Dequeued cloud request. 2026-09-15T03:44:12.756 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:44:12.960 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{55100FA7-36BE-E415-AB6D-D32044293D1A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 03:44:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T03:44:13.460 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:46:02.147 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:46:02.147 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:46:02.147 [Cloud] Queued cloud request. 2026-09-15T03:46:02.147 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:46:02.147 [Cloud] Dequeued cloud request. 2026-09-15T03:46:02.147 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:46:02.944 [Cloud] End of cloud request. 2026-09-15T03:46:03.459 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:50:09.256 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:50:09.256 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:50:09.256 [Cloud] Queued cloud request. 2026-09-15T03:50:09.256 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:50:09.256 [Cloud] Dequeued cloud request. 2026-09-15T03:50:09.256 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:50:09.443 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{702F603E-F54F-17D8-0658-FA70EB98431E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 03:50:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T03:50:09.943 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T03:53:37.771 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T03:57:59.943 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T03:57:59.943 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T03:57:59.943 [Cloud] Queued cloud request. 2026-09-15T03:57:59.943 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T03:57:59.943 [Cloud] Dequeued cloud request. 2026-09-15T03:57:59.943 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T03:58:00.162 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0BC6D00E-ED20-97F1-6B8E-DBCE9FB1D702} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 03:58:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T03:58:00.677 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:04:03.349 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:04:03.349 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:04:03.349 [Cloud] Queued cloud request. 2026-09-15T04:04:03.349 [Cloud] Dequeued cloud request. 2026-09-15T04:04:03.349 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:04:03.349 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:04:03.521 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BBACCCB2-A6BD-31EA-B239-877A39A65DCE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 04:04:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T04:04:04.036 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:08:42.770 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T04:10:58.254 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:10:58.254 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:10:58.254 [Cloud] Queued cloud request. 2026-09-15T04:10:58.254 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:10:58.254 [Cloud] Dequeued cloud request. 2026-09-15T04:10:58.254 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:10:58.457 [Cloud] End of cloud request. 2026-09-15T04:10:58.957 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:19:01.238 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:19:01.238 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:19:01.238 [Cloud] Queued cloud request. 2026-09-15T04:19:01.238 [Cloud] Dequeued cloud request. 2026-09-15T04:19:01.238 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:19:01.238 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:19:01.472 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AD2D5596-B2FE-F2C0-2D96-EC18A26863F5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 04:19:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T04:19:01.972 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:20:07.519 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:20:07.519 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:20:07.519 [Cloud] Queued cloud request. 2026-09-15T04:20:07.519 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:20:07.519 [Cloud] Dequeued cloud request. 2026-09-15T04:20:07.519 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:20:07.707 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2A1391D8-7EE8-E9D3-2B21-BAE5E21DF9D0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 04:20:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T04:20:08.207 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:22:36.504 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:22:36.504 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:22:36.504 [Cloud] Queued cloud request. 2026-09-15T04:22:36.504 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:22:36.504 [Cloud] Dequeued cloud request. 2026-09-15T04:22:36.504 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:22:36.707 [Cloud] End of cloud request. 2026-09-15T04:22:37.207 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:22:47.738 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:22:47.738 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:22:47.738 [Cloud] Queued cloud request. 2026-09-15T04:22:47.738 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:22:47.738 [Cloud] Dequeued cloud request. 2026-09-15T04:22:47.738 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:22:47.816 [Cloud] End of cloud request. 2026-09-15T04:22:48.316 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:23:47.769 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T04:25:05.488 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:25:05.488 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:25:05.488 [Cloud] Queued cloud request. 2026-09-15T04:25:05.488 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:25:05.488 [Cloud] Dequeued cloud request. 2026-09-15T04:25:05.488 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{CB85556E-83D9-471A-5109-13C84BEC9CAD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 04:25:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T04:25:07.019 [Cloud] End of cloud request. 2026-09-15T04:25:07.519 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:32:45.472 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:32:45.472 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:32:45.472 [Cloud] Queued cloud request. 2026-09-15T04:32:45.472 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:32:45.472 [Cloud] Dequeued cloud request. 2026-09-15T04:32:45.472 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:32:45.675 [Cloud] End of cloud request. 2026-09-15T04:32:46.190 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:33:41.503 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:33:41.503 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:33:41.503 [Cloud] Queued cloud request. 2026-09-15T04:33:41.503 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:33:41.519 [Cloud] Dequeued cloud request. 2026-09-15T04:33:41.519 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:33:41.597 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{55D955B6-D44F-C86E-9B68-AF839614B16A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 04:33:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T04:33:42.097 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:33:49.128 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:33:49.128 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:33:49.128 [Cloud] Queued cloud request. 2026-09-15T04:33:49.128 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:33:49.128 [Cloud] Dequeued cloud request. 2026-09-15T04:33:49.128 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:33:49.206 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DA2DE07A-FABD-77DB-A0C3-C0B377FA2F6D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 04:33:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T04:33:49.706 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:34:49.831 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:34:49.831 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:34:49.831 [Cloud] Queued cloud request. 2026-09-15T04:34:49.831 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:34:49.831 [Cloud] Dequeued cloud request. 2026-09-15T04:34:49.847 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:34:59.987 [Cloud] End of cloud request. 2026-09-15T04:35:00.503 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:35:30.550 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:35:30.550 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:35:30.550 [Cloud] Queued cloud request. 2026-09-15T04:35:30.550 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:35:30.550 [Cloud] Dequeued cloud request. 2026-09-15T04:35:30.565 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:35:30.644 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EF53A5B3-ADD2-D666-E5D3-049284B29D51} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 04:35:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T04:35:31.159 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:35:47.284 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:35:47.284 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:35:47.284 [Cloud] Queued cloud request. 2026-09-15T04:35:47.284 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:35:47.284 [Cloud] Dequeued cloud request. 2026-09-15T04:35:47.284 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:35:47.378 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E66970D1-EFAC-F4B5-0DAE-688A277AA5E5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 04:35:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T04:35:47.894 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:38:52.768 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T04:39:48.456 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:39:48.456 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:39:48.456 [Cloud] Queued cloud request. 2026-09-15T04:39:48.456 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:39:48.456 [Cloud] Dequeued cloud request. 2026-09-15T04:39:48.471 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:39:48.659 [Cloud] End of cloud request. 2026-09-15T04:39:49.159 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:39:58.659 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:39:58.659 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:39:58.659 [Cloud] Queued cloud request. 2026-09-15T04:39:58.659 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:39:58.659 [Cloud] Dequeued cloud request. 2026-09-15T04:39:58.659 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:39:58.737 [Cloud] End of cloud request. 2026-09-15T04:39:59.237 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:41:54.237 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:41:54.237 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:41:54.237 [Cloud] Queued cloud request. 2026-09-15T04:41:54.237 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:41:54.237 [Cloud] Dequeued cloud request. 2026-09-15T04:41:54.237 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:41:54.424 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F438ABA-949F-BF31-B29A-0E9805ACFDAE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 04:41:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T04:41:54.924 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:48:25.064 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:48:25.064 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:48:25.064 [Cloud] Queued cloud request. 2026-09-15T04:48:25.064 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:48:25.064 [Cloud] Dequeued cloud request. 2026-09-15T04:48:25.064 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:48:35.189 [Cloud] End of cloud request. 2026-09-15T04:48:35.689 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:50:40.767 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:50:40.767 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:50:40.767 [Cloud] Queued cloud request. 2026-09-15T04:50:40.767 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:50:40.924 [Cloud] Dequeued cloud request. 2026-09-15T04:50:40.924 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:50:41.095 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{91A5575C-C603-6166-C06A-188AE2EEE691} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 04:50:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T04:50:41.611 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:53:57.767 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T04:59:09.970 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:59:09.970 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:59:09.970 [Cloud] Queued cloud request. 2026-09-15T04:59:09.970 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:59:09.970 [Cloud] Dequeued cloud request. 2026-09-15T04:59:09.970 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:59:10.126 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FE403EFC-1E46-C344-E99F-581105049DA5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 04:59:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T04:59:10.642 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T04:59:54.579 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T04:59:54.579 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T04:59:54.579 [Cloud] Queued cloud request. 2026-09-15T04:59:54.579 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T04:59:54.579 [Cloud] Dequeued cloud request. 2026-09-15T04:59:54.579 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T04:59:54.673 [Cloud] End of cloud request. 2026-09-15T04:59:55.173 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T05:09:02.766 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T05:16:09.328 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T05:16:09.328 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T05:16:09.328 [Cloud] Queued cloud request. 2026-09-15T05:16:09.328 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T05:16:09.328 [Cloud] Dequeued cloud request. 2026-09-15T05:16:09.328 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T05:16:09.500 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{824B5245-A492-3CE9-B49C-1483679D9051} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 05:16:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T05:16:10.000 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T05:22:26.484 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T05:22:26.484 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T05:22:26.484 [Cloud] Queued cloud request. 2026-09-15T05:22:26.484 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T05:22:26.484 [Cloud] Dequeued cloud request. 2026-09-15T05:22:26.484 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T05:22:26.640 [Cloud] End of cloud request. 2026-09-15T05:22:27.156 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T05:24:07.765 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T05:28:53.358 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 17854, Count: 1088, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\limesurvey\index.php, EstimatedImpact: 0% 2026-09-15T05:28:53.358 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 15268, Count: 654, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-15T05:28:53.358 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 7132, Count: 297, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-15T05:28:53.358 ProcessImageName: powershell.exe, Pid: 3540, TotalTime: 1804, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 39% 2026-09-15T05:28:53.358 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 827, Count: 37, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-15T05:28:53.358 ProcessImageName: AgentShellService.exe, Pid: 5036, TotalTime: 792, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-15T05:28:53.358 ProcessImageName: WmiPrvSE.exe, Pid: 6092, TotalTime: 736, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-15T05:28:53.358 ProcessImageName: WmiPrvSE.exe, Pid: 1948, TotalTime: 286, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-15T05:28:53.358 ProcessImageName: WmiPrvSE.exe, Pid: 7368, TotalTime: 248, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-15T05:28:53.358 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 122, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-15T05:28:53.358 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-15T05:28:53.358 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-15T05:28:53.358 ProcessImageName: taskhostw.exe, Pid: 3172, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 9% 2026-09-15T05:28:53.358 ProcessImageName: taskhostw.exe, Pid: 3436, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-15T05:28:53.358 ProcessImageName: DeviceCensus.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-15T05:28:53.358 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2.MAI, EstimatedImpact: 24% 2026-09-15T05:28:53.358 ProcessImageName: powershell.exe, Pid: 6496, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rwprwnp5.upt.psm1, EstimatedImpact: 0% 2026-09-15T05:28:53.358 ProcessImageName: cmd.exe, Pid: 848, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-15T05:28:53.358 ProcessImageName: mysqldump.exe, Pid: 5888, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-15T05:28:53.358 ProcessImageName: taskhostw.exe, Pid: 6236, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-15T05:28:53.358 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-15T05:28:53.358 ProcessImageName: ngentask.exe, Pid: 8092, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-15T05:30:13.577 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T05:30:13.577 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T05:30:13.577 [Cloud] Queued cloud request. 2026-09-15T05:30:13.577 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T05:30:13.577 [Cloud] Dequeued cloud request. 2026-09-15T05:30:13.577 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T05:30:23.749 [Cloud] End of cloud request. 2026-09-15T05:30:24.249 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T05:31:41.171 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T05:31:41.171 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T05:31:41.171 [Cloud] Queued cloud request. 2026-09-15T05:31:41.171 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T05:31:41.171 [Cloud] Dequeued cloud request. 2026-09-15T05:31:41.171 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T05:31:41.390 [Cloud] End of cloud request. 2026-09-15T05:31:41.905 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T05:39:12.764 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T05:47:51.216 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T05:47:51.216 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T05:47:51.216 [Cloud] Queued cloud request. 2026-09-15T05:47:51.216 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T05:47:51.216 [Cloud] Dequeued cloud request. 2026-09-15T05:47:51.216 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T05:47:51.419 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4FF4B691-209A-4D30-E86A-0EB1154ADA99} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 05:47:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T05:47:51.935 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T05:54:17.763 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T05:55:04.356 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T05:55:04.356 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T05:55:04.356 [Cloud] Queued cloud request. 2026-09-15T05:55:04.356 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T05:55:04.356 [Cloud] Dequeued cloud request. 2026-09-15T05:55:04.372 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T05:55:04.560 [Cloud] End of cloud request. 2026-09-15T05:55:05.075 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T05:57:45.247 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T05:57:45.247 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T05:57:45.247 [Cloud] Queued cloud request. 2026-09-15T05:57:45.247 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T05:57:45.247 [Cloud] Dequeued cloud request. 2026-09-15T05:57:45.247 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T05:57:45.466 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{05AD926A-2828-74C0-382C-99E0A86C57D9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 05:57:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T05:57:45.966 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:03:07.075 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:03:07.075 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:03:07.075 [Cloud] Queued cloud request. 2026-09-15T06:03:07.075 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:03:07.075 [Cloud] Dequeued cloud request. 2026-09-15T06:03:07.075 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:03:07.231 [Cloud] End of cloud request. 2026-09-15T06:03:07.731 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:06:24.028 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:06:24.028 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:06:24.028 [Cloud] Queued cloud request. 2026-09-15T06:06:24.028 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:06:24.043 [Cloud] Dequeued cloud request. 2026-09-15T06:06:24.043 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:06:24.200 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6CAE4C47-1D0C-55A2-8E2D-3594E5CC5398} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 06:06:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T06:06:24.715 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:09:22.762 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T06:14:11.074 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:14:11.074 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:14:11.074 [Cloud] Queued cloud request. 2026-09-15T06:14:11.074 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:14:11.074 [Cloud] Dequeued cloud request. 2026-09-15T06:14:11.090 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:14:11.277 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4E5BA662-D635-35B1-9172-524AA28436BB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 06:14:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T06:14:11.777 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:17:28.199 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:17:28.199 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:17:28.215 [Cloud] Queued cloud request. 2026-09-15T06:17:28.215 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:17:28.215 [Cloud] Dequeued cloud request. 2026-09-15T06:17:28.215 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:17:28.402 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{508E4A49-C043-DB32-7AE2-F55FEE2D019C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 06:17:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T06:17:28.902 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:24:27.761 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T06:28:05.307 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:28:05.307 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:28:05.307 [Cloud] Queued cloud request. 2026-09-15T06:28:05.307 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:28:05.479 [Cloud] Dequeued cloud request. 2026-09-15T06:28:05.479 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:28:05.636 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CC85D039-1477-C340-7B94-710B20533C11} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 06:28:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T06:28:06.151 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:29:54.229 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:29:54.229 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:29:54.229 [Cloud] Queued cloud request. 2026-09-15T06:29:54.229 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:29:54.229 [Cloud] Dequeued cloud request. 2026-09-15T06:29:54.229 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:29:54.386 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6051DDCD-8398-F280-9699-6A869B21F018} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 06:29:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T06:29:54.886 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:33:03.573 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:33:03.573 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:33:03.573 [Cloud] Queued cloud request. 2026-09-15T06:33:03.573 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:33:03.729 [Cloud] Dequeued cloud request. 2026-09-15T06:33:03.729 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:33:03.886 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DDFB3D4E-02D2-BFE8-5E8A-AED9E08F7522} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 06:33:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T06:33:04.386 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:36:10.307 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:36:10.323 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:36:10.323 [Cloud] Queued cloud request. 2026-09-15T06:36:10.323 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:36:10.323 [Cloud] Dequeued cloud request. 2026-09-15T06:36:10.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:36:20.698 [Cloud] End of cloud request. 2026-09-15T06:36:21.213 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:37:49.854 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:37:49.854 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:37:49.854 [Cloud] Queued cloud request. 2026-09-15T06:37:49.854 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:37:49.854 [Cloud] Dequeued cloud request. 2026-09-15T06:37:49.854 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:37:50.010 [Cloud] End of cloud request. 2026-09-15T06:37:50.510 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:39:32.760 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T06:40:31.713 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:40:31.713 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:40:31.713 [Cloud] Queued cloud request. 2026-09-15T06:40:31.713 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:40:31.713 [Cloud] Dequeued cloud request. 2026-09-15T06:40:31.713 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:40:31.916 [Cloud] End of cloud request. 2026-09-15T06:40:32.416 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:41:56.463 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:41:56.463 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:41:56.463 [Cloud] Queued cloud request. 2026-09-15T06:41:56.463 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:41:56.619 [Cloud] Dequeued cloud request. 2026-09-15T06:41:56.619 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:41:56.791 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1C6D9A1C-7ECD-3250-5B88-BFF21EB4E320} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 06:41:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T06:41:57.291 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:49:40.712 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:49:40.712 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:49:40.712 [Cloud] Queued cloud request. 2026-09-15T06:49:40.712 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:49:40.712 [Cloud] Dequeued cloud request. 2026-09-15T06:49:40.712 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:49:41.494 [Cloud] End of cloud request. 2026-09-15T06:49:41.994 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:51:49.634 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:51:49.634 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:51:49.634 [Cloud] Queued cloud request. 2026-09-15T06:51:49.634 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:51:49.665 [Cloud] Dequeued cloud request. 2026-09-15T06:51:49.665 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:51:49.822 [Cloud] End of cloud request. 2026-09-15T06:51:50.337 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:52:44.228 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:52:44.228 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:52:44.228 [Cloud] Queued cloud request. 2026-09-15T06:52:44.228 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:52:44.228 [Cloud] Dequeued cloud request. 2026-09-15T06:52:44.228 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:52:44.306 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{476E9B33-149F-1147-7208-8C01EA26431D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 06:52:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T06:52:44.806 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T06:54:37.759 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T06:58:05.259 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T06:58:05.259 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T06:58:05.259 [Cloud] Queued cloud request. 2026-09-15T06:58:05.259 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T06:58:05.259 [Cloud] Dequeued cloud request. 2026-09-15T06:58:05.259 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T06:58:05.415 [Cloud] End of cloud request. 2026-09-15T06:58:05.915 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:04:36.665 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:04:36.665 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:04:36.665 [Cloud] Queued cloud request. 2026-09-15T07:04:36.665 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:04:36.868 [Cloud] Dequeued cloud request. 2026-09-15T07:04:36.868 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:04:37.055 [Cloud] End of cloud request. 2026-09-15T07:04:37.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:05:30.992 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:05:30.992 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:05:30.992 [Cloud] Queued cloud request. 2026-09-15T07:05:30.992 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:05:30.992 [Cloud] Dequeued cloud request. 2026-09-15T07:05:30.992 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:05:31.086 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{900E548F-981A-490D-C13B-D3E8CBE0F5F4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 07:05:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T07:05:31.602 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:09:42.758 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T07:14:42.289 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:14:42.289 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:14:42.289 [Cloud] Queued cloud request. 2026-09-15T07:14:42.289 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:14:42.289 [Cloud] Dequeued cloud request. 2026-09-15T07:14:42.289 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:14:42.477 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8E1C3D27-1ADB-320C-956D-25083F9FDF68} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 07:14:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T07:14:42.977 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:23:36.820 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:23:36.820 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:23:36.820 [Cloud] Queued cloud request. 2026-09-15T07:23:36.820 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:23:36.820 [Cloud] Dequeued cloud request. 2026-09-15T07:23:36.820 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:23:37.101 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1A80152A-B511-F211-0477-FE1C4413BF25} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 07:23:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T07:23:37.601 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:24:26.866 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:24:26.866 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:24:26.866 [Cloud] Queued cloud request. 2026-09-15T07:24:26.866 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:24:26.866 [Cloud] Dequeued cloud request. 2026-09-15T07:24:26.866 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:24:26.960 [Cloud] End of cloud request. 2026-09-15T07:24:27.460 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:24:47.757 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T07:25:42.773 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:25:42.773 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:25:42.773 [Cloud] Queued cloud request. 2026-09-15T07:25:42.773 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:25:42.773 [Cloud] Dequeued cloud request. 2026-09-15T07:25:42.773 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:25:42.960 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{456E2DC5-560B-C9BA-5E0D-A0EC8B02A25B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 07:25:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T07:25:43.476 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:27:25.179 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:27:25.179 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:27:25.179 [Cloud] Queued cloud request. 2026-09-15T07:27:25.179 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:27:25.179 [Cloud] Dequeued cloud request. 2026-09-15T07:27:25.179 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:27:25.382 [Cloud] End of cloud request. 2026-09-15T07:27:25.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:28:53.366 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 23163, Count: 1461, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\limesurvey\index.php, EstimatedImpact: 0% 2026-09-15T07:28:53.366 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 19263, Count: 837, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-15T07:28:53.366 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 7132, Count: 297, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-15T07:28:53.366 ProcessImageName: powershell.exe, Pid: 3540, TotalTime: 1804, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 39% 2026-09-15T07:28:53.366 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 889, Count: 39, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-15T07:28:53.366 ProcessImageName: AgentShellService.exe, Pid: 5036, TotalTime: 792, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-15T07:28:53.366 ProcessImageName: WmiPrvSE.exe, Pid: 6092, TotalTime: 736, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-15T07:28:53.366 ProcessImageName: powershell.exe, Pid: 1960, TotalTime: 308, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 59% 2026-09-15T07:28:53.366 ProcessImageName: WmiPrvSE.exe, Pid: 1948, TotalTime: 286, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-15T07:28:53.366 ProcessImageName: WmiPrvSE.exe, Pid: 7368, TotalTime: 248, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-15T07:28:53.366 ProcessImageName: python.exe, Pid: 8152, TotalTime: 212, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 7% 2026-09-15T07:28:53.366 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 139, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-15T07:28:53.366 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 122, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-15T07:28:53.366 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-15T07:28:53.366 ProcessImageName: taskhostw.exe, Pid: 3436, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-15T07:28:53.366 ProcessImageName: taskhostw.exe, Pid: 3172, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 9% 2026-09-15T07:28:53.366 ProcessImageName: DeviceCensus.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-15T07:28:53.366 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2.MAI, EstimatedImpact: 24% 2026-09-15T07:28:53.366 ProcessImageName: powershell.exe, Pid: 6496, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rwprwnp5.upt.psm1, EstimatedImpact: 0% 2026-09-15T07:28:53.366 ProcessImageName: cmd.exe, Pid: 848, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-15T07:28:53.366 ProcessImageName: mysqldump.exe, Pid: 5888, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-15T07:28:53.366 ProcessImageName: taskhostw.exe, Pid: 6236, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-15T07:28:53.366 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-15T07:28:53.366 ProcessImageName: ngentask.exe, Pid: 8092, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-15T07:32:08.335 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:32:08.335 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:32:08.335 [Cloud] Queued cloud request. 2026-09-15T07:32:08.335 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:32:08.335 [Cloud] Dequeued cloud request. 2026-09-15T07:32:08.335 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:32:09.022 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F6D2D440-6B33-E047-6B84-70E4D6F71284} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 07:32:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T07:32:09.538 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:38:15.553 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:38:15.553 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:38:15.553 [Cloud] Queued cloud request. 2026-09-15T07:38:15.553 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:38:15.553 [Cloud] Dequeued cloud request. 2026-09-15T07:38:15.569 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:38:15.850 [Cloud] End of cloud request. 2026-09-15T07:38:16.365 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:39:52.756 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T07:41:41.303 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:41:41.303 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:41:41.303 [Cloud] Queued cloud request. 2026-09-15T07:41:41.303 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:41:41.303 [Cloud] Dequeued cloud request. 2026-09-15T07:41:41.303 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:41:41.490 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{389CD15D-2DE2-3718-B08D-556BAAC8D876} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 07:41:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T07:41:41.990 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:42:49.006 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:42:49.006 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:42:49.006 [Cloud] Queued cloud request. 2026-09-15T07:42:49.006 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:42:49.006 [Cloud] Dequeued cloud request. 2026-09-15T07:42:49.006 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:42:49.397 [Cloud] End of cloud request. 2026-09-15T07:42:49.897 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:48:00.927 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:48:00.927 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:48:00.927 [Cloud] Queued cloud request. 2026-09-15T07:48:00.927 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:48:00.927 [Cloud] Dequeued cloud request. 2026-09-15T07:48:00.927 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:48:01.146 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4D1A5288-C970-2A58-6FDE-37B42228BA31} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 07:48:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T07:48:01.646 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:51:16.771 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:51:16.771 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:51:16.771 [Cloud] Queued cloud request. 2026-09-15T07:51:16.771 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:51:16.771 [Cloud] Dequeued cloud request. 2026-09-15T07:51:16.771 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:51:16.943 [Cloud] End of cloud request. 2026-09-15T07:51:17.459 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T07:54:57.755 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T07:56:52.021 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T07:56:52.021 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T07:56:52.021 [Cloud] Queued cloud request. 2026-09-15T07:56:52.021 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T07:56:52.021 [Cloud] Dequeued cloud request. 2026-09-15T07:56:52.021 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T07:56:52.177 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{365A8AEB-2683-EA05-45F8-8A06C7053AFB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 07:56:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T07:56:52.677 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:02:02.786 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:02:02.786 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:02:02.786 [Cloud] Queued cloud request. 2026-09-15T08:02:02.786 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:02:02.786 [Cloud] Dequeued cloud request. 2026-09-15T08:02:02.786 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:02:03.177 [Cloud] End of cloud request. 2026-09-15T08:02:03.692 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:02:30.896 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:02:30.896 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:02:30.896 [Cloud] Queued cloud request. 2026-09-15T08:02:30.896 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:02:30.896 [Cloud] Dequeued cloud request. 2026-09-15T08:02:30.896 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:02:30.974 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A61077EB-BDB6-F7AA-9158-D2627AAE195F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 08:02:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T08:02:31.474 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:05:39.286 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:05:39.286 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:05:39.286 [Cloud] Queued cloud request. 2026-09-15T08:05:39.286 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:05:39.286 [Cloud] Dequeued cloud request. 2026-09-15T08:05:39.286 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:05:39.442 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7A554FFF-59CF-92B9-460E-D7EC8345498D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 08:05:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T08:05:39.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:08:02.583 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:08:02.583 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:08:02.583 [Cloud] Queued cloud request. 2026-09-15T08:08:02.583 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:08:02.583 [Cloud] Dequeued cloud request. 2026-09-15T08:08:02.583 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:08:02.739 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1345EA68-EAC7-0CB3-A531-6827E7F70DC9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 08:08:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T08:08:03.255 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:10:02.755 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T08:13:15.161 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:13:15.161 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:13:15.161 [Cloud] Queued cloud request. 2026-09-15T08:13:15.161 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:13:15.161 [Cloud] Dequeued cloud request. 2026-09-15T08:13:15.176 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:13:15.333 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ADF3C257-0BA1-A2DC-2B4B-A40396781B47} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 08:13:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T08:13:15.833 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:14:29.926 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:14:29.926 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:14:29.926 [Cloud] Queued cloud request. 2026-09-15T08:14:29.926 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:14:29.926 [Cloud] Dequeued cloud request. 2026-09-15T08:14:29.926 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:14:30.067 [Cloud] End of cloud request. 2026-09-15T08:14:30.083 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:14:30.083 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:14:30.083 [Cloud] Queued cloud request. 2026-09-15T08:14:30.083 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:14:30.083 [Cloud] Dequeued cloud request. 2026-09-15T08:14:30.083 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:14:30.161 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FA1F21AE-6704-79B1-6D7B-33DD8C134B03} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 08:14:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T08:14:30.583 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:17:38.457 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:17:38.457 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:17:38.457 [Cloud] Queued cloud request. 2026-09-15T08:17:38.457 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:17:38.457 [Cloud] Dequeued cloud request. 2026-09-15T08:17:38.457 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:17:38.598 [Cloud] End of cloud request. 2026-09-15T08:17:39.098 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:20:51.238 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:20:51.238 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:20:51.238 [Cloud] Queued cloud request. 2026-09-15T08:20:51.238 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:20:51.238 [Cloud] Dequeued cloud request. 2026-09-15T08:20:51.238 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:20:51.395 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3681280A-F828-20FD-057C-66669219526E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 08:20:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T08:20:51.895 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:21:48.410 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:21:48.410 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:21:48.410 [Cloud] Queued cloud request. 2026-09-15T08:21:48.410 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:21:48.410 [Cloud] Dequeued cloud request. 2026-09-15T08:21:48.410 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:21:48.504 [Cloud] End of cloud request. 2026-09-15T08:21:49.004 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:25:07.754 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T08:27:35.535 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:27:35.535 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:27:35.535 [Cloud] Queued cloud request. 2026-09-15T08:27:35.535 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:27:35.535 [Cloud] Dequeued cloud request. 2026-09-15T08:27:35.535 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:27:35.691 [Cloud] End of cloud request. 2026-09-15T08:27:36.207 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:32:39.660 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:32:39.660 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:32:39.660 [Cloud] Queued cloud request. 2026-09-15T08:32:39.660 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:32:39.660 [Cloud] Dequeued cloud request. 2026-09-15T08:32:39.926 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:32:40.066 [Cloud] End of cloud request. 2026-09-15T08:32:40.566 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:32:58.785 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:32:58.785 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:32:58.785 [Cloud] Queued cloud request. 2026-09-15T08:32:58.785 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:32:58.785 [Cloud] Dequeued cloud request. 2026-09-15T08:32:58.785 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:32:58.879 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7FAFEEF1-7DCA-D009-C174-F30A7D6A16B1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 08:32:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T08:32:59.379 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:34:22.348 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:34:22.348 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:34:22.348 [Cloud] Queued cloud request. 2026-09-15T08:34:22.348 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:34:22.348 [Cloud] Dequeued cloud request. 2026-09-15T08:34:22.348 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:34:22.582 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CDEE9D4D-6705-B377-EF8F-EDEDB904671D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 08:34:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T08:34:23.082 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:36:17.457 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:36:17.457 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:36:17.457 [Cloud] Queued cloud request. 2026-09-15T08:36:17.457 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:36:17.457 [Cloud] Dequeued cloud request. 2026-09-15T08:36:17.457 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:36:17.613 [Cloud] End of cloud request. 2026-09-15T08:36:18.129 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:38:29.035 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:38:29.035 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:38:29.035 [Cloud] Queued cloud request. 2026-09-15T08:38:29.035 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:38:29.035 [Cloud] Dequeued cloud request. 2026-09-15T08:38:29.035 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:38:29.191 [Cloud] End of cloud request. 2026-09-15T08:38:29.691 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:39:59.488 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:39:59.488 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:39:59.488 [Cloud] Queued cloud request. 2026-09-15T08:39:59.488 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:39:59.488 [Cloud] Dequeued cloud request. 2026-09-15T08:39:59.488 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:39:59.628 [Cloud] End of cloud request. 2026-09-15T08:40:00.128 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:40:12.753 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T08:42:01.706 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:42:01.706 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:42:01.706 [Cloud] Queued cloud request. 2026-09-15T08:42:01.706 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:42:01.706 [Cloud] Dequeued cloud request. 2026-09-15T08:42:01.706 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:42:01.863 [Cloud] End of cloud request. 2026-09-15T08:42:02.363 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:42:19.988 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:42:19.988 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:42:19.988 [Cloud] Queued cloud request. 2026-09-15T08:42:19.988 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:42:19.988 [Cloud] Dequeued cloud request. 2026-09-15T08:42:19.988 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:42:20.066 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{83683E84-A059-8C13-FCA4-60CDC6DDE941} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 08:42:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T08:42:20.566 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:44:25.613 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:44:25.613 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:44:25.613 [Cloud] Queued cloud request. 2026-09-15T08:44:25.613 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:44:25.613 [Cloud] Dequeued cloud request. 2026-09-15T08:44:25.613 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:44:25.769 [Cloud] End of cloud request. 2026-09-15T08:44:26.284 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:48:07.128 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:48:07.128 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:48:07.128 [Cloud] Queued cloud request. 2026-09-15T08:48:07.128 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:48:07.128 [Cloud] Dequeued cloud request. 2026-09-15T08:48:07.128 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:48:07.284 [Cloud] End of cloud request. 2026-09-15T08:48:07.800 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:48:56.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:48:56.925 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:48:56.925 [Cloud] Queued cloud request. 2026-09-15T08:48:56.925 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:48:56.925 [Cloud] Dequeued cloud request. 2026-09-15T08:48:56.925 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:48:57.034 [Cloud] End of cloud request. 2026-09-15T08:48:57.550 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:49:54.581 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:49:54.581 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:49:54.581 [Cloud] Queued cloud request. 2026-09-15T08:49:54.581 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:49:54.581 [Cloud] Dequeued cloud request. 2026-09-15T08:49:54.581 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:49:54.659 [Cloud] End of cloud request. 2026-09-15T08:49:55.175 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:51:35.112 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T08:51:35.112 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T08:51:35.112 [Cloud] Queued cloud request. 2026-09-15T08:51:35.112 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T08:51:35.112 [Cloud] Dequeued cloud request. 2026-09-15T08:51:35.112 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T08:51:35.284 [Cloud] End of cloud request. 2026-09-15T08:51:35.800 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T08:55:17.753 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T09:10:22.752 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T09:22:11.252 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:22:11.252 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:22:11.252 [Cloud] Queued cloud request. 2026-09-15T09:22:11.252 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:22:11.252 [Cloud] Dequeued cloud request. 2026-09-15T09:22:11.268 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:22:11.799 [Cloud] End of cloud request. 2026-09-15T09:22:12.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:24:08.830 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:24:08.830 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:24:08.830 [Cloud] Queued cloud request. 2026-09-15T09:24:08.830 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:24:08.830 [Cloud] Dequeued cloud request. 2026-09-15T09:24:08.830 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:24:09.065 [Cloud] End of cloud request. 2026-09-15T09:24:09.565 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:25:27.752 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T09:25:31.705 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:25:31.705 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:25:31.705 [Cloud] Queued cloud request. 2026-09-15T09:25:31.705 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:25:31.705 [Cloud] Dequeued cloud request. 2026-09-15T09:25:31.705 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:25:40.502 [Cloud] End of cloud request. 2026-09-15T09:25:41.018 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:26:51.471 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:26:51.471 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:26:51.471 [Cloud] Queued cloud request. 2026-09-15T09:26:51.471 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:26:51.471 [Cloud] Dequeued cloud request. 2026-09-15T09:26:51.486 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:26:51.752 [Cloud] End of cloud request. 2026-09-15T09:26:52.268 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:27:37.189 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:27:37.189 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:27:37.189 [Cloud] Queued cloud request. 2026-09-15T09:27:37.189 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:27:37.189 [Cloud] Dequeued cloud request. 2026-09-15T09:27:37.189 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:27:42.018 [Cloud] End of cloud request. 2026-09-15T09:27:42.533 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:27:43.314 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:27:43.314 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:27:43.314 [Cloud] Queued cloud request. 2026-09-15T09:27:43.314 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:27:43.314 [Cloud] Dequeued cloud request. 2026-09-15T09:27:43.314 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:27:43.814 [Cloud] End of cloud request. 2026-09-15T09:27:44.330 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:28:24.924 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:28:24.924 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:28:24.924 [Cloud] Queued cloud request. 2026-09-15T09:28:24.924 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:28:24.924 [Cloud] Dequeued cloud request. 2026-09-15T09:28:24.924 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:28:25.033 [Cloud] End of cloud request. 2026-09-15T09:28:25.533 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:28:53.361 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 29041, Count: 1880, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\limesurvey\index.php, EstimatedImpact: 0% 2026-09-15T09:28:53.361 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 23231, Count: 1014, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-15T09:28:53.361 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 7132, Count: 297, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-15T09:28:53.361 ProcessImageName: powershell.exe, Pid: 3540, TotalTime: 1804, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 39% 2026-09-15T09:28:53.361 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 919, Count: 41, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-15T09:28:53.361 ProcessImageName: AgentShellService.exe, Pid: 5036, TotalTime: 792, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-15T09:28:53.361 ProcessImageName: WmiPrvSE.exe, Pid: 6092, TotalTime: 736, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-15T09:28:53.361 ProcessImageName: powershell.exe, Pid: 1960, TotalTime: 308, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 59% 2026-09-15T09:28:53.361 ProcessImageName: WmiPrvSE.exe, Pid: 1948, TotalTime: 286, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-15T09:28:53.361 ProcessImageName: WmiPrvSE.exe, Pid: 7368, TotalTime: 248, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-15T09:28:53.361 ProcessImageName: python.exe, Pid: 8152, TotalTime: 212, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 7% 2026-09-15T09:28:53.361 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 139, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-15T09:28:53.361 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 122, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-15T09:28:53.361 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-15T09:28:53.361 ProcessImageName: taskhostw.exe, Pid: 3436, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-15T09:28:53.361 ProcessImageName: taskhostw.exe, Pid: 3172, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 9% 2026-09-15T09:28:53.361 ProcessImageName: DeviceCensus.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-15T09:28:53.361 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2.MAI, EstimatedImpact: 0% 2026-09-15T09:28:53.361 ProcessImageName: powershell.exe, Pid: 6496, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rwprwnp5.upt.psm1, EstimatedImpact: 0% 2026-09-15T09:28:53.361 ProcessImageName: cmd.exe, Pid: 848, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-15T09:28:53.361 ProcessImageName: mysqldump.exe, Pid: 5888, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-15T09:28:53.361 ProcessImageName: taskhostw.exe, Pid: 6236, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-15T09:28:53.361 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-15T09:28:53.361 ProcessImageName: ngentask.exe, Pid: 8092, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-15T09:30:27.252 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:30:27.252 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:30:27.252 [Cloud] Queued cloud request. 2026-09-15T09:30:27.252 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:30:27.252 [Cloud] Dequeued cloud request. 2026-09-15T09:30:27.252 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:30:27.471 [Cloud] End of cloud request. 2026-09-15T09:30:27.971 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:31:49.189 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:31:49.189 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:31:49.189 [Cloud] Queued cloud request. 2026-09-15T09:31:49.189 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:31:49.189 [Cloud] Dequeued cloud request. 2026-09-15T09:31:49.189 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:31:49.361 [Cloud] End of cloud request. 2026-09-15T09:31:49.877 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:33:34.221 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:33:34.221 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:33:34.221 [Cloud] Queued cloud request. 2026-09-15T09:33:34.221 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:33:34.221 [Cloud] Dequeued cloud request. 2026-09-15T09:33:34.221 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:33:34.439 [Cloud] End of cloud request. 2026-09-15T09:33:34.939 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:33:43.658 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:33:43.658 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:33:43.658 [Cloud] Queued cloud request. 2026-09-15T09:33:43.658 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:33:43.658 [Cloud] Dequeued cloud request. 2026-09-15T09:33:43.658 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:33:43.752 [Cloud] End of cloud request. 2026-09-15T09:33:44.252 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:34:13.455 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:34:13.455 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:34:13.455 [Cloud] Queued cloud request. 2026-09-15T09:34:13.455 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:34:13.455 [Cloud] Dequeued cloud request. 2026-09-15T09:34:13.455 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:34:13.549 [Cloud] End of cloud request. 2026-09-15T09:34:14.064 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:34:17.424 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:34:17.424 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:34:17.424 [Cloud] Queued cloud request. 2026-09-15T09:34:17.424 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:34:17.424 [Cloud] Dequeued cloud request. 2026-09-15T09:34:17.424 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:34:17.533 [Cloud] End of cloud request. 2026-09-15T09:34:18.049 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:34:25.439 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:34:25.439 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:34:25.439 [Cloud] Queued cloud request. 2026-09-15T09:34:25.439 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:34:25.439 [Cloud] Dequeued cloud request. 2026-09-15T09:34:25.439 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:34:25.518 [Cloud] End of cloud request. 2026-09-15T09:34:26.018 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:36:21.564 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:36:21.564 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:36:21.564 [Cloud] Queued cloud request. 2026-09-15T09:36:21.564 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:36:21.564 [Cloud] Dequeued cloud request. 2026-09-15T09:36:21.564 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:36:21.767 [Cloud] End of cloud request. 2026-09-15T09:36:22.283 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:38:23.580 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:38:23.580 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:38:23.580 [Cloud] Queued cloud request. 2026-09-15T09:38:23.580 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:38:23.580 [Cloud] Dequeued cloud request. 2026-09-15T09:38:23.580 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:38:23.767 [Cloud] End of cloud request. 2026-09-15T09:38:24.267 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:38:30.236 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:38:30.236 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:38:30.236 [Cloud] Queued cloud request. 2026-09-15T09:38:30.236 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:38:30.236 [Cloud] Dequeued cloud request. 2026-09-15T09:38:30.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:38:30.345 [Cloud] End of cloud request. 2026-09-15T09:38:30.845 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:40:32.752 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T09:40:50.955 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:40:50.955 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:40:50.955 [Cloud] Queued cloud request. 2026-09-15T09:40:50.955 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:40:50.955 [Cloud] Dequeued cloud request. 2026-09-15T09:40:50.955 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:40:51.174 [Cloud] End of cloud request. 2026-09-15T09:40:51.689 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:41:41.970 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:41:41.970 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:41:41.970 [Cloud] Queued cloud request. 2026-09-15T09:41:41.970 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:41:41.970 [Cloud] Dequeued cloud request. 2026-09-15T09:41:41.970 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:41:42.095 [Cloud] End of cloud request. 2026-09-15T09:41:42.595 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:41:55.173 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:41:55.173 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:41:55.173 [Cloud] Queued cloud request. 2026-09-15T09:41:55.173 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:41:55.173 [Cloud] Dequeued cloud request. 2026-09-15T09:41:55.173 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:41:55.252 [Cloud] End of cloud request. 2026-09-15T09:41:55.752 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:44:30.298 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:44:30.298 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:44:30.298 [Cloud] Queued cloud request. 2026-09-15T09:44:30.298 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:44:30.298 [Cloud] Dequeued cloud request. 2026-09-15T09:44:30.298 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:44:30.533 [Cloud] End of cloud request. 2026-09-15T09:44:31.033 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:44:49.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:44:49.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:44:49.049 [Cloud] Queued cloud request. 2026-09-15T09:44:49.049 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:44:49.049 [Cloud] Dequeued cloud request. 2026-09-15T09:44:49.064 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:44:49.142 [Cloud] End of cloud request. 2026-09-15T09:44:49.642 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:45:11.533 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:45:11.533 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:45:11.533 [Cloud] Queued cloud request. 2026-09-15T09:45:11.533 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:45:11.533 [Cloud] Dequeued cloud request. 2026-09-15T09:45:11.533 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:45:11.627 [Cloud] End of cloud request. 2026-09-15T09:45:12.127 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:45:45.798 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:45:45.798 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:45:45.798 [Cloud] Queued cloud request. 2026-09-15T09:45:45.798 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:45:45.798 [Cloud] Dequeued cloud request. 2026-09-15T09:45:45.814 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:45:45.892 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{38FF8FB5-8C8E-F13B-476C-C5728B406064} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 09:45:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T09:45:46.392 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:46:45.876 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:46:45.876 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:46:45.876 [Cloud] Queued cloud request. 2026-09-15T09:46:45.876 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:46:45.876 [Cloud] Dequeued cloud request. 2026-09-15T09:46:45.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:46:46.064 [Cloud] End of cloud request. 2026-09-15T09:46:46.580 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:47:01.908 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:47:01.908 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:47:01.908 [Cloud] Queued cloud request. 2026-09-15T09:47:01.908 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:47:01.908 [Cloud] Dequeued cloud request. 2026-09-15T09:47:01.908 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:47:02.017 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{16CAD0E8-5593-0F81-CA25-595BABFD84D3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 09:47:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T09:47:02.517 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:49:22.798 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:49:22.798 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:49:22.798 [Cloud] Queued cloud request. 2026-09-15T09:49:22.798 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:49:22.798 [Cloud] Dequeued cloud request. 2026-09-15T09:49:22.814 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:49:22.986 [Cloud] End of cloud request. 2026-09-15T09:49:23.501 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:51:02.283 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:51:02.283 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:51:02.283 [Cloud] Queued cloud request. 2026-09-15T09:51:02.283 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:51:02.283 [Cloud] Dequeued cloud request. 2026-09-15T09:51:02.283 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:51:02.486 [Cloud] End of cloud request. 2026-09-15T09:51:02.986 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:54:34.251 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:54:34.251 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:54:34.251 [Cloud] Queued cloud request. 2026-09-15T09:54:34.251 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:54:34.251 [Cloud] Dequeued cloud request. 2026-09-15T09:54:34.251 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:54:44.392 [Cloud] End of cloud request. 2026-09-15T09:54:44.907 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:54:52.876 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:54:52.876 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:54:52.876 [Cloud] Queued cloud request. 2026-09-15T09:54:52.876 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:54:52.876 [Cloud] Dequeued cloud request. 2026-09-15T09:54:52.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:54:53.220 [Cloud] End of cloud request. 2026-09-15T09:54:53.720 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:55:04.642 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:55:04.642 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:55:04.642 [Cloud] Queued cloud request. 2026-09-15T09:55:04.642 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:55:04.642 [Cloud] Dequeued cloud request. 2026-09-15T09:55:04.642 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:55:04.736 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8554913B-8AB3-48D4-BC8E-E9DFEF5A3291} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 09:55:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T09:55:05.236 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:55:37.751 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T09:55:55.189 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:55:55.189 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:55:55.189 [Cloud] Queued cloud request. 2026-09-15T09:55:55.189 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:55:55.189 [Cloud] Dequeued cloud request. 2026-09-15T09:55:55.189 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:55:55.267 [Cloud] End of cloud request. 2026-09-15T09:55:55.767 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:57:08.298 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:57:08.298 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:57:08.298 [Cloud] Queued cloud request. 2026-09-15T09:57:08.298 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:57:08.298 [Cloud] Dequeued cloud request. 2026-09-15T09:57:08.298 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:57:08.501 [Cloud] End of cloud request. 2026-09-15T09:57:09.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:57:10.939 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:57:10.939 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:57:10.939 [Cloud] Queued cloud request. 2026-09-15T09:57:10.939 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:57:10.939 [Cloud] Dequeued cloud request. 2026-09-15T09:57:10.939 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:57:11.017 [Cloud] End of cloud request. 2026-09-15T09:57:11.532 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:57:25.970 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:57:25.970 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:57:25.970 [Cloud] Queued cloud request. 2026-09-15T09:57:25.970 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:57:25.970 [Cloud] Dequeued cloud request. 2026-09-15T09:57:25.970 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:57:26.064 [Cloud] End of cloud request. 2026-09-15T09:57:26.564 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:57:42.876 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:57:42.876 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:57:42.876 [Cloud] Queued cloud request. 2026-09-15T09:57:42.876 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:57:42.876 [Cloud] Dequeued cloud request. 2026-09-15T09:57:42.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:57:43.048 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5CD27748-748B-93D9-5DC0-FF3BC66E693B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 09:57:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T09:57:43.564 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:57:46.782 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:57:46.782 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:57:46.782 [Cloud] Queued cloud request. 2026-09-15T09:57:46.782 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:57:46.782 [Cloud] Dequeued cloud request. 2026-09-15T09:57:46.782 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:57:56.829 [Cloud] End of cloud request. 2026-09-15T09:57:57.345 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T09:59:53.110 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T09:59:53.110 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T09:59:53.110 [Cloud] Queued cloud request. 2026-09-15T09:59:53.110 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T09:59:53.110 [Cloud] Dequeued cloud request. 2026-09-15T09:59:53.110 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T09:59:53.345 [Cloud] End of cloud request. 2026-09-15T09:59:53.845 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:00:31.907 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:00:31.907 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:00:31.907 [Cloud] Queued cloud request. 2026-09-15T10:00:31.907 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:00:31.907 [Cloud] Dequeued cloud request. 2026-09-15T10:00:31.907 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:00:32.001 [Cloud] End of cloud request. 2026-09-15T10:00:32.517 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:04:49.360 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:04:49.360 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:04:49.360 [Cloud] Queued cloud request. 2026-09-15T10:04:49.360 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:04:49.360 [Cloud] Dequeued cloud request. 2026-09-15T10:04:49.360 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:04:49.798 [Cloud] End of cloud request. 2026-09-15T10:04:50.298 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:05:33.048 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:05:33.048 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:05:33.048 [Cloud] Queued cloud request. 2026-09-15T10:05:33.048 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:05:33.048 [Cloud] Dequeued cloud request. 2026-09-15T10:05:33.048 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:05:33.142 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AE2C4062-1D14-9C4A-1EAF-B2F41B4D4392} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 10:05:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T10:05:33.657 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:06:34.235 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:06:34.235 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:06:34.235 [Cloud] Queued cloud request. 2026-09-15T10:06:34.235 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:06:34.235 [Cloud] Dequeued cloud request. 2026-09-15T10:06:34.235 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:06:34.438 [Cloud] End of cloud request. 2026-09-15T10:06:34.938 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:08:44.345 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:08:44.345 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:08:44.345 [Cloud] Queued cloud request. 2026-09-15T10:08:44.345 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:08:44.345 [Cloud] Dequeued cloud request. 2026-09-15T10:08:44.345 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:08:44.548 [Cloud] End of cloud request. 2026-09-15T10:08:45.048 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:08:59.204 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:08:59.204 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:08:59.204 [Cloud] Queued cloud request. 2026-09-15T10:08:59.204 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:08:59.204 [Cloud] Dequeued cloud request. 2026-09-15T10:08:59.204 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:08:59.376 [Cloud] End of cloud request. 2026-09-15T10:08:59.876 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:10:21.923 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:10:21.923 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:10:21.923 [Cloud] Queued cloud request. 2026-09-15T10:10:21.923 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:10:21.923 [Cloud] Dequeued cloud request. 2026-09-15T10:10:21.923 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:10:22.251 [Cloud] End of cloud request. 2026-09-15T10:10:22.751 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:10:42.751 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T10:12:46.048 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:12:46.048 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:12:46.048 [Cloud] Queued cloud request. 2026-09-15T10:12:46.048 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:12:46.048 [Cloud] Dequeued cloud request. 2026-09-15T10:12:46.048 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:12:46.298 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F23767F-090E-A512-12E0-6780801FA041} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 10:12:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T10:12:46.798 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:13:56.454 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:13:56.454 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:13:56.454 [Cloud] Queued cloud request. 2026-09-15T10:13:56.454 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:13:56.454 [Cloud] Dequeued cloud request. 2026-09-15T10:13:56.454 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:13:56.892 [Cloud] End of cloud request. 2026-09-15T10:13:57.392 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:14:13.345 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:14:13.345 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:14:13.345 [Cloud] Queued cloud request. 2026-09-15T10:14:13.345 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:14:13.345 [Cloud] Dequeued cloud request. 2026-09-15T10:14:13.345 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:14:23.376 [Cloud] End of cloud request. 2026-09-15T10:14:23.876 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:17:39.298 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:17:39.298 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:17:39.298 [Cloud] Queued cloud request. 2026-09-15T10:17:39.298 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:17:39.298 [Cloud] Dequeued cloud request. 2026-09-15T10:17:39.298 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:17:39.485 [Cloud] End of cloud request. 2026-09-15T10:17:40.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:17:55.032 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:17:55.032 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:17:55.032 [Cloud] Queued cloud request. 2026-09-15T10:17:55.032 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:17:55.032 [Cloud] Dequeued cloud request. 2026-09-15T10:17:55.032 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:17:55.391 [Cloud] End of cloud request. 2026-09-15T10:17:55.891 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:18:01.360 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:18:01.360 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:18:01.360 [Cloud] Queued cloud request. 2026-09-15T10:18:01.360 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:18:01.360 [Cloud] Dequeued cloud request. 2026-09-15T10:18:01.360 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:18:01.438 [Cloud] End of cloud request. 2026-09-15T10:18:01.954 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:18:07.188 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:18:07.188 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:18:07.188 [Cloud] Queued cloud request. 2026-09-15T10:18:07.188 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:18:07.188 [Cloud] Dequeued cloud request. 2026-09-15T10:18:07.188 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:18:07.329 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EDC65933-1FA0-66AF-8722-1F9EE65DFAB6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 10:18:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T10:18:07.829 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:18:42.860 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:18:42.860 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:18:42.860 [Cloud] Queued cloud request. 2026-09-15T10:18:42.860 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:18:42.860 [Cloud] Dequeued cloud request. 2026-09-15T10:18:42.860 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:18:42.954 [Cloud] End of cloud request. 2026-09-15T10:18:43.454 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:19:07.001 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:19:07.001 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:19:07.001 [Cloud] Queued cloud request. 2026-09-15T10:19:07.001 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:19:07.001 [Cloud] Dequeued cloud request. 2026-09-15T10:19:07.001 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:19:07.079 [Cloud] End of cloud request. 2026-09-15T10:19:07.579 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:21:18.126 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:21:18.126 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:21:18.126 [Cloud] Queued cloud request. 2026-09-15T10:21:18.126 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:21:18.126 [Cloud] Dequeued cloud request. 2026-09-15T10:21:18.126 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:21:18.329 [Cloud] End of cloud request. 2026-09-15T10:21:18.829 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:21:54.407 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:21:54.407 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:21:54.407 [Cloud] Queued cloud request. 2026-09-15T10:21:54.407 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:21:54.407 [Cloud] Dequeued cloud request. 2026-09-15T10:21:54.422 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:21:54.501 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1E58A402-78ED-DA78-DB4E-FBA351603B5B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 10:21:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T10:21:55.016 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:22:21.126 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:22:21.126 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:22:21.126 [Cloud] Queued cloud request. 2026-09-15T10:22:21.126 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:22:21.126 [Cloud] Dequeued cloud request. 2026-09-15T10:22:21.126 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:22:21.219 [Cloud] End of cloud request. 2026-09-15T10:22:21.735 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:23:27.251 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:23:27.251 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:23:27.251 [Cloud] Queued cloud request. 2026-09-15T10:23:27.251 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:23:27.251 [Cloud] Dequeued cloud request. 2026-09-15T10:23:27.251 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:23:27.610 [Cloud] End of cloud request. 2026-09-15T10:23:28.126 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:23:38.079 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:23:38.079 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:23:38.079 [Cloud] Queued cloud request. 2026-09-15T10:23:38.079 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:23:38.079 [Cloud] Dequeued cloud request. 2026-09-15T10:23:38.079 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:23:38.172 [Cloud] End of cloud request. 2026-09-15T10:23:38.672 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:23:41.532 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:23:41.532 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:23:41.532 [Cloud] Queued cloud request. 2026-09-15T10:23:41.532 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:23:41.532 [Cloud] Dequeued cloud request. 2026-09-15T10:23:41.547 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:23:41.641 [Cloud] End of cloud request. 2026-09-15T10:23:42.157 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:25:47.751 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T10:30:42.250 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:30:42.250 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:30:42.250 [Cloud] Queued cloud request. 2026-09-15T10:30:42.250 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:30:42.250 [Cloud] Dequeued cloud request. 2026-09-15T10:30:42.250 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:30:42.532 [Cloud] End of cloud request. 2026-09-15T10:30:43.047 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:30:46.219 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:30:46.219 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:30:46.219 [Cloud] Queued cloud request. 2026-09-15T10:30:46.219 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:30:46.219 [Cloud] Dequeued cloud request. 2026-09-15T10:30:46.219 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:30:56.250 [Cloud] End of cloud request. 2026-09-15T10:30:56.750 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:31:13.375 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:31:13.375 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:31:13.375 [Cloud] Queued cloud request. 2026-09-15T10:31:13.375 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:31:13.375 [Cloud] Dequeued cloud request. 2026-09-15T10:31:13.375 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:31:13.704 [Cloud] End of cloud request. 2026-09-15T10:31:14.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:32:10.735 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:32:10.735 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:32:10.735 [Cloud] Queued cloud request. 2026-09-15T10:32:10.735 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:32:10.735 [Cloud] Dequeued cloud request. 2026-09-15T10:32:10.735 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:32:10.829 [Cloud] End of cloud request. 2026-09-15T10:32:11.329 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:35:57.907 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:35:57.907 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:35:57.907 [Cloud] Queued cloud request. 2026-09-15T10:35:57.907 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:35:57.907 [Cloud] Dequeued cloud request. 2026-09-15T10:35:57.907 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:35:58.094 [Cloud] End of cloud request. 2026-09-15T10:35:58.594 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:36:31.782 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:36:31.782 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:36:31.782 [Cloud] Queued cloud request. 2026-09-15T10:36:31.782 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:36:31.782 [Cloud] Dequeued cloud request. 2026-09-15T10:36:31.782 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:36:31.860 [Cloud] End of cloud request. 2026-09-15T10:36:32.360 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:37:52.313 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:37:52.313 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:37:52.313 [Cloud] Queued cloud request. 2026-09-15T10:37:52.313 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:37:52.313 [Cloud] Dequeued cloud request. 2026-09-15T10:37:52.313 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:37:52.469 [Cloud] End of cloud request. 2026-09-15T10:37:52.984 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:38:27.000 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:38:27.000 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:38:27.000 [Cloud] Queued cloud request. 2026-09-15T10:38:27.000 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:38:27.000 [Cloud] Dequeued cloud request. 2026-09-15T10:38:27.000 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:38:27.141 [Cloud] End of cloud request. 2026-09-15T10:38:27.656 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:40:52.750 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T10:41:16.141 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:41:16.141 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:41:16.141 [Cloud] Queued cloud request. 2026-09-15T10:41:16.141 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:41:16.297 [Cloud] Dequeued cloud request. 2026-09-15T10:41:16.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:41:16.453 [Cloud] End of cloud request. 2026-09-15T10:41:16.969 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:41:17.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:41:17.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:41:17.297 [Cloud] Queued cloud request. 2026-09-15T10:41:17.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:41:17.297 [Cloud] Dequeued cloud request. 2026-09-15T10:41:17.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:41:17.375 [Cloud] End of cloud request. 2026-09-15T10:41:17.875 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:41:32.750 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:41:32.750 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:41:32.750 [Cloud] Queued cloud request. 2026-09-15T10:41:32.750 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:41:32.750 [Cloud] Dequeued cloud request. 2026-09-15T10:41:32.750 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:41:33.078 [Cloud] End of cloud request. 2026-09-15T10:41:33.594 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:45:30.562 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:45:30.562 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:45:30.562 [Cloud] Queued cloud request. 2026-09-15T10:45:30.562 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:45:30.562 [Cloud] Dequeued cloud request. 2026-09-15T10:45:30.562 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:45:30.734 [Cloud] End of cloud request. 2026-09-15T10:45:31.234 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:45:39.390 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:45:39.390 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:45:39.390 [Cloud] Queued cloud request. 2026-09-15T10:45:39.390 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:45:39.390 [Cloud] Dequeued cloud request. 2026-09-15T10:45:39.390 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:45:39.469 [Cloud] End of cloud request. 2026-09-15T10:45:39.969 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:47:40.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:47:40.672 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:47:40.672 [Cloud] Queued cloud request. 2026-09-15T10:47:40.672 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:47:40.672 [Cloud] Dequeued cloud request. 2026-09-15T10:47:40.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:47:40.844 [Cloud] End of cloud request. 2026-09-15T10:47:41.359 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:48:06.640 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:48:06.640 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:48:06.640 [Cloud] Queued cloud request. 2026-09-15T10:48:06.640 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:48:06.640 [Cloud] Dequeued cloud request. 2026-09-15T10:48:06.640 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:48:06.734 [Cloud] End of cloud request. 2026-09-15T10:48:07.234 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:48:24.984 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:48:24.984 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:48:24.984 [Cloud] Queued cloud request. 2026-09-15T10:48:24.984 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:48:24.984 [Cloud] Dequeued cloud request. 2026-09-15T10:48:24.984 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:48:25.078 [Cloud] End of cloud request. 2026-09-15T10:48:25.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:48:58.375 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:48:58.375 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:48:58.375 [Cloud] Queued cloud request. 2026-09-15T10:48:58.375 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:48:58.375 [Cloud] Dequeued cloud request. 2026-09-15T10:48:58.375 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:48:58.469 [Cloud] End of cloud request. 2026-09-15T10:48:58.984 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:49:39.156 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:49:39.156 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:49:39.156 [Cloud] Queued cloud request. 2026-09-15T10:49:39.156 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:49:39.156 [Cloud] Dequeued cloud request. 2026-09-15T10:49:39.156 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:49:39.250 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D45587F7-BC43-BC49-A482-D737F28E9FCF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 10:49:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T10:49:39.750 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:51:18.718 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:51:18.718 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:51:18.718 [Cloud] Queued cloud request. 2026-09-15T10:51:18.718 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:51:18.718 [Cloud] Dequeued cloud request. 2026-09-15T10:51:18.718 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:51:18.890 [Cloud] End of cloud request. 2026-09-15T10:51:19.406 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:51:28.781 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:51:28.781 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:51:28.781 [Cloud] Queued cloud request. 2026-09-15T10:51:28.781 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:51:28.781 [Cloud] Dequeued cloud request. 2026-09-15T10:51:28.781 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:51:28.875 [Cloud] End of cloud request. 2026-09-15T10:51:29.375 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:53:51.406 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:53:51.406 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:53:51.422 [Cloud] Queued cloud request. 2026-09-15T10:53:51.422 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:53:51.422 [Cloud] Dequeued cloud request. 2026-09-15T10:53:51.422 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:53:51.578 [Cloud] End of cloud request. 2026-09-15T10:53:52.093 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:55:07.172 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:55:07.172 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:55:07.172 [Cloud] Queued cloud request. 2026-09-15T10:55:07.172 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:55:07.172 [Cloud] Dequeued cloud request. 2026-09-15T10:55:07.172 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:55:07.359 [Cloud] End of cloud request. 2026-09-15T10:55:07.859 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:55:26.453 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:55:26.453 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:55:26.453 [Cloud] Queued cloud request. 2026-09-15T10:55:26.453 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:55:26.453 [Cloud] Dequeued cloud request. 2026-09-15T10:55:26.453 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:55:26.562 [Cloud] End of cloud request. 2026-09-15T10:55:27.062 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:55:57.750 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T10:56:30.031 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:56:30.031 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:56:30.031 [Cloud] Queued cloud request. 2026-09-15T10:56:30.031 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:56:30.031 [Cloud] Dequeued cloud request. 2026-09-15T10:56:30.031 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:56:30.203 [Cloud] End of cloud request. 2026-09-15T10:56:30.703 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:56:54.922 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:56:54.922 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:56:54.922 [Cloud] Queued cloud request. 2026-09-15T10:56:54.922 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:56:54.922 [Cloud] Dequeued cloud request. 2026-09-15T10:56:54.922 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:56:55.031 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{432250C2-D64B-4716-B344-07C0168C1F7B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 10:56:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T10:56:55.531 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:59:07.750 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:59:07.750 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:59:07.750 [Cloud] Queued cloud request. 2026-09-15T10:59:07.750 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:59:07.750 [Cloud] Dequeued cloud request. 2026-09-15T10:59:07.750 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:59:07.906 [Cloud] End of cloud request. 2026-09-15T10:59:08.421 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:59:24.390 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:59:24.390 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:59:24.390 [Cloud] Queued cloud request. 2026-09-15T10:59:24.390 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:59:24.390 [Cloud] Dequeued cloud request. 2026-09-15T10:59:24.390 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:59:24.468 [Cloud] End of cloud request. 2026-09-15T10:59:24.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T10:59:30.531 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T10:59:30.531 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T10:59:30.531 [Cloud] Queued cloud request. 2026-09-15T10:59:30.531 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T10:59:30.531 [Cloud] Dequeued cloud request. 2026-09-15T10:59:30.531 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T10:59:30.624 [Cloud] End of cloud request. 2026-09-15T10:59:31.125 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:01:16.187 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:01:16.187 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:01:16.187 [Cloud] Queued cloud request. 2026-09-15T11:01:16.187 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:01:16.187 [Cloud] Dequeued cloud request. 2026-09-15T11:01:16.187 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:01:16.343 [Cloud] End of cloud request. 2026-09-15T11:01:16.843 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:01:26.015 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:01:26.015 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:01:26.015 [Cloud] Queued cloud request. 2026-09-15T11:01:26.015 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:01:26.015 [Cloud] Dequeued cloud request. 2026-09-15T11:01:26.015 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:01:26.125 [Cloud] End of cloud request. 2026-09-15T11:01:26.625 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:02:39.890 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:02:39.890 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:02:39.890 [Cloud] Queued cloud request. 2026-09-15T11:02:39.890 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:02:39.890 [Cloud] Dequeued cloud request. 2026-09-15T11:02:39.890 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:02:40.093 [Cloud] End of cloud request. 2026-09-15T11:02:40.609 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:02:46.187 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:02:46.187 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:02:46.187 [Cloud] Queued cloud request. 2026-09-15T11:02:46.187 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:02:46.187 [Cloud] Dequeued cloud request. 2026-09-15T11:02:46.187 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:02:46.312 [Cloud] End of cloud request. 2026-09-15T11:02:46.828 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:03:25.796 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:03:25.796 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:03:25.796 [Cloud] Queued cloud request. 2026-09-15T11:03:25.796 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:03:25.796 [Cloud] Dequeued cloud request. 2026-09-15T11:03:25.984 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:03:26.062 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{328C328E-72DB-367A-CE8D-57B964EC14C2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 11:03:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T11:03:26.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:03:43.453 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:03:43.453 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:03:43.453 [Cloud] Queued cloud request. 2026-09-15T11:03:43.453 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:03:43.453 [Cloud] Dequeued cloud request. 2026-09-15T11:03:43.453 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:03:43.546 [Cloud] End of cloud request. 2026-09-15T11:03:44.062 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:06:57.296 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:06:57.296 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:06:57.296 [Cloud] Queued cloud request. 2026-09-15T11:06:57.296 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:06:57.296 [Cloud] Dequeued cloud request. 2026-09-15T11:06:57.296 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:06:57.468 [Cloud] End of cloud request. 2026-09-15T11:06:57.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:11:02.749 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T11:21:37.811 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:21:37.811 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:21:37.811 [Cloud] Queued cloud request. 2026-09-15T11:21:37.811 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:21:37.827 [Cloud] Dequeued cloud request. 2026-09-15T11:21:37.827 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:21:37.983 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{019C957A-0FEC-C0E7-5146-E305FBB049CD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 11:21:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T11:21:38.483 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:25:19.483 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:25:19.483 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:25:19.483 [Cloud] Queued cloud request. 2026-09-15T11:25:19.483 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:25:19.483 [Cloud] Dequeued cloud request. 2026-09-15T11:25:19.483 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:25:19.670 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1B6D7BFC-17A0-274A-2397-DBA50395B36F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 11:25:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T11:25:20.186 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:26:07.749 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T11:28:53.374 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 31529, Count: 1983, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\limesurvey\index.php, EstimatedImpact: 0% 2026-09-15T11:28:53.374 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 27261, Count: 1189, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-15T11:28:53.374 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 7132, Count: 297, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-15T11:28:53.374 ProcessImageName: powershell.exe, Pid: 3540, TotalTime: 1804, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 39% 2026-09-15T11:28:53.374 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1011, Count: 45, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-15T11:28:53.374 ProcessImageName: AgentShellService.exe, Pid: 5036, TotalTime: 792, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-15T11:28:53.374 ProcessImageName: WmiPrvSE.exe, Pid: 6092, TotalTime: 736, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-15T11:28:53.374 ProcessImageName: powershell.exe, Pid: 1960, TotalTime: 308, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 59% 2026-09-15T11:28:53.374 ProcessImageName: WmiPrvSE.exe, Pid: 1948, TotalTime: 286, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-15T11:28:53.374 ProcessImageName: WmiPrvSE.exe, Pid: 7368, TotalTime: 248, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-15T11:28:53.374 ProcessImageName: python.exe, Pid: 8152, TotalTime: 212, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 7% 2026-09-15T11:28:53.374 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 139, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-15T11:28:53.374 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 122, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-15T11:28:53.374 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-15T11:28:53.374 ProcessImageName: taskhostw.exe, Pid: 3436, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-15T11:28:53.374 ProcessImageName: taskhostw.exe, Pid: 3172, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 9% 2026-09-15T11:28:53.374 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2.MAI, EstimatedImpact: 0% 2026-09-15T11:28:53.374 ProcessImageName: DeviceCensus.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-15T11:28:53.374 ProcessImageName: powershell.exe, Pid: 6496, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rwprwnp5.upt.psm1, EstimatedImpact: 0% 2026-09-15T11:28:53.374 ProcessImageName: cmd.exe, Pid: 848, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-15T11:28:53.374 ProcessImageName: mysqldump.exe, Pid: 5888, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-15T11:28:53.374 ProcessImageName: taskhostw.exe, Pid: 6236, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-15T11:28:53.374 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-15T11:28:53.374 ProcessImageName: ngentask.exe, Pid: 8092, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-15T11:41:12.748 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T11:43:27.232 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:43:27.232 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:43:27.232 [Cloud] Queued cloud request. 2026-09-15T11:43:27.232 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:43:27.232 [Cloud] Dequeued cloud request. 2026-09-15T11:43:27.248 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:43:27.435 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{85CDE35A-7087-7E5B-6C5A-723353BE46A5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 11:43:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T11:43:27.951 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:52:34.185 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:52:34.185 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:52:34.185 [Cloud] Queued cloud request. 2026-09-15T11:52:34.185 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:52:34.185 [Cloud] Dequeued cloud request. 2026-09-15T11:52:34.185 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:52:34.404 [Cloud] End of cloud request. 2026-09-15T11:52:34.904 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:52:49.467 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:52:49.467 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:52:49.467 [Cloud] Queued cloud request. 2026-09-15T11:52:49.467 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:52:49.467 [Cloud] Dequeued cloud request. 2026-09-15T11:52:49.467 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:52:50.654 [Cloud] End of cloud request. 2026-09-15T11:52:51.170 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:54:02.764 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:54:02.764 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:54:02.764 [Cloud] Queued cloud request. 2026-09-15T11:54:02.764 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:54:02.764 [Cloud] Dequeued cloud request. 2026-09-15T11:54:02.779 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:54:02.920 [Cloud] End of cloud request. 2026-09-15T11:54:03.435 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:56:00.113 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:56:00.113 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:56:00.113 [Cloud] Queued cloud request. 2026-09-15T11:56:00.113 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:56:00.113 [Cloud] Dequeued cloud request. 2026-09-15T11:56:00.113 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:56:00.285 [Cloud] End of cloud request. 2026-09-15T11:56:00.785 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:56:17.754 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T11:57:44.678 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:57:44.678 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:57:44.678 [Cloud] Queued cloud request. 2026-09-15T11:57:44.678 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:57:44.678 [Cloud] Dequeued cloud request. 2026-09-15T11:57:44.678 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:57:44.881 [Cloud] End of cloud request. 2026-09-15T11:57:45.381 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:58:08.306 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:58:08.306 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:58:08.306 [Cloud] Queued cloud request. 2026-09-15T11:58:08.306 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:58:08.306 [Cloud] Dequeued cloud request. 2026-09-15T11:58:08.306 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:58:08.384 [Cloud] End of cloud request. 2026-09-15T11:58:08.884 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:58:12.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:58:12.337 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:58:12.337 [Cloud] Queued cloud request. 2026-09-15T11:58:12.337 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:58:12.337 [Cloud] Dequeued cloud request. 2026-09-15T11:58:12.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:58:12.415 [Cloud] End of cloud request. 2026-09-15T11:58:12.931 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T11:59:57.385 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T11:59:57.385 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T11:59:57.385 [Cloud] Queued cloud request. 2026-09-15T11:59:57.385 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T11:59:57.385 [Cloud] Dequeued cloud request. 2026-09-15T11:59:57.385 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T11:59:57.541 [Cloud] End of cloud request. 2026-09-15T11:59:58.041 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T12:00:06.619 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T12:00:06.619 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T12:00:06.619 [Cloud] Queued cloud request. 2026-09-15T12:00:06.619 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T12:00:06.619 [Cloud] Dequeued cloud request. 2026-09-15T12:00:06.619 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T12:00:06.713 [Cloud] End of cloud request. 2026-09-15T12:00:07.229 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T12:02:33.916 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T12:02:33.916 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T12:02:33.916 [Cloud] Queued cloud request. 2026-09-15T12:02:33.916 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T12:02:33.916 [Cloud] Dequeued cloud request. 2026-09-15T12:02:33.916 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T12:02:34.119 [Cloud] End of cloud request. 2026-09-15T12:02:34.619 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T12:11:22.780 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T12:26:27.787 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T12:32:44.165 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T12:32:44.165 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T12:32:44.165 [Cloud] Queued cloud request. 2026-09-15T12:32:44.165 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T12:32:44.165 [Cloud] Dequeued cloud request. 2026-09-15T12:32:44.165 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T12:32:44.399 [Cloud] End of cloud request. 2026-09-15T12:32:44.915 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T12:34:29.977 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T12:34:29.977 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T12:34:29.977 [Cloud] Queued cloud request. 2026-09-15T12:34:29.977 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T12:34:29.977 [Cloud] Dequeued cloud request. 2026-09-15T12:34:29.977 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T12:34:40.102 [Cloud] End of cloud request. 2026-09-15T12:34:40.602 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T12:37:27.060 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T12:37:27.060 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T12:37:27.060 [Cloud] Queued cloud request. 2026-09-15T12:37:27.060 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T12:37:27.060 [Cloud] Dequeued cloud request. 2026-09-15T12:37:27.060 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T12:37:27.247 [Cloud] End of cloud request. 2026-09-15T12:37:27.763 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T12:41:00.514 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T12:41:00.514 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T12:41:00.514 [Cloud] Queued cloud request. 2026-09-15T12:41:00.514 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T12:41:00.514 [Cloud] Dequeued cloud request. 2026-09-15T12:41:00.514 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T12:41:00.701 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FAB95AB0-7D73-E3EB-AFFE-5E0D1EE0E5E4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 12:41:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T12:41:01.217 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T12:41:32.795 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T12:43:58.404 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T12:43:58.404 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T12:43:58.404 [Cloud] Queued cloud request. 2026-09-15T12:43:58.404 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T12:43:58.404 [Cloud] Dequeued cloud request. 2026-09-15T12:43:58.404 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T12:43:59.358 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ACF582E1-B77C-84C2-E864-510F319DAC1C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 12:43:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T12:43:59.858 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T12:51:47.143 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T12:51:47.143 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T12:51:47.143 [Cloud] Queued cloud request. 2026-09-15T12:51:47.143 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T12:51:47.143 [Cloud] Dequeued cloud request. 2026-09-15T12:51:47.143 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T12:51:47.409 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AD32C39D-604D-E446-1B38-DB8587621459} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 12:51:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T12:51:47.909 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T12:55:45.021 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T12:55:45.021 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T12:55:45.021 [Cloud] Queued cloud request. 2026-09-15T12:55:45.021 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T12:55:45.224 [Cloud] Dequeued cloud request. 2026-09-15T12:55:45.224 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T12:55:45.411 [Cloud] End of cloud request. 2026-09-15T12:55:45.927 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T12:56:37.802 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T12:58:59.024 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T12:58:59.024 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T12:58:59.024 [Cloud] Queued cloud request. 2026-09-15T12:58:59.024 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T12:58:59.024 [Cloud] Dequeued cloud request. 2026-09-15T12:58:59.024 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T12:58:59.539 [Cloud] End of cloud request. 2026-09-15T12:59:00.039 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:00:37.398 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:00:37.398 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:00:37.398 [Cloud] Queued cloud request. 2026-09-15T13:00:37.398 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:00:37.398 [Cloud] Dequeued cloud request. 2026-09-15T13:00:37.398 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:00:37.726 [Cloud] End of cloud request. 2026-09-15T13:00:38.226 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:01:08.226 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:01:08.226 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:01:08.226 [Cloud] Queued cloud request. 2026-09-15T13:01:08.226 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:01:08.226 [Cloud] Dequeued cloud request. 2026-09-15T13:01:08.226 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:01:08.304 [Cloud] End of cloud request. 2026-09-15T13:01:08.820 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:01:58.195 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:01:58.195 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:01:58.195 [Cloud] Queued cloud request. 2026-09-15T13:01:58.195 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:01:58.195 [Cloud] Dequeued cloud request. 2026-09-15T13:01:58.195 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:01:58.273 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B8EE1BB1-92AF-7B28-BC19-38060E941980} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 13:01:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T13:01:58.789 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:04:11.040 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:04:11.040 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:04:11.040 [Cloud] Queued cloud request. 2026-09-15T13:04:11.040 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:04:11.040 [Cloud] Dequeued cloud request. 2026-09-15T13:04:11.040 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:04:11.244 [Cloud] End of cloud request. 2026-09-15T13:04:11.744 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:04:41.244 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:04:41.244 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:04:41.244 [Cloud] Queued cloud request. 2026-09-15T13:04:41.244 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:04:41.244 [Cloud] Dequeued cloud request. 2026-09-15T13:04:41.244 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:04:41.338 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{55E97060-EC76-5207-5D84-D2099634FA74} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 13:04:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T13:04:41.838 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:06:21.949 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:06:21.949 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:06:21.949 [Cloud] Queued cloud request. 2026-09-15T13:06:21.949 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:06:21.949 [Cloud] Dequeued cloud request. 2026-09-15T13:06:21.949 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:06:22.136 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0259E1E7-9D85-96EE-AD57-17B7299B1DF8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 13:06:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T13:06:22.636 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:06:51.043 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:06:51.043 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:06:51.043 [Cloud] Queued cloud request. 2026-09-15T13:06:51.043 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:06:51.043 [Cloud] Dequeued cloud request. 2026-09-15T13:06:51.043 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:06:51.121 [Cloud] End of cloud request. 2026-09-15T13:06:51.636 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:11:42.810 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T13:24:16.395 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:24:16.395 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:24:16.395 [Cloud] Queued cloud request. 2026-09-15T13:24:16.395 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:24:16.395 [Cloud] Dequeued cloud request. 2026-09-15T13:24:16.395 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:24:16.536 [Cloud] End of cloud request. 2026-09-15T13:24:17.036 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:26:47.819 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T13:27:26.303 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:27:26.303 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:27:26.303 [Cloud] Queued cloud request. 2026-09-15T13:27:26.303 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:27:26.303 [Cloud] Dequeued cloud request. 2026-09-15T13:27:26.303 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:27:26.444 [Cloud] End of cloud request. 2026-09-15T13:27:26.960 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:28:53.445 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 32721, Count: 2048, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\limesurvey\index.php, EstimatedImpact: 0% 2026-09-15T13:28:53.445 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 29934, Count: 1360, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-15T13:28:53.445 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 7132, Count: 297, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-15T13:28:53.445 ProcessImageName: powershell.exe, Pid: 3540, TotalTime: 1804, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 39% 2026-09-15T13:28:53.445 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1057, Count: 49, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-15T13:28:53.445 ProcessImageName: AgentShellService.exe, Pid: 5036, TotalTime: 792, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-15T13:28:53.445 ProcessImageName: WmiPrvSE.exe, Pid: 6092, TotalTime: 736, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-15T13:28:53.445 ProcessImageName: powershell.exe, Pid: 1960, TotalTime: 308, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 59% 2026-09-15T13:28:53.445 ProcessImageName: WmiPrvSE.exe, Pid: 1948, TotalTime: 286, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-15T13:28:53.445 ProcessImageName: WmiPrvSE.exe, Pid: 7368, TotalTime: 248, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-15T13:28:53.445 ProcessImageName: python.exe, Pid: 8152, TotalTime: 212, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 7% 2026-09-15T13:28:53.445 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 139, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-15T13:28:53.445 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 122, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-15T13:28:53.445 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-15T13:28:53.445 ProcessImageName: taskhostw.exe, Pid: 3172, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 9% 2026-09-15T13:28:53.445 ProcessImageName: taskhostw.exe, Pid: 3436, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-15T13:28:53.445 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2.MAI, EstimatedImpact: 0% 2026-09-15T13:28:53.445 ProcessImageName: DeviceCensus.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-15T13:28:53.445 ProcessImageName: powershell.exe, Pid: 6496, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rwprwnp5.upt.psm1, EstimatedImpact: 0% 2026-09-15T13:28:53.445 ProcessImageName: cmd.exe, Pid: 848, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-15T13:28:53.445 ProcessImageName: mysqldump.exe, Pid: 5888, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-15T13:28:53.445 ProcessImageName: taskhostw.exe, Pid: 6236, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-15T13:28:53.445 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-15T13:28:53.445 ProcessImageName: ngentask.exe, Pid: 8092, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-15T13:41:16.575 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:41:16.575 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:41:16.575 [Cloud] Queued cloud request. 2026-09-15T13:41:16.575 [Cloud] Dequeued cloud request. 2026-09-15T13:41:16.575 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:41:16.575 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:41:16.778 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{640553C0-81CF-2EE3-E630-A113963EC360} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 13:41:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T13:41:17.278 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:41:24.685 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:41:24.685 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:41:24.685 [Cloud] Queued cloud request. 2026-09-15T13:41:24.685 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:41:24.685 [Cloud] Dequeued cloud request. 2026-09-15T13:41:24.685 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:41:24.763 [Cloud] End of cloud request. 2026-09-15T13:41:25.263 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:41:27.091 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:41:27.091 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:41:27.091 [Cloud] Queued cloud request. 2026-09-15T13:41:27.091 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:41:27.091 [Cloud] Dequeued cloud request. 2026-09-15T13:41:27.091 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:41:27.200 [Cloud] End of cloud request. 2026-09-15T13:41:27.716 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:41:52.825 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T13:42:18.544 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:42:18.544 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:42:18.544 [Cloud] Queued cloud request. 2026-09-15T13:42:18.544 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:42:18.544 [Cloud] Dequeued cloud request. 2026-09-15T13:42:18.544 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:42:18.622 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3310DEC7-2999-0FBD-AB6A-E39016E6BE6E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 13:42:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T13:42:19.122 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:44:01.685 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:44:01.685 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:44:01.685 [Cloud] Queued cloud request. 2026-09-15T13:44:01.685 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:44:01.685 [Cloud] Dequeued cloud request. 2026-09-15T13:44:01.685 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:44:01.857 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{13B25D6C-AE4F-C2AD-2B87-64AA83B5FAC9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 13:44:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T13:44:02.357 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:45:00.903 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:45:00.903 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:45:00.903 [Cloud] Queued cloud request. 2026-09-15T13:45:00.903 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:45:00.903 [Cloud] Dequeued cloud request. 2026-09-15T13:45:00.903 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:45:00.982 [Cloud] End of cloud request. 2026-09-15T13:45:01.497 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:48:14.127 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:48:14.127 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:48:14.127 [Cloud] Queued cloud request. 2026-09-15T13:48:14.127 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:48:14.127 [Cloud] Dequeued cloud request. 2026-09-15T13:48:14.127 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:48:14.298 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{42E3F65D-36C3-5FBC-9325-A666E360D043} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 13:48:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T13:48:14.814 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:48:35.142 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:48:35.142 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:48:35.142 [Cloud] Queued cloud request. 2026-09-15T13:48:35.142 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:48:35.142 [Cloud] Dequeued cloud request. 2026-09-15T13:48:35.142 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:48:35.236 [Cloud] End of cloud request. 2026-09-15T13:48:35.752 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:51:23.095 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:51:23.095 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:51:23.095 [Cloud] Queued cloud request. 2026-09-15T13:51:23.095 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:51:23.095 [Cloud] Dequeued cloud request. 2026-09-15T13:51:23.095 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:51:23.283 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1EA7B7E3-6B93-5738-BBB4-0CCB0BA91E0B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 13:51:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T13:51:23.783 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:51:55.517 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:51:55.517 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:51:55.517 [Cloud] Queued cloud request. 2026-09-15T13:51:55.517 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:51:55.517 [Cloud] Dequeued cloud request. 2026-09-15T13:51:55.517 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:51:55.595 [Cloud] End of cloud request. 2026-09-15T13:51:56.095 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:52:57.127 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:52:57.127 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:52:57.127 [Cloud] Queued cloud request. 2026-09-15T13:52:57.127 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:52:57.127 [Cloud] Dequeued cloud request. 2026-09-15T13:52:57.127 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:52:57.283 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F87E3B5-15B3-89C7-1D2B-11723BF1A4E0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 13:52:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T13:52:57.783 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:54:11.551 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:54:11.551 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:54:11.551 [Cloud] Queued cloud request. 2026-09-15T13:54:11.551 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:54:11.551 [Cloud] Dequeued cloud request. 2026-09-15T13:54:11.551 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:54:11.692 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F96FF7E5-A0BB-42C2-AA75-B63EA7202283} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 13:54:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T13:54:12.192 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T13:56:57.833 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T13:58:20.194 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T13:58:20.194 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T13:58:20.194 [Cloud] Queued cloud request. 2026-09-15T13:58:20.194 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T13:58:20.194 [Cloud] Dequeued cloud request. 2026-09-15T13:58:20.194 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T13:58:20.335 [Cloud] End of cloud request. 2026-09-15T13:58:20.850 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:01:23.054 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:01:23.054 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:01:23.054 [Cloud] Queued cloud request. 2026-09-15T14:01:23.054 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:01:23.054 [Cloud] Dequeued cloud request. 2026-09-15T14:01:23.054 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:01:23.210 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3854B95B-B11F-5043-E2A8-A419BD4C49E5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 14:01:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T14:01:23.710 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:01:25.851 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:01:25.851 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:01:25.851 [Cloud] Queued cloud request. 2026-09-15T14:01:25.851 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:01:25.851 [Cloud] Dequeued cloud request. 2026-09-15T14:01:25.851 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:01:26.023 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{75216DA6-A144-B3C7-AB46-7DF26097E4DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 14:01:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T14:01:26.523 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:02:04.835 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:02:04.835 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:02:04.835 [Cloud] Queued cloud request. 2026-09-15T14:02:04.835 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:02:04.835 [Cloud] Dequeued cloud request. 2026-09-15T14:02:04.835 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:02:04.913 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4BEB0326-8E91-A9F1-68CE-E9B8D43A684E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 14:02:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T14:02:05.413 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:07:40.917 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:07:40.917 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:07:40.917 [Cloud] Queued cloud request. 2026-09-15T14:07:40.917 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:07:40.917 [Cloud] Dequeued cloud request. 2026-09-15T14:07:40.917 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:07:41.089 [Cloud] End of cloud request. 2026-09-15T14:07:41.589 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:12:02.841 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T14:19:32.595 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:19:32.595 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:19:32.595 [Cloud] Queued cloud request. 2026-09-15T14:19:32.595 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:19:32.595 [Cloud] Dequeued cloud request. 2026-09-15T14:19:32.611 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:19:32.861 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CC6817A9-129E-0ACA-448C-A4F623F18DEB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 14:19:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T14:19:33.376 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:21:36.439 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:21:36.439 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:21:36.439 [Cloud] Queued cloud request. 2026-09-15T14:21:36.439 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:21:36.439 [Cloud] Dequeued cloud request. 2026-09-15T14:21:36.439 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:21:36.642 [Cloud] End of cloud request. 2026-09-15T14:21:37.142 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:27:07.849 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T14:28:18.053 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:28:18.053 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:28:18.053 [Cloud] Queued cloud request. 2026-09-15T14:28:18.053 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:28:18.053 [Cloud] Dequeued cloud request. 2026-09-15T14:28:18.053 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:28:18.241 [Cloud] End of cloud request. 2026-09-15T14:28:18.741 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:31:33.680 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:31:33.680 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:31:33.680 [Cloud] Queued cloud request. 2026-09-15T14:31:33.680 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:31:33.680 [Cloud] Dequeued cloud request. 2026-09-15T14:31:33.680 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:31:33.898 [Cloud] End of cloud request. 2026-09-15T14:31:34.398 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:31:51.305 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:31:51.305 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:31:51.305 [Cloud] Queued cloud request. 2026-09-15T14:31:51.305 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:31:51.305 [Cloud] Dequeued cloud request. 2026-09-15T14:31:51.305 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:31:51.383 [Cloud] End of cloud request. 2026-09-15T14:31:51.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:32:31.383 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:32:31.383 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:32:31.383 [Cloud] Queued cloud request. 2026-09-15T14:32:31.383 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:32:31.383 [Cloud] Dequeued cloud request. 2026-09-15T14:32:31.383 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:32:41.414 [Cloud] End of cloud request. 2026-09-15T14:32:41.914 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:33:45.056 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:33:45.056 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:33:45.056 [Cloud] Queued cloud request. 2026-09-15T14:33:45.056 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:33:45.056 [Cloud] Dequeued cloud request. 2026-09-15T14:33:45.056 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:33:45.259 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{28570B78-DB82-634B-9B83-895C6C1362B3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 14:33:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T14:33:45.759 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:37:44.667 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:37:44.667 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:37:44.667 [Cloud] Queued cloud request. 2026-09-15T14:37:44.667 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:37:44.667 [Cloud] Dequeued cloud request. 2026-09-15T14:37:44.667 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:37:44.839 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EED9CB9F-B629-8DDD-16B0-2C6172DC5240} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 14:37:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T14:37:45.355 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:41:43.137 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:41:43.137 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:41:43.137 [Cloud] Queued cloud request. 2026-09-15T14:41:43.137 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:41:43.137 [Cloud] Dequeued cloud request. 2026-09-15T14:41:43.137 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:41:43.325 [Cloud] End of cloud request. 2026-09-15T14:41:43.825 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:42:12.856 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T14:43:59.434 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:43:59.434 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:43:59.434 [Cloud] Queued cloud request. 2026-09-15T14:43:59.434 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:43:59.434 [Cloud] Dequeued cloud request. 2026-09-15T14:43:59.434 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:43:59.622 [Cloud] End of cloud request. 2026-09-15T14:44:00.122 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:46:27.781 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:46:27.781 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:46:27.781 [Cloud] Queued cloud request. 2026-09-15T14:46:27.781 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:46:27.781 [Cloud] Dequeued cloud request. 2026-09-15T14:46:27.781 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:46:27.969 [Cloud] End of cloud request. 2026-09-15T14:46:28.484 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:50:12.392 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:50:12.392 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:50:12.392 [Cloud] Queued cloud request. 2026-09-15T14:50:12.392 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:50:12.392 [Cloud] Dequeued cloud request. 2026-09-15T14:50:12.392 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:50:12.673 [Cloud] End of cloud request. 2026-09-15T14:50:13.189 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:51:26.923 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:51:26.923 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:51:26.923 [Cloud] Queued cloud request. 2026-09-15T14:51:26.923 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:51:26.923 [Cloud] Dequeued cloud request. 2026-09-15T14:51:26.923 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:51:27.189 [Cloud] End of cloud request. 2026-09-15T14:51:27.689 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:57:17.863 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T14:57:56.287 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:57:56.287 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:57:56.287 [Cloud] Queued cloud request. 2026-09-15T14:57:56.287 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:57:56.287 [Cloud] Dequeued cloud request. 2026-09-15T14:57:56.287 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:57:56.443 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FB9B36BE-B68A-AA1F-A208-0FCAF35E26D6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 14:57:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T14:57:56.943 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T14:58:58.506 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T14:58:58.506 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T14:58:58.506 [Cloud] Queued cloud request. 2026-09-15T14:58:58.506 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T14:58:58.506 [Cloud] Dequeued cloud request. 2026-09-15T14:58:58.506 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T14:58:58.662 [Cloud] End of cloud request. 2026-09-15T14:58:59.162 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:01:54.490 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:01:54.490 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:01:54.490 [Cloud] Queued cloud request. 2026-09-15T15:01:54.490 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:01:54.490 [Cloud] Dequeued cloud request. 2026-09-15T15:01:54.490 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:01:54.631 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B35B96D9-EA2A-673C-F3B1-171B06AD77AB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 15:01:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T15:01:55.131 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:03:22.740 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:03:22.740 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:03:22.740 [Cloud] Queued cloud request. 2026-09-15T15:03:22.740 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:03:22.740 [Cloud] Dequeued cloud request. 2026-09-15T15:03:22.740 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:03:22.912 [Cloud] End of cloud request. 2026-09-15T15:03:23.412 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:04:08.475 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:04:08.475 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:04:08.475 [Cloud] Queued cloud request. 2026-09-15T15:04:08.475 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:04:08.475 [Cloud] Dequeued cloud request. 2026-09-15T15:04:08.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:04:08.663 [Cloud] End of cloud request. 2026-09-15T15:04:09.163 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:07:14.807 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:07:14.807 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:07:14.807 [Cloud] Queued cloud request. 2026-09-15T15:07:14.807 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:07:14.807 [Cloud] Dequeued cloud request. 2026-09-15T15:07:14.807 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:07:14.947 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4B784628-963A-C957-658C-C6949FDB1434} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 15:07:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T15:07:15.447 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:08:15.277 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:08:15.277 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:08:15.277 [Cloud] Queued cloud request. 2026-09-15T15:08:15.277 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:08:15.277 [Cloud] Dequeued cloud request. 2026-09-15T15:08:15.277 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:08:15.433 [Cloud] End of cloud request. 2026-09-15T15:08:15.949 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:11:01.934 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:11:01.934 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:11:01.934 [Cloud] Queued cloud request. 2026-09-15T15:11:01.934 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:11:01.934 [Cloud] Dequeued cloud request. 2026-09-15T15:11:01.934 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:11:02.090 [Cloud] End of cloud request. 2026-09-15T15:11:02.605 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:12:22.871 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T15:13:40.902 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:13:40.902 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:13:40.902 [Cloud] Queued cloud request. 2026-09-15T15:13:40.902 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:13:41.059 [Cloud] Dequeued cloud request. 2026-09-15T15:13:41.059 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:13:41.199 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{43EE9683-6B98-3D57-D135-EC00CB616FDE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 15:13:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T15:13:41.699 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:14:46.418 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:14:46.418 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:14:46.418 [Cloud] Queued cloud request. 2026-09-15T15:14:46.418 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:14:46.418 [Cloud] Dequeued cloud request. 2026-09-15T15:14:46.418 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:14:46.559 [Cloud] End of cloud request. 2026-09-15T15:14:47.059 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:19:43.454 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:19:43.454 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:19:43.454 [Cloud] Queued cloud request. 2026-09-15T15:19:43.454 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:19:43.454 [Cloud] Dequeued cloud request. 2026-09-15T15:19:43.454 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:19:43.610 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C812B06-12E1-BD1C-1435-0313DAD26E90} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 15:19:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T15:19:44.110 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:20:26.141 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:20:26.141 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:20:26.141 [Cloud] Queued cloud request. 2026-09-15T15:20:26.141 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:20:26.141 [Cloud] Dequeued cloud request. 2026-09-15T15:20:26.141 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:20:26.235 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{258EA23D-EFD0-3CFE-2D6D-BF1AA13B3FB7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 15:20:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T15:20:26.735 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:25:55.019 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:25:55.019 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:25:55.019 [Cloud] Queued cloud request. 2026-09-15T15:25:55.019 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:25:55.019 [Cloud] Dequeued cloud request. 2026-09-15T15:25:55.019 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:26:05.160 [Cloud] End of cloud request. 2026-09-15T15:26:05.660 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:27:27.880 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T15:28:53.506 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 34054, Count: 2114, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-15T15:28:53.506 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 32071, Count: 1538, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-15T15:28:53.506 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 7132, Count: 297, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-15T15:28:53.506 ProcessImageName: powershell.exe, Pid: 3540, TotalTime: 1804, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 39% 2026-09-15T15:28:53.506 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1118, Count: 53, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-15T15:28:53.506 ProcessImageName: AgentShellService.exe, Pid: 5036, TotalTime: 792, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-15T15:28:53.506 ProcessImageName: WmiPrvSE.exe, Pid: 6092, TotalTime: 736, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-15T15:28:53.506 ProcessImageName: powershell.exe, Pid: 1960, TotalTime: 308, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 59% 2026-09-15T15:28:53.506 ProcessImageName: WmiPrvSE.exe, Pid: 1948, TotalTime: 286, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-15T15:28:53.506 ProcessImageName: WmiPrvSE.exe, Pid: 7368, TotalTime: 248, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-15T15:28:53.506 ProcessImageName: python.exe, Pid: 8152, TotalTime: 212, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 7% 2026-09-15T15:28:53.506 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 139, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-15T15:28:53.506 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 122, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-15T15:28:53.506 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-15T15:28:53.506 ProcessImageName: taskhostw.exe, Pid: 3172, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 9% 2026-09-15T15:28:53.506 ProcessImageName: taskhostw.exe, Pid: 3436, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-15T15:28:53.506 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2.MAI, EstimatedImpact: 0% 2026-09-15T15:28:53.506 ProcessImageName: DeviceCensus.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-15T15:28:53.506 ProcessImageName: powershell.exe, Pid: 6496, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rwprwnp5.upt.psm1, EstimatedImpact: 0% 2026-09-15T15:28:53.506 ProcessImageName: cmd.exe, Pid: 848, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-15T15:28:53.506 ProcessImageName: mysqldump.exe, Pid: 5888, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-15T15:28:53.506 ProcessImageName: taskhostw.exe, Pid: 6236, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-15T15:28:53.506 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-15T15:28:53.506 ProcessImageName: ngentask.exe, Pid: 8092, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-15T15:32:11.600 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:32:11.600 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:32:11.600 [Cloud] Queued cloud request. 2026-09-15T15:32:11.600 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:32:11.756 [Cloud] Dequeued cloud request. 2026-09-15T15:32:11.928 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:32:12.584 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{32FA5852-1AFA-FB7D-CA1D-CBF0D33A8E03} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 15:32:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T15:32:13.100 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:34:10.241 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:34:10.241 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:34:10.241 [Cloud] Queued cloud request. 2026-09-15T15:34:10.241 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:34:10.241 [Cloud] Dequeued cloud request. 2026-09-15T15:34:10.241 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:34:10.397 [Cloud] End of cloud request. 2026-09-15T15:34:10.897 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:36:29.994 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:36:29.994 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:36:29.994 [Cloud] Queued cloud request. 2026-09-15T15:36:29.994 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:36:29.994 [Cloud] Dequeued cloud request. 2026-09-15T15:36:29.994 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:36:30.181 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F7C0BDFD-F7DA-0919-24E9-76E9713B6366} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 15:36:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T15:36:30.681 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:37:47.651 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:37:47.651 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:37:47.651 [Cloud] Queued cloud request. 2026-09-15T15:37:47.651 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:37:47.651 [Cloud] Dequeued cloud request. 2026-09-15T15:37:47.651 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:37:47.838 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4FC2DB2B-BFD4-A6EC-5D4A-9333945F04A0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 15:37:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T15:37:48.338 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:39:03.464 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:39:03.464 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:39:03.464 [Cloud] Queued cloud request. 2026-09-15T15:39:03.464 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:39:03.464 [Cloud] Dequeued cloud request. 2026-09-15T15:39:03.464 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:39:03.855 [Cloud] End of cloud request. 2026-09-15T15:39:04.370 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:39:29.511 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:39:29.511 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:39:29.511 [Cloud] Queued cloud request. 2026-09-15T15:39:29.511 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:39:29.511 [Cloud] Dequeued cloud request. 2026-09-15T15:39:29.511 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:39:29.605 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4B181BAF-A4CF-98C1-810D-597C434F93F6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 15:39:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T15:39:30.120 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:42:09.886 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:42:09.886 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:42:09.886 [Cloud] Queued cloud request. 2026-09-15T15:42:09.886 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:42:10.089 [Cloud] Dequeued cloud request. 2026-09-15T15:42:10.089 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:42:10.261 [Cloud] End of cloud request. 2026-09-15T15:42:10.777 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:42:32.886 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T15:47:30.296 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:47:30.296 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:47:30.296 [Cloud] Queued cloud request. 2026-09-15T15:47:30.296 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:47:30.296 [Cloud] Dequeued cloud request. 2026-09-15T15:47:30.296 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:47:30.468 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EFF66FB0-4E65-3787-1C34-3B5533388BC0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 15:47:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T15:47:30.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:48:21.266 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:48:21.266 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:48:21.266 [Cloud] Queued cloud request. 2026-09-15T15:48:21.266 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:48:21.266 [Cloud] Dequeued cloud request. 2026-09-15T15:48:21.266 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:48:21.344 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{66A88457-7235-8EBE-FCD8-51550128D970} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 15:48:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T15:48:21.844 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:52:12.328 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:52:12.328 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:52:12.328 [Cloud] Queued cloud request. 2026-09-15T15:52:12.328 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:52:12.328 [Cloud] Dequeued cloud request. 2026-09-15T15:52:12.328 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:52:12.625 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5114847B-B62E-41C9-F136-4BBA3CDA9F71} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 15:52:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T15:52:13.125 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:53:26.156 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:53:26.156 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:53:26.156 [Cloud] Queued cloud request. 2026-09-15T15:53:26.156 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:53:26.156 [Cloud] Dequeued cloud request. 2026-09-15T15:53:26.156 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:53:26.297 [Cloud] End of cloud request. 2026-09-15T15:53:26.812 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:56:10.941 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T15:56:10.941 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T15:56:10.941 [Cloud] Queued cloud request. 2026-09-15T15:56:10.941 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T15:56:10.941 [Cloud] Dequeued cloud request. 2026-09-15T15:56:10.941 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T15:56:11.097 [Cloud] End of cloud request. 2026-09-15T15:56:11.597 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T15:57:37.895 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T16:03:46.084 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:03:46.084 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:03:46.084 [Cloud] Queued cloud request. 2026-09-15T16:03:46.084 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:03:46.084 [Cloud] Dequeued cloud request. 2026-09-15T16:03:46.084 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:03:46.225 [Cloud] End of cloud request. 2026-09-15T16:03:46.725 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:04:09.038 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:04:09.038 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:04:09.038 [Cloud] Queued cloud request. 2026-09-15T16:04:09.038 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:04:09.038 [Cloud] Dequeued cloud request. 2026-09-15T16:04:09.038 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:04:09.116 [Cloud] End of cloud request. 2026-09-15T16:04:09.631 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:08:28.713 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:08:28.713 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:08:28.713 [Cloud] Queued cloud request. 2026-09-15T16:08:28.713 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:08:28.713 [Cloud] Dequeued cloud request. 2026-09-15T16:08:28.713 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:08:28.854 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{38A4D2CE-92D7-E8CD-FFD0-5D36C32B06D8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 16:08:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T16:08:29.354 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:08:58.042 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:08:58.042 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:08:58.042 [Cloud] Queued cloud request. 2026-09-15T16:08:58.042 [Cloud] Dequeued cloud request. 2026-09-15T16:08:58.042 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:08:58.042 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:08:58.120 [Cloud] End of cloud request. 2026-09-15T16:08:58.636 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:11:27.870 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:11:27.870 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:11:27.870 [Cloud] Queued cloud request. 2026-09-15T16:11:27.870 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:11:27.870 [Cloud] Dequeued cloud request. 2026-09-15T16:11:27.870 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:11:28.026 [Cloud] End of cloud request. 2026-09-15T16:11:28.542 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:12:42.901 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T16:14:22.995 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:14:22.995 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:14:22.995 [Cloud] Queued cloud request. 2026-09-15T16:14:22.995 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:14:22.995 [Cloud] Dequeued cloud request. 2026-09-15T16:14:22.995 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:14:23.151 [Cloud] End of cloud request. 2026-09-15T16:14:23.667 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:15:52.887 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:15:52.887 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:15:52.887 [Cloud] Queued cloud request. 2026-09-15T16:15:52.887 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:15:52.887 [Cloud] Dequeued cloud request. 2026-09-15T16:15:52.887 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:15:53.043 [Cloud] End of cloud request. 2026-09-15T16:15:53.543 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:21:10.984 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:21:10.984 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:21:10.984 [Cloud] Queued cloud request. 2026-09-15T16:21:10.984 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:21:10.984 [Cloud] Dequeued cloud request. 2026-09-15T16:21:10.984 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:21:11.140 [Cloud] End of cloud request. 2026-09-15T16:21:11.640 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:23:05.829 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:23:05.829 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:23:05.829 [Cloud] Queued cloud request. 2026-09-15T16:23:05.829 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:23:05.829 [Cloud] Dequeued cloud request. 2026-09-15T16:23:05.829 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:23:05.985 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{89F047A3-3C19-D60B-9F2B-1C7ECB973D11} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 16:23:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T16:23:06.485 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:23:43.799 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:23:43.799 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:23:43.799 [Cloud] Queued cloud request. 2026-09-15T16:23:43.799 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:23:43.799 [Cloud] Dequeued cloud request. 2026-09-15T16:23:43.799 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:23:43.877 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9B92E167-18DD-1F15-FCB9-9D8AE82A143A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 16:23:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T16:23:44.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:25:10.627 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:25:10.627 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:25:10.627 [Cloud] Queued cloud request. 2026-09-15T16:25:10.627 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:25:10.627 [Cloud] Dequeued cloud request. 2026-09-15T16:25:10.627 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:25:20.705 [Cloud] End of cloud request. 2026-09-15T16:25:21.221 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:27:22.534 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:27:22.534 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:27:22.534 [Cloud] Queued cloud request. 2026-09-15T16:27:22.534 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:27:22.534 [Cloud] Dequeued cloud request. 2026-09-15T16:27:22.534 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:27:22.800 [Cloud] End of cloud request. 2026-09-15T16:27:23.316 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:27:47.911 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T16:28:58.005 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:28:58.005 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:28:58.005 [Cloud] Queued cloud request. 2026-09-15T16:28:58.005 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:28:58.005 [Cloud] Dequeued cloud request. 2026-09-15T16:28:58.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:28:58.192 [Cloud] End of cloud request. 2026-09-15T16:28:58.693 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:34:58.536 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:34:58.536 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:34:58.536 [Cloud] Queued cloud request. 2026-09-15T16:34:58.536 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:34:58.536 [Cloud] Dequeued cloud request. 2026-09-15T16:34:58.536 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:34:58.724 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9517B4F2-70BB-EE05-FA78-CAF8D7053EDF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 16:34:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T16:34:59.224 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:38:48.057 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:38:48.057 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:38:48.057 [Cloud] Queued cloud request. 2026-09-15T16:38:48.057 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:38:48.057 [Cloud] Dequeued cloud request. 2026-09-15T16:38:48.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:38:48.245 [Cloud] End of cloud request. 2026-09-15T16:38:48.745 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:40:48.588 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:40:48.588 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:40:48.588 [Cloud] Queued cloud request. 2026-09-15T16:40:48.588 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:40:48.588 [Cloud] Dequeued cloud request. 2026-09-15T16:40:48.588 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:40:48.776 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C3BC7455-62C4-5001-7038-86688C3DBCFC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 16:40:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T16:40:49.276 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:42:52.917 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T16:46:36.623 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:46:36.623 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:46:36.623 [Cloud] Queued cloud request. 2026-09-15T16:46:36.623 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:46:36.779 [Cloud] Dequeued cloud request. 2026-09-15T16:46:36.779 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:46:36.998 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3D84A964-8411-C2C5-FCC9-1AD2E20C44CE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 16:46:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T16:46:37.498 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:48:15.609 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:48:15.609 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:48:15.609 [Cloud] Queued cloud request. 2026-09-15T16:48:15.609 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:48:15.609 [Cloud] Dequeued cloud request. 2026-09-15T16:48:15.609 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:48:15.796 [Cloud] End of cloud request. 2026-09-15T16:48:16.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:52:41.078 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:52:41.078 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:52:41.078 [Cloud] Queued cloud request. 2026-09-15T16:52:41.078 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:52:41.078 [Cloud] Dequeued cloud request. 2026-09-15T16:52:41.078 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:52:41.265 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A15A2137-5E41-4155-6609-D942DBF3224B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 16:52:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T16:52:41.781 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:53:37.703 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T16:53:37.703 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T16:53:37.703 [Cloud] Queued cloud request. 2026-09-15T16:53:37.703 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T16:53:37.703 [Cloud] Dequeued cloud request. 2026-09-15T16:53:37.703 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T16:53:38.047 [Cloud] End of cloud request. 2026-09-15T16:53:38.547 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T16:57:57.926 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T17:09:46.650 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T17:09:46.650 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T17:09:46.650 [Cloud] Queued cloud request. 2026-09-15T17:09:46.650 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T17:09:46.650 [Cloud] Dequeued cloud request. 2026-09-15T17:09:46.650 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T17:09:46.963 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D4830D36-C490-16F1-6D43-6B3529403627} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 17:09:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T17:09:47.463 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T17:13:02.933 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T17:15:21.637 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T17:15:21.637 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T17:15:21.637 [Cloud] Queued cloud request. 2026-09-15T17:15:21.637 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T17:15:21.637 [Cloud] Dequeued cloud request. 2026-09-15T17:15:21.637 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T17:15:21.872 [Cloud] End of cloud request. 2026-09-15T17:15:22.372 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T17:28:07.941 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T17:28:35.316 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T17:28:35.316 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T17:28:35.316 [Cloud] Queued cloud request. 2026-09-15T17:28:35.316 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T17:28:35.316 [Cloud] Dequeued cloud request. 2026-09-15T17:28:35.316 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T17:28:35.535 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0C294544-13C0-D0FF-9017-3D130E1E2414} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 17:28:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T17:28:36.051 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T17:28:53.582 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 34541, Count: 2148, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-15T17:28:53.582 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 34383, Count: 1710, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-15T17:28:53.582 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 7132, Count: 297, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-15T17:28:53.582 ProcessImageName: powershell.exe, Pid: 3540, TotalTime: 1804, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 39% 2026-09-15T17:28:53.582 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1178, Count: 57, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-15T17:28:53.582 ProcessImageName: AgentShellService.exe, Pid: 5036, TotalTime: 792, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-15T17:28:53.582 ProcessImageName: WmiPrvSE.exe, Pid: 6092, TotalTime: 736, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-15T17:28:53.582 ProcessImageName: powershell.exe, Pid: 1960, TotalTime: 308, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 59% 2026-09-15T17:28:53.582 ProcessImageName: WmiPrvSE.exe, Pid: 1948, TotalTime: 286, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-15T17:28:53.582 ProcessImageName: WmiPrvSE.exe, Pid: 7368, TotalTime: 248, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-15T17:28:53.582 ProcessImageName: python.exe, Pid: 8152, TotalTime: 212, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 7% 2026-09-15T17:28:53.582 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 139, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-15T17:28:53.582 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 137, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-15T17:28:53.582 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 122, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-15T17:28:53.582 ProcessImageName: taskhostw.exe, Pid: 3172, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 9% 2026-09-15T17:28:53.582 ProcessImageName: taskhostw.exe, Pid: 3436, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-15T17:28:53.582 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-151c6-2.MAI, EstimatedImpact: 0% 2026-09-15T17:28:53.582 ProcessImageName: DeviceCensus.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 6% 2026-09-15T17:28:53.582 ProcessImageName: powershell.exe, Pid: 6496, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rwprwnp5.upt.psm1, EstimatedImpact: 0% 2026-09-15T17:28:53.582 ProcessImageName: cmd.exe, Pid: 848, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-15T17:28:53.582 ProcessImageName: mysqldump.exe, Pid: 5888, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-15T17:28:53.582 ProcessImageName: taskhostw.exe, Pid: 6236, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-15T17:28:53.582 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-15T17:28:53.582 ProcessImageName: ngentask.exe, Pid: 8092, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-15T17:29:34.911 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T17:29:34.911 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T17:29:34.911 [Cloud] Queued cloud request. 2026-09-15T17:29:34.911 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T17:29:34.911 [Cloud] Dequeued cloud request. 2026-09-15T17:29:34.911 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T17:29:34.989 [Cloud] End of cloud request. 2026-09-15T17:29:35.504 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T17:32:49.739 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T17:32:49.755 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T17:32:49.755 [Cloud] Queued cloud request. 2026-09-15T17:32:49.755 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T17:32:49.927 [Cloud] Dequeued cloud request. 2026-09-15T17:32:50.177 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T17:32:50.349 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6C87BCDF-B706-99B7-46F4-22EDF593C128} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 17:32:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T17:32:50.849 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T17:35:44.536 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T17:35:44.536 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T17:35:44.536 [Cloud] Queued cloud request. 2026-09-15T17:35:44.536 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T17:35:44.536 [Cloud] Dequeued cloud request. 2026-09-15T17:35:44.536 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T17:35:44.708 [Cloud] End of cloud request. 2026-09-15T17:35:45.208 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T17:40:12.290 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T17:40:12.290 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T17:40:12.290 [Cloud] Queued cloud request. 2026-09-15T17:40:12.290 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T17:40:12.290 [Cloud] Dequeued cloud request. 2026-09-15T17:40:12.290 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T17:40:12.478 [Cloud] End of cloud request. 2026-09-15T17:40:12.978 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T17:41:20.900 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T17:41:20.900 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T17:41:20.900 [Cloud] Queued cloud request. 2026-09-15T17:41:20.900 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T17:41:20.900 [Cloud] Dequeued cloud request. 2026-09-15T17:41:20.900 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T17:41:21.087 [Cloud] End of cloud request. 2026-09-15T17:41:21.587 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T17:43:12.947 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T17:49:39.764 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T17:49:39.764 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T17:49:39.764 [Cloud] Queued cloud request. 2026-09-15T17:49:39.764 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T17:49:39.764 [Cloud] Dequeued cloud request. 2026-09-15T17:49:39.779 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T17:49:39.967 [Cloud] End of cloud request. 2026-09-15T17:49:40.483 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T17:51:14.936 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T17:51:14.936 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T17:51:14.936 [Cloud] Queued cloud request. 2026-09-15T17:51:14.936 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T17:51:14.936 [Cloud] Dequeued cloud request. 2026-09-15T17:51:14.936 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T17:51:15.092 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B341C84A-9044-685C-D556-0ACAA21B9FBC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 17:51:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T17:51:15.592 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T17:58:17.956 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T18:00:23.753 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:00:23.753 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:00:23.753 [Cloud] Queued cloud request. 2026-09-15T18:00:23.753 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:00:23.753 [Cloud] Dequeued cloud request. 2026-09-15T18:00:23.753 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:00:23.941 [Cloud] End of cloud request. 2026-09-15T18:00:24.456 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:01:43.175 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:01:43.175 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:01:43.175 [Cloud] Queued cloud request. 2026-09-15T18:01:43.175 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:01:43.175 [Cloud] Dequeued cloud request. 2026-09-15T18:01:43.175 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:01:43.503 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2B31BE32-09DF-99F7-F98F-CC00B5D7FC3B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 18:01:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T18:01:43.503 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:01:43.503 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:01:43.503 [Cloud] Queued cloud request. 2026-09-15T18:01:43.503 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:01:43.503 [Cloud] Dequeued cloud request. 2026-09-15T18:01:43.503 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:01:43.581 [Cloud] End of cloud request. 2026-09-15T18:01:44.019 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:07:18.241 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:07:18.241 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:07:18.241 [Cloud] Queued cloud request. 2026-09-15T18:07:18.241 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:07:18.241 [Cloud] Dequeued cloud request. 2026-09-15T18:07:18.241 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:07:28.414 [Cloud] End of cloud request. 2026-09-15T18:07:28.914 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:09:20.009 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:09:20.009 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:09:20.009 [Cloud] Queued cloud request. 2026-09-15T18:09:20.009 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:09:20.009 [Cloud] Dequeued cloud request. 2026-09-15T18:09:20.009 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:09:23.696 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{200D67AA-4976-8C28-2061-D4691ADB127B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 18:09:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T18:09:24.196 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:13:22.962 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T18:13:30.134 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:13:30.134 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:13:30.134 [Cloud] Queued cloud request. 2026-09-15T18:13:30.134 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:13:30.134 [Cloud] Dequeued cloud request. 2026-09-15T18:13:30.134 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:13:30.321 [Cloud] End of cloud request. 2026-09-15T18:13:30.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:15:05.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:15:05.337 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:15:05.337 [Cloud] Queued cloud request. 2026-09-15T18:15:05.337 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:15:05.337 [Cloud] Dequeued cloud request. 2026-09-15T18:15:05.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:15:05.837 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{65AF0142-9EDA-4863-9263-7A54227EC2BD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 18:15:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T18:15:06.337 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:21:28.982 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:21:28.982 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:21:28.982 [Cloud] Queued cloud request. 2026-09-15T18:21:28.982 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:21:28.982 [Cloud] Dequeued cloud request. 2026-09-15T18:21:28.982 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:21:29.123 [Cloud] End of cloud request. 2026-09-15T18:21:29.638 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:24:01.750 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:24:01.750 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:24:01.750 [Cloud] Queued cloud request. 2026-09-15T18:24:01.750 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:24:01.750 [Cloud] Dequeued cloud request. 2026-09-15T18:24:01.750 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:24:01.937 [Cloud] End of cloud request. 2026-09-15T18:24:02.437 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:28:27.972 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T18:33:57.409 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:33:57.409 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:33:57.409 [Cloud] Queued cloud request. 2026-09-15T18:33:57.409 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:33:57.409 [Cloud] Dequeued cloud request. 2026-09-15T18:33:57.409 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:33:57.628 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{166D56A6-F3DA-2C30-8ABD-E8DC88739F01} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 18:33:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T18:33:58.128 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:40:00.930 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:40:00.930 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:40:00.930 [Cloud] Queued cloud request. 2026-09-15T18:40:00.930 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:40:00.930 [Cloud] Dequeued cloud request. 2026-09-15T18:40:00.930 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:40:01.087 [Cloud] End of cloud request. 2026-09-15T18:40:01.587 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:41:35.384 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:41:35.384 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:41:35.384 [Cloud] Queued cloud request. 2026-09-15T18:41:35.384 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:41:35.384 [Cloud] Dequeued cloud request. 2026-09-15T18:41:35.384 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:41:35.524 [Cloud] End of cloud request. 2026-09-15T18:41:36.040 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:43:32.979 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T18:47:07.541 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:47:07.541 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:47:07.541 [Cloud] Queued cloud request. 2026-09-15T18:47:07.541 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:47:07.698 [Cloud] Dequeued cloud request. 2026-09-15T18:47:07.698 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:47:07.885 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{686ADB84-D71B-C7FF-DB3A-FD86E3B22026} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 18:47:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T18:47:08.385 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:47:10.745 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:47:10.745 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:47:10.745 [Cloud] Queued cloud request. 2026-09-15T18:47:10.745 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:47:10.745 [Cloud] Dequeued cloud request. 2026-09-15T18:47:10.745 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:47:10.823 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E3462C2A-126F-3D8C-B8D7-F5A85DC9F365} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 18:47:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T18:47:11.338 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:52:22.388 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:52:22.388 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:52:22.388 [Cloud] Queued cloud request. 2026-09-15T18:52:22.388 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:52:22.591 [Cloud] Dequeued cloud request. 2026-09-15T18:52:22.748 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:52:22.935 [Cloud] End of cloud request. 2026-09-15T18:52:23.435 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:56:29.798 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T18:56:29.798 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T18:56:29.798 [Cloud] Queued cloud request. 2026-09-15T18:56:29.798 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T18:56:29.798 [Cloud] Dequeued cloud request. 2026-09-15T18:56:29.798 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T18:56:29.986 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{172C72A9-DFCB-E578-E49F-757150CA650B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 18:56:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T18:56:30.501 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T18:58:37.987 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T19:02:00.019 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:02:00.019 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:02:00.019 [Cloud] Queued cloud request. 2026-09-15T19:02:00.019 [Cloud] Dequeued cloud request. 2026-09-15T19:02:00.019 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:02:00.019 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:02:00.331 [Cloud] End of cloud request. 2026-09-15T19:02:00.847 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:04:01.019 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:04:01.019 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:04:01.019 [Cloud] Queued cloud request. 2026-09-15T19:04:01.019 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:04:01.019 [Cloud] Dequeued cloud request. 2026-09-15T19:04:01.019 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:04:01.331 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4A0A6FE4-B980-2EF7-1346-EE46231F1D37} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 19:04:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T19:04:01.831 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:04:28.222 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:04:28.222 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:04:28.222 [Cloud] Queued cloud request. 2026-09-15T19:04:28.222 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:04:28.222 [Cloud] Dequeued cloud request. 2026-09-15T19:04:28.222 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:04:38.253 [Cloud] End of cloud request. 2026-09-15T19:04:38.753 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:13:42.994 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T19:13:53.744 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:13:53.744 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:13:53.744 [Cloud] Queued cloud request. 2026-09-15T19:13:53.744 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:13:53.744 [Cloud] Dequeued cloud request. 2026-09-15T19:13:53.744 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:14:03.057 [Cloud] End of cloud request. 2026-09-15T19:14:03.557 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:17:39.168 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:17:39.168 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:17:39.168 [Cloud] Queued cloud request. 2026-09-15T19:17:39.168 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:17:39.168 [Cloud] Dequeued cloud request. 2026-09-15T19:17:39.168 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:17:39.325 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D13007D3-C6E4-5543-725C-DF59E39DEFA4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 19:17:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T19:17:39.825 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:25:17.219 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:25:17.219 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:25:17.219 [Cloud] Queued cloud request. 2026-09-15T19:25:17.219 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:25:17.219 [Cloud] Dequeued cloud request. 2026-09-15T19:25:17.219 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:25:17.437 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{47318A74-A4C7-2A99-80DD-F69871505976} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 19:25:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T19:25:17.937 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:25:50.015 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:25:50.015 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:25:50.015 [Cloud] Queued cloud request. 2026-09-15T19:25:50.015 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:25:50.015 [Cloud] Dequeued cloud request. 2026-09-15T19:25:50.015 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:25:50.094 [Cloud] End of cloud request. 2026-09-15T19:25:50.609 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:27:19.891 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:27:19.891 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:27:19.891 [Cloud] Queued cloud request. 2026-09-15T19:27:19.891 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:27:19.891 [Cloud] Dequeued cloud request. 2026-09-15T19:27:19.891 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:27:20.079 [Cloud] End of cloud request. 2026-09-15T19:27:20.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:28:18.002 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-15T19:28:18.033 Job Notification: New process added to job (1164) 2026-09-15T19:28:18.033 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-15T19:28:18.033 Aggressive catchup quick scan threshold: 692447408988 / 25920000000000 2026-09-15T19:28:18.033 Job Notification: New process added to job (492) 2026-09-15T19:28:18.049 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:1164] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:492]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-15T19:28:18.158 Job Notification: New process added to job (3648) 2026-09-15T19:28:18.174 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-15T19:28:18.174 Job Notification: New process added to job (3712) 2026-09-15T19:28:18.224 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:3648] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:3712]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-15T19:28:18.362 Job Notification: New process added to job (8176) 2026-09-15T19:28:18.424 Task(GetDeviceTicket -AccessKey 22BC1E2B-2AFB-DFE9-A686-6CF768FB99B9 ) launched as network service 2026-09-15T19:28:18.533 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-15T19:28:18.533 [RTP] Duplicating the current plugin configuration object... 2026-09-15T19:28:18.533 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-15T19:28:18.533 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-15T19:28:18.533 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-15T19:28:18.533 [RTP] No config change detected. Not updating plugin configuration. 2026-09-15T19:28:18.533 [RTP] No config changes found. No configuration switch. 2026-09-15T19:28:18.533 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-15T19:28:19.002 Job Notification: Process exited from job (8176) 2026-09-15T19:28:19.174 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-15T19:28:19.174 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:28:19.174 [Cloud] Queued cloud request. 2026-09-15T19:28:19.174 [Cloud] Dequeued cloud request. 2026-09-15T19:28:19.174 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:28:19.221 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-15T19:28:19.237 [Cloud] End of cloud request. 2026-09-15T19:28:19.690 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:28:30.518 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\E87796BA-3660-45FF-AA3E-EF546B61E94C1738.1dd454862a0d734 2026-09-15T19:28:30.596 Verifying engine and signature files (source: 0) ... 2026-09-15T19:28:30.596 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D}\mpengine.dll] due to PPL. 2026-09-15T19:28:30.596 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D}\mpasbase.vdm]. File not in cache (0x1) 2026-09-15T19:28:31.627 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D}\mpasbase.vdm] 2026-09-15T19:28:31.627 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-15T19:28:31.643 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D}\mpasdlta.vdm] 2026-09-15T19:28:31.643 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D}\mpavbase.vdm]. File not in cache (0x1) 2026-09-15T19:28:32.080 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D}\mpavbase.vdm] 2026-09-15T19:28:32.080 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-15T19:28:32.096 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D}\mpavdlta.vdm] 2026-09-15T19:28:32.283 [Engine] IsHybridMode: 0 2026-09-15T19:28:32.283 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-15T19:28:32.283 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FEEFF375E9D47059FB301D40276A0E610F7D36A.bin): 0x00000002 2026-09-15T19:28:32.299 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FEEFF375E9D47059FB301D40276A0E610F7D36A.bin) 2026-09-15T19:28:32.299 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-15T19:28:32.299 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-15T19:28:32.299 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-15T19:28:32.299 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-15T19:28:44.440 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-15T19:28:44.456 [AutoExclusion] Applied roles from cache. 2026-09-15T19:28:44.456 [AutoExclusion] Started roles monitoring. 2026-09-15T19:28:44.565 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF4ABB020, lRefCount: 6, hr=0 2026-09-15T19:28:44.565 [Engine] New active engine 00007FFCF68AB020 replacing engine 00007FFCF4ABB020. Number of active engines: 2 2026-09-15T19:28:44.581 EngineInit:Global ASOC is enabled 2026-09-15T19:28:44.581 EngineInit:ASOO is enabled for developer volumes 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.659 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-15T19:28:44.690 MpWriteUupSignatureVersion 1.459.225.0, hr = 0 2026-09-15T19:28:44.690 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-15T19:28:44.721 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-15T19:28:44.737 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-15T19:28:44.737 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-15T19:28:44.737 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-15T19:28:44.752 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-15T19:28:44.752 [Plugin] Initializing RTP plugin state... 2026-09-15T19:28:44.752 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-15T19:28:44.752 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎14‎-‎2026 21:28:53 Last Perf:‎09‎-‎14‎-‎2026 21:28:53 First RTP Scan:‎09‎-‎14‎-‎2026 21:28:53 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1432 Misses:7505 BM Queue:0,78,0 Proc:0,38,0 File:0,78,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:6336768 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:-1168204818 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:15578 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:800694 TotalHits:23070776 InstanceCacheInserts:453615 InstanceCacheUpdates:0 InstanceCacheDeletes:68965 InstanceCacheHits:16905 InstanceCacheMisses:814508 InstanceCacheOverflows:367691 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:5ms (8466/1483) Success: 1483, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-15T19:28:44.752 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D} 2026-09-15T19:28:44.752 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1}\mpasbase.vdm in use, hr=0x80070020 2026-09-15T19:28:44.752 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-15T19:28:44.752 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DD27423-7B14-4448-A454-BEDE60FA916D} removed 2026-09-15T19:28:44.752 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-15T19:28:44.752 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-15T19:28:44.752 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-15T19:28:44.752 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-15T19:28:44.752 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-15-2026 19:28:44 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-15-2026 19:28:44 2026-09-15T19:28:44.752 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-15T19:28:44.752 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-15T19:28:44.752 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-15T19:28:44.752 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-15T19:28:44.768 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:28:44.768 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-15T19:28:44.768 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-15T19:28:44.768 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-15T19:28:44.768 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-15T19:28:44.768 MdCoreSvc is supported in this platform and OS Signature updated on 09-15-2026 19:28:44 Product Version: 4.18.26080.3 Service Version: 4.18.26080.3 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.225.0 AV Signature Version: 1.459.225.0 ************************************************************ 2026-09-15T19:28:44.768 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-15T19:28:44.768 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\E87796BA-3660-45FF-AA3E-EF546B61E94C1738.1dd454862a0d734 2026-09-15T19:28:44.815 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-15T19:28:44.815 Process scan (postsignatureupdatescan) started. 2026-09-15T19:28:44.815 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-15-2026 19:28:44 ************************************************************ 2026-09-15T19:28:44.971 Job Notification: Process exited from job (3648) 2026-09-15T19:28:44.971 Job Notification: Process exited from job (3712) 2026-09-15T19:28:44.987 Job Notification: Process exited from job (1164) 2026-09-15T19:28:45.002 Job Notification: Process exited from job (492) 2026-09-15T19:28:45.081 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-15T19:28:45.081 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-15T19:28:45.081 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-15T19:28:45.081 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-15T19:28:45.081 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-15T19:28:45.096 [Engine] Engine 00007FFCF4ABB020 no longer in use. Number of active engines: 1 2026-09-15T19:28:45.096 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-15T19:28:45.096 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-15T19:28:45.224 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-15T19:28:45.224 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-15T19:28:45.224 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-15T19:28:45.627 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 36726, Count: 1882, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-15T19:28:45.627 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 35069, Count: 2196, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-15T19:28:45.627 ProcessImageName: AgentShell.exe, Pid: 7888, TotalTime: 7132, Count: 297, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-15T19:28:45.627 ProcessImageName: powershell.exe, Pid: 3540, TotalTime: 1804, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 39% 2026-09-15T19:28:45.627 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1301, Count: 65, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-15T19:28:45.627 ProcessImageName: AgentShellService.exe, Pid: 5036, TotalTime: 792, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-15T19:28:45.627 ProcessImageName: WmiPrvSE.exe, Pid: 6092, TotalTime: 736, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-15T19:28:45.627 ProcessImageName: powershell.exe, Pid: 1960, TotalTime: 308, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 59% 2026-09-15T19:28:45.627 ProcessImageName: WmiPrvSE.exe, Pid: 1948, TotalTime: 286, Count: 32, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-15T19:28:45.627 ProcessImageName: WmiPrvSE.exe, Pid: 7368, TotalTime: 248, Count: 5, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-15T19:28:45.627 ProcessImageName: python.exe, Pid: 8152, TotalTime: 212, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 7% 2026-09-15T19:28:45.627 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 152, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-15T19:28:45.627 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 139, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-15T19:28:45.627 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 122, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\POSTOFFICE.TAB, EstimatedImpact: 0% 2026-09-15T19:28:45.690 [Engine] RSIG_UNLOADENGINE, 00007FFCF4ABB020, err=0x0 2026-09-15T19:28:45.737 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{34FF622A-1F23-4A43-9C69-0FF9DF7794A1} removed 2026-09-15T19:28:48.003 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T19:28:59.456 Process scan (postsignatureupdatescan) completed. 2026-09-15T19:33:44.628 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-15T19:34:22.018 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:34:22.018 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:34:22.018 [Cloud] Queued cloud request. 2026-09-15T19:34:22.018 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:34:22.018 [Cloud] Dequeued cloud request. 2026-09-15T19:34:22.018 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:34:22.206 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B9FF9BE7-1A8E-2A6E-ECB7-83CA21AAA540} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 19:34:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T19:34:22.706 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:41:24.398 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:41:24.398 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:41:24.398 [Cloud] Queued cloud request. 2026-09-15T19:41:24.398 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:41:24.398 [Cloud] Dequeued cloud request. 2026-09-15T19:41:24.398 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:41:24.554 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{18042F6A-EE5C-B8C7-BA25-521209923BDA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 19:41:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T19:41:25.054 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:43:53.007 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T19:45:28.494 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:45:28.494 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:45:28.494 [Cloud] Queued cloud request. 2026-09-15T19:45:28.494 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:45:28.494 [Cloud] Dequeued cloud request. 2026-09-15T19:45:28.494 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{F035EF47-0104-0C10-B160-4205642246CB} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 19:45:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T19:45:38.588 [Cloud] End of cloud request. 2026-09-15T19:45:39.104 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:49:36.857 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:49:36.857 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:49:36.857 [Cloud] Queued cloud request. 2026-09-15T19:49:36.857 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:49:36.857 [Cloud] Dequeued cloud request. 2026-09-15T19:49:36.857 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:49:36.997 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{81B1ECA0-85A3-7760-B1E6-1F522C7153FD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 19:49:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T19:49:37.497 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:55:39.093 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:55:39.093 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:55:39.093 [Cloud] Queued cloud request. 2026-09-15T19:55:39.093 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:55:39.093 [Cloud] Dequeued cloud request. 2026-09-15T19:55:39.093 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:55:39.250 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D7B2E123-1A41-863C-BBDE-4CF6D9D27360} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 19:55:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T19:55:39.750 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:56:40.704 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:56:40.704 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:56:40.704 [Cloud] Queued cloud request. 2026-09-15T19:56:40.704 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:56:40.704 [Cloud] Dequeued cloud request. 2026-09-15T19:56:40.704 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:56:40.875 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{31B51196-66AD-1149-42AE-B4F34E512475} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 19:56:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T19:56:41.375 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:56:50.454 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:56:50.454 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:56:50.454 [Cloud] Queued cloud request. 2026-09-15T19:56:50.454 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:56:50.454 [Cloud] Dequeued cloud request. 2026-09-15T19:56:50.454 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:56:50.532 [Cloud] End of cloud request. 2026-09-15T19:56:50.532 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:56:50.532 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:56:50.532 [Cloud] Queued cloud request. 2026-09-15T19:56:50.532 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:56:50.532 [Cloud] Dequeued cloud request. 2026-09-15T19:56:50.532 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:56:50.610 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{698F35BD-0F6A-B6B9-FD74-01501DD9BA5E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 19:56:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T19:56:51.047 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:58:26.064 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T19:58:26.064 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T19:58:26.064 [Cloud] Queued cloud request. 2026-09-15T19:58:26.064 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T19:58:26.064 [Cloud] Dequeued cloud request. 2026-09-15T19:58:26.064 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T19:58:26.205 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AB4D328A-7DF4-D80C-D28C-C5F855A1C47C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 19:58:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T19:58:26.721 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T19:58:58.018 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T20:01:48.518 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T20:01:48.518 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T20:01:48.518 [Cloud] Queued cloud request. 2026-09-15T20:01:48.518 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T20:01:48.518 [Cloud] Dequeued cloud request. 2026-09-15T20:01:48.518 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T20:01:48.815 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{835BBD10-8434-7599-EC19-FE20C38054BF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 20:01:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T20:01:49.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T20:14:03.025 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T20:19:46.575 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T20:19:46.575 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T20:19:46.575 [Cloud] Queued cloud request. 2026-09-15T20:19:46.575 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T20:19:46.575 [Cloud] Dequeued cloud request. 2026-09-15T20:19:46.575 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T20:19:48.246 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DF76FB43-96BB-4C40-833F-CB2B14F828E5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 20:19:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T20:19:48.746 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T20:21:55.325 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T20:21:55.325 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T20:21:55.325 [Cloud] Queued cloud request. 2026-09-15T20:21:55.325 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T20:21:55.325 [Cloud] Dequeued cloud request. 2026-09-15T20:21:55.325 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T20:21:55.481 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0C35FB75-2CC5-11A0-97D3-7046824E646C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 20:21:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T20:21:55.981 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T20:22:27.887 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T20:22:27.887 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T20:22:27.887 [Cloud] Queued cloud request. 2026-09-15T20:22:27.887 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T20:22:27.887 [Cloud] Dequeued cloud request. 2026-09-15T20:22:27.887 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T20:22:29.543 [Cloud] End of cloud request. 2026-09-15T20:22:30.059 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T20:29:08.033 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T20:29:08.783 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T20:29:08.783 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T20:29:08.783 [Cloud] Queued cloud request. 2026-09-15T20:29:08.783 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T20:29:08.783 [Cloud] Dequeued cloud request. 2026-09-15T20:29:08.783 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T20:29:11.580 [Cloud] End of cloud request. 2026-09-15T20:29:12.080 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T20:32:32.736 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T20:32:32.736 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T20:32:32.736 [Cloud] Queued cloud request. 2026-09-15T20:32:32.736 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T20:32:32.736 [Cloud] Dequeued cloud request. 2026-09-15T20:32:32.736 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T20:32:32.876 [Cloud] End of cloud request. 2026-09-15T20:32:33.392 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T20:35:44.316 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T20:35:44.316 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T20:35:44.316 [Cloud] Queued cloud request. 2026-09-15T20:35:44.316 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T20:35:44.316 [Cloud] Dequeued cloud request. 2026-09-15T20:35:44.316 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T20:35:44.488 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{327B547A-5AB8-2DD6-C047-8F6CF04C8D46} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 20:35:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T20:35:44.988 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T20:41:42.460 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T20:41:42.460 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T20:41:42.460 [Cloud] Queued cloud request. 2026-09-15T20:41:42.460 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T20:41:42.460 [Cloud] Dequeued cloud request. 2026-09-15T20:41:42.460 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T20:41:42.679 [Cloud] End of cloud request. 2026-09-15T20:41:43.179 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T20:44:13.038 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T20:46:41.838 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T20:46:41.838 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T20:46:41.838 [Cloud] Queued cloud request. 2026-09-15T20:46:41.838 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T20:46:41.838 [Cloud] Dequeued cloud request. 2026-09-15T20:46:41.838 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T20:46:51.917 [Cloud] End of cloud request. 2026-09-15T20:46:52.432 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T20:49:39.199 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T20:49:39.199 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T20:49:39.199 [Cloud] Queued cloud request. 2026-09-15T20:49:39.199 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T20:49:39.199 [Cloud] Dequeued cloud request. 2026-09-15T20:49:39.199 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T20:49:39.386 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{61CE14FD-CC6E-B651-AAFB-BD4F6B875AE1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 20:49:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T20:49:39.902 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T20:57:16.468 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T20:57:16.468 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T20:57:16.468 [Cloud] Queued cloud request. 2026-09-15T20:57:16.468 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T20:57:16.468 [Cloud] Dequeued cloud request. 2026-09-15T20:57:16.468 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T20:57:16.609 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A8D470C8-E47D-0426-6A3A-1C7EB383F113} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 20:57:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T20:57:17.109 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T20:59:18.048 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T21:00:49.438 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:00:49.438 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:00:49.438 [Cloud] Queued cloud request. 2026-09-15T21:00:49.438 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:00:49.438 [Cloud] Dequeued cloud request. 2026-09-15T21:00:49.438 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:00:49.579 [Cloud] End of cloud request. 2026-09-15T21:00:50.079 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:02:02.907 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:02:02.907 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:02:02.907 [Cloud] Queued cloud request. 2026-09-15T21:02:02.907 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:02:02.907 [Cloud] Dequeued cloud request. 2026-09-15T21:02:02.907 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:02:03.063 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9D98D271-4C14-3E15-A366-84E00E364A99} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 21:02:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T21:02:03.563 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:08:33.084 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:08:33.084 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:08:33.084 [Cloud] Queued cloud request. 2026-09-15T21:08:33.084 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:08:33.084 [Cloud] Dequeued cloud request. 2026-09-15T21:08:33.084 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:08:33.287 [Cloud] End of cloud request. 2026-09-15T21:08:33.787 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:14:23.055 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T21:15:38.743 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:15:38.743 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:15:38.743 [Cloud] Queued cloud request. 2026-09-15T21:15:38.743 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:15:38.899 [Cloud] Dequeued cloud request. 2026-09-15T21:15:39.086 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:15:39.258 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3747676F-494A-CF51-322C-CAD95816F025} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 21:15:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T21:15:39.758 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:18:40.902 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:18:40.902 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:18:40.902 [Cloud] Queued cloud request. 2026-09-15T21:18:40.902 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:18:41.121 [Cloud] Dequeued cloud request. 2026-09-15T21:18:41.121 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:18:41.277 [Cloud] End of cloud request. 2026-09-15T21:18:41.793 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:19:09.402 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:19:09.402 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:19:09.402 [Cloud] Queued cloud request. 2026-09-15T21:19:09.402 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:19:09.402 [Cloud] Dequeued cloud request. 2026-09-15T21:19:09.402 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:19:09.480 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B5F5D0E2-64EF-10AB-B63D-CDA3FF3F8719} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 21:19:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T21:19:09.980 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:22:05.777 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:22:05.777 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:22:05.777 [Cloud] Queued cloud request. 2026-09-15T21:22:05.777 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:22:05.777 [Cloud] Dequeued cloud request. 2026-09-15T21:22:05.777 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:22:05.934 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CAB455EE-C44B-50CB-579C-40B704FCB2D3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 21:22:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T21:22:06.434 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:23:23.482 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:23:23.482 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:23:23.482 [Cloud] Queued cloud request. 2026-09-15T21:23:23.482 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:23:23.482 [Cloud] Dequeued cloud request. 2026-09-15T21:23:23.482 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:23:23.622 [Cloud] End of cloud request. 2026-09-15T21:23:24.122 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:23:41.310 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:23:41.310 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:23:41.310 [Cloud] Queued cloud request. 2026-09-15T21:23:41.310 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:23:41.310 [Cloud] Dequeued cloud request. 2026-09-15T21:23:41.310 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:23:41.388 [Cloud] End of cloud request. 2026-09-15T21:23:41.888 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:24:41.295 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:24:41.295 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:24:41.295 [Cloud] Queued cloud request. 2026-09-15T21:24:41.295 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:24:41.295 [Cloud] Dequeued cloud request. 2026-09-15T21:24:41.295 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:24:41.373 [Cloud] End of cloud request. 2026-09-15T21:24:41.873 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:28:33.032 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:28:33.032 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:28:33.032 [Cloud] Queued cloud request. 2026-09-15T21:28:33.032 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:28:33.032 [Cloud] Dequeued cloud request. 2026-09-15T21:28:33.032 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:28:33.172 [Cloud] End of cloud request. 2026-09-15T21:28:33.672 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:28:44.626 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 3290, Count: 229, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\index.html, EstimatedImpact: 0% 2026-09-15T21:28:44.626 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 2166, Count: 176, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-15T21:28:44.626 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-15T21:28:44.626 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-15T21:28:44.626 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-15T21:28:44.626 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-15T21:28:44.626 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-15T21:28:44.626 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-15T21:28:44.626 ProcessImageName: taskhostw.exe, Pid: 2100, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-15T21:28:52.407 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:28:52.407 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:28:52.407 [Cloud] Queued cloud request. 2026-09-15T21:28:52.407 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:28:52.407 [Cloud] Dequeued cloud request. 2026-09-15T21:28:52.407 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:28:52.501 [Cloud] End of cloud request. 2026-09-15T21:28:53.016 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:29:28.063 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T21:30:29.985 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:30:29.985 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:30:29.985 [Cloud] Queued cloud request. 2026-09-15T21:30:29.985 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:30:29.985 [Cloud] Dequeued cloud request. 2026-09-15T21:30:29.985 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:30:30.188 [Cloud] End of cloud request. 2026-09-15T21:30:30.704 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:32:15.501 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:32:15.501 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:32:15.501 [Cloud] Queued cloud request. 2026-09-15T21:32:15.501 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:32:15.501 [Cloud] Dequeued cloud request. 2026-09-15T21:32:15.501 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:32:15.688 [Cloud] End of cloud request. 2026-09-15T21:32:16.204 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:33:11.516 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:33:11.516 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:33:11.516 [Cloud] Queued cloud request. 2026-09-15T21:33:11.516 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:33:11.516 [Cloud] Dequeued cloud request. 2026-09-15T21:33:11.516 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:33:11.594 [Cloud] End of cloud request. 2026-09-15T21:33:12.110 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:36:10.473 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:36:10.473 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:36:10.473 [Cloud] Queued cloud request. 2026-09-15T21:36:10.473 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:36:10.473 [Cloud] Dequeued cloud request. 2026-09-15T21:36:10.473 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:36:10.645 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E67F4F88-0DAF-4D53-FEF2-80C8A2AC24C3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 21:36:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T21:36:11.160 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{B218390C-B34C-D196-9193-8BE15E352F02} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-15-2026 21:38:04 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T21:38:05.334 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:38:05.334 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:38:05.334 [Cloud] Queued cloud request. 2026-09-15T21:38:05.334 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:38:05.334 [Cloud] Dequeued cloud request. 2026-09-15T21:38:05.334 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:38:15.474 [Cloud] End of cloud request. 2026-09-15T21:38:15.974 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:38:51.818 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:38:51.818 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:38:51.818 [Cloud] Queued cloud request. 2026-09-15T21:38:51.818 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:38:51.818 [Cloud] Dequeued cloud request. 2026-09-15T21:38:51.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:38:51.928 [Cloud] End of cloud request. 2026-09-15T21:38:52.443 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:44:33.069 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T21:46:40.416 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:46:40.416 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:46:40.416 [Cloud] Queued cloud request. 2026-09-15T21:46:40.416 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:46:40.572 [Cloud] Dequeued cloud request. 2026-09-15T21:46:40.572 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:46:40.728 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AA4E6439-0F76-3B2C-8510-086AFAFA959B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 21:46:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T21:46:41.228 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:49:38.026 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:49:38.026 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:49:38.026 [Cloud] Queued cloud request. 2026-09-15T21:49:38.026 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:49:38.182 [Cloud] Dequeued cloud request. 2026-09-15T21:49:38.182 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:49:38.307 [Cloud] End of cloud request. 2026-09-15T21:49:38.823 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:50:03.620 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:50:03.620 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:50:03.620 [Cloud] Queued cloud request. 2026-09-15T21:50:03.620 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:50:03.620 [Cloud] Dequeued cloud request. 2026-09-15T21:50:03.620 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:50:03.698 [Cloud] End of cloud request. 2026-09-15T21:50:04.198 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:50:05.526 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:50:05.526 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:50:05.526 [Cloud] Queued cloud request. 2026-09-15T21:50:05.526 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:50:05.526 [Cloud] Dequeued cloud request. 2026-09-15T21:50:05.526 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:50:05.620 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{24EB1C2F-D4C1-A4FE-3772-61EC2A030078} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 21:50:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T21:50:06.136 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:54:18.841 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:54:18.841 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:54:18.841 [Cloud] Queued cloud request. 2026-09-15T21:54:18.841 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:54:18.841 [Cloud] Dequeued cloud request. 2026-09-15T21:54:18.841 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:54:18.982 [Cloud] End of cloud request. 2026-09-15T21:54:19.482 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:55:38.717 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:55:38.717 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:55:38.717 [Cloud] Queued cloud request. 2026-09-15T21:55:38.717 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:55:38.717 [Cloud] Dequeued cloud request. 2026-09-15T21:55:38.717 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:55:48.811 [Cloud] End of cloud request. 2026-09-15T21:55:49.311 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:56:15.514 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:56:15.514 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:56:15.514 [Cloud] Queued cloud request. 2026-09-15T21:56:15.514 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:56:15.514 [Cloud] Dequeued cloud request. 2026-09-15T21:56:15.514 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:56:15.593 [Cloud] End of cloud request. 2026-09-15T21:56:16.108 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:57:04.811 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:57:04.811 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:57:04.811 [Cloud] Queued cloud request. 2026-09-15T21:57:04.811 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:57:04.811 [Cloud] Dequeued cloud request. 2026-09-15T21:57:04.811 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:57:04.921 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C129D6BA-405B-2E03-69CD-CB43D85E2618} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 21:57:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T21:57:05.421 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:58:24.859 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:58:24.859 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:58:24.859 [Cloud] Queued cloud request. 2026-09-15T21:58:24.859 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:58:24.859 [Cloud] Dequeued cloud request. 2026-09-15T21:58:24.859 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:58:25.141 [Cloud] End of cloud request. 2026-09-15T21:58:25.641 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:58:47.016 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:58:47.016 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:58:47.016 [Cloud] Queued cloud request. 2026-09-15T21:58:47.016 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:58:47.016 [Cloud] Dequeued cloud request. 2026-09-15T21:58:47.016 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:58:55.594 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T21:58:55.594 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T21:58:55.594 [Cloud] Queued cloud request. 2026-09-15T21:58:55.594 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T21:58:55.594 [Cloud] Dequeued cloud request. 2026-09-15T21:58:55.594 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T21:58:55.844 [Cloud] End of cloud request. 2026-09-15T21:58:56.359 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:58:57.047 [Cloud] End of cloud request. 2026-09-15T21:58:57.547 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T21:59:38.078 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T22:01:26.141 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:01:26.141 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:01:26.141 [Cloud] Queued cloud request. 2026-09-15T22:01:26.141 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:01:26.141 [Cloud] Dequeued cloud request. 2026-09-15T22:01:26.141 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:01:26.328 [Cloud] End of cloud request. 2026-09-15T22:01:26.828 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:01:38.078 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:01:38.078 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:01:38.078 [Cloud] Queued cloud request. 2026-09-15T22:01:38.078 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:01:38.078 [Cloud] Dequeued cloud request. 2026-09-15T22:01:38.078 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:01:42.187 [Cloud] End of cloud request. 2026-09-15T22:01:42.703 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:04:38.987 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:04:38.987 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:04:38.987 [Cloud] Queued cloud request. 2026-09-15T22:04:38.987 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:04:38.987 [Cloud] Dequeued cloud request. 2026-09-15T22:04:38.987 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:04:39.174 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{18BB95FC-F33E-BF2B-9E64-2674D004C3E4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 22:04:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T22:04:39.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:06:35.863 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:06:35.863 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:06:35.863 [Cloud] Queued cloud request. 2026-09-15T22:06:35.863 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:06:35.863 [Cloud] Dequeued cloud request. 2026-09-15T22:06:35.863 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:06:36.035 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{623A96B1-EADB-1D51-09B0-56CCACBDEE29} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 22:06:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T22:06:36.535 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:08:11.942 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:08:11.942 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:08:11.942 [Cloud] Queued cloud request. 2026-09-15T22:08:11.942 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:08:11.942 [Cloud] Dequeued cloud request. 2026-09-15T22:08:11.942 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:08:12.130 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DADC1F1D-C363-EEA9-2660-E00F6B5BE249} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 22:08:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T22:08:12.630 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:13:27.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:13:27.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:13:27.304 [Cloud] Queued cloud request. 2026-09-15T22:13:27.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:13:27.304 [Cloud] Dequeued cloud request. 2026-09-15T22:13:27.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:13:27.460 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B6FD351E-7FA0-6082-EEE5-01E1524BCD8E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 22:13:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T22:13:27.960 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:13:36.351 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:13:36.351 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:13:36.351 [Cloud] Queued cloud request. 2026-09-15T22:13:36.351 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:13:36.351 [Cloud] Dequeued cloud request. 2026-09-15T22:13:36.351 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:13:36.429 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ED15B947-0AE3-201B-0074-F520C2A4E35F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 22:13:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T22:13:36.929 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:13:58.210 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:13:58.210 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:13:58.210 [Cloud] Queued cloud request. 2026-09-15T22:13:58.210 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:13:58.210 [Cloud] Dequeued cloud request. 2026-09-15T22:13:58.210 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:13:58.288 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E35141C-AC66-C4EC-28ED-A2FAE0D51C0E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 22:13:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T22:13:58.804 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:14:43.085 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T22:23:23.325 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:23:23.325 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:23:23.325 [Cloud] Queued cloud request. 2026-09-15T22:23:23.325 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:23:23.325 [Cloud] Dequeued cloud request. 2026-09-15T22:23:23.325 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:23:23.481 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{77A21FE1-8761-53C6-FB69-D4D586DE51D7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 22:23:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T22:23:23.981 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:24:57.294 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:24:57.294 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:24:57.294 [Cloud] Queued cloud request. 2026-09-15T22:24:57.294 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:24:57.294 [Cloud] Dequeued cloud request. 2026-09-15T22:24:57.294 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:24:57.450 [Cloud] End of cloud request. 2026-09-15T22:24:57.966 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:28:26.453 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:28:26.453 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:28:26.453 [Cloud] Queued cloud request. 2026-09-15T22:28:26.453 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:28:26.687 [Cloud] Dequeued cloud request. 2026-09-15T22:28:26.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:28:26.812 [Cloud] End of cloud request. 2026-09-15T22:28:27.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:29:48.094 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T22:29:55.844 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:29:55.844 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:29:55.844 [Cloud] Queued cloud request. 2026-09-15T22:29:55.844 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:29:55.844 [Cloud] Dequeued cloud request. 2026-09-15T22:29:55.844 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:29:55.985 [Cloud] End of cloud request. 2026-09-15T22:29:56.500 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:33:50.735 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:33:50.735 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:33:50.735 [Cloud] Queued cloud request. 2026-09-15T22:33:50.735 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:33:50.735 [Cloud] Dequeued cloud request. 2026-09-15T22:33:50.735 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:33:57.970 [Cloud] End of cloud request. 2026-09-15T22:33:58.485 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:36:25.190 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:36:25.190 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:36:25.190 [Cloud] Queued cloud request. 2026-09-15T22:36:25.190 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:36:25.394 [Cloud] Dequeued cloud request. 2026-09-15T22:36:25.394 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:36:25.550 [Cloud] End of cloud request. 2026-09-15T22:36:26.050 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:38:48.974 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:38:48.974 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:38:48.974 [Cloud] Queued cloud request. 2026-09-15T22:38:48.974 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:38:48.974 [Cloud] Dequeued cloud request. 2026-09-15T22:38:48.974 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:38:49.130 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EFF95EBD-4F12-1513-6B93-2FB0CAD12D3D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 22:38:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T22:38:49.630 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:39:59.505 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:39:59.505 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:39:59.505 [Cloud] Queued cloud request. 2026-09-15T22:39:59.505 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:39:59.505 [Cloud] Dequeued cloud request. 2026-09-15T22:39:59.505 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:39:59.661 [Cloud] End of cloud request. 2026-09-15T22:40:00.161 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:40:10.536 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:40:10.536 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:40:10.536 [Cloud] Queued cloud request. 2026-09-15T22:40:10.536 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:40:10.536 [Cloud] Dequeued cloud request. 2026-09-15T22:40:10.536 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:40:10.614 [Cloud] End of cloud request. 2026-09-15T22:40:11.130 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:41:54.880 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:41:54.880 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:41:54.880 [Cloud] Queued cloud request. 2026-09-15T22:41:54.880 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:41:54.880 [Cloud] Dequeued cloud request. 2026-09-15T22:41:54.880 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:41:55.021 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{07F430F2-429B-93DC-91D8-A85FB9228A09} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 22:41:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T22:41:55.536 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:43:15.489 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:43:15.489 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:43:15.489 [Cloud] Queued cloud request. 2026-09-15T22:43:15.489 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:43:15.489 [Cloud] Dequeued cloud request. 2026-09-15T22:43:15.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:43:15.646 [Cloud] End of cloud request. 2026-09-15T22:43:16.161 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:44:53.099 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T22:45:34.506 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:45:34.506 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:45:34.506 [Cloud] Queued cloud request. 2026-09-15T22:45:34.506 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:45:34.506 [Cloud] Dequeued cloud request. 2026-09-15T22:45:34.506 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:45:34.881 [Cloud] End of cloud request. 2026-09-15T22:45:35.381 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:45:59.147 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:45:59.147 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:45:59.147 [Cloud] Queued cloud request. 2026-09-15T22:45:59.147 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:45:59.147 [Cloud] Dequeued cloud request. 2026-09-15T22:45:59.147 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:45:59.225 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FA014989-342A-C24B-EA1A-CE31E2A9B878} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 22:45:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T22:45:59.740 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:46:10.850 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:46:10.850 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:46:10.850 [Cloud] Queued cloud request. 2026-09-15T22:46:10.850 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:46:10.850 [Cloud] Dequeued cloud request. 2026-09-15T22:46:10.850 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:46:10.928 [Cloud] End of cloud request. 2026-09-15T22:46:11.444 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:51:49.995 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:51:49.995 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:51:49.995 [Cloud] Queued cloud request. 2026-09-15T22:51:49.995 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:51:49.995 [Cloud] Dequeued cloud request. 2026-09-15T22:51:49.995 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:51:50.136 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{742A6DE1-F1C6-0F93-1775-0BC41E7FC6ED} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 22:51:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T22:51:50.651 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:52:40.901 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:52:40.901 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:52:40.901 [Cloud] Queued cloud request. 2026-09-15T22:52:40.901 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:52:40.901 [Cloud] Dequeued cloud request. 2026-09-15T22:52:40.901 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:52:40.979 [Cloud] End of cloud request. 2026-09-15T22:52:41.479 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:54:05.058 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:54:05.058 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:54:05.058 [Cloud] Queued cloud request. 2026-09-15T22:54:05.058 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:54:05.058 [Cloud] Dequeued cloud request. 2026-09-15T22:54:05.058 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:54:05.198 [Cloud] End of cloud request. 2026-09-15T22:54:05.714 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:54:36.120 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:54:36.120 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:54:36.120 [Cloud] Queued cloud request. 2026-09-15T22:54:36.120 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:54:36.276 [Cloud] Dequeued cloud request. 2026-09-15T22:54:36.276 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:54:36.355 [Cloud] End of cloud request. 2026-09-15T22:54:36.855 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:59:03.686 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T22:59:03.686 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T22:59:03.686 [Cloud] Queued cloud request. 2026-09-15T22:59:03.686 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T22:59:03.686 [Cloud] Dequeued cloud request. 2026-09-15T22:59:03.686 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T22:59:13.296 [Cloud] End of cloud request. 2026-09-15T22:59:13.796 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T22:59:58.108 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T23:00:08.952 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:00:08.952 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:00:08.952 [Cloud] Queued cloud request. 2026-09-15T23:00:08.952 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:00:08.952 [Cloud] Dequeued cloud request. 2026-09-15T23:00:08.952 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:00:09.046 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{34489371-309E-0BD4-8ABF-0E824E7C79EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 23:00:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T23:00:09.546 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:01:11.030 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:01:11.030 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:01:11.030 [Cloud] Queued cloud request. 2026-09-15T23:01:11.030 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:01:11.030 [Cloud] Dequeued cloud request. 2026-09-15T23:01:11.030 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:01:11.171 [Cloud] End of cloud request. 2026-09-15T23:01:11.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:02:48.811 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:02:48.811 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:02:48.811 [Cloud] Queued cloud request. 2026-09-15T23:02:48.811 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:02:48.811 [Cloud] Dequeued cloud request. 2026-09-15T23:02:48.811 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:02:48.968 [Cloud] End of cloud request. 2026-09-15T23:02:49.468 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:03:32.141 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:03:32.141 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:03:32.141 [Cloud] Queued cloud request. 2026-09-15T23:03:32.141 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:03:32.141 [Cloud] Dequeued cloud request. 2026-09-15T23:03:32.141 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:03:32.220 [Cloud] End of cloud request. 2026-09-15T23:03:32.720 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:04:52.939 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:04:52.939 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:04:52.939 [Cloud] Queued cloud request. 2026-09-15T23:04:52.939 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:04:52.939 [Cloud] Dequeued cloud request. 2026-09-15T23:04:52.939 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:04:53.095 [Cloud] End of cloud request. 2026-09-15T23:04:53.595 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:04:56.658 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:04:56.658 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:04:56.658 [Cloud] Queued cloud request. 2026-09-15T23:04:56.658 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:04:56.658 [Cloud] Dequeued cloud request. 2026-09-15T23:04:56.658 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:04:56.751 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{59C34882-62BC-D207-67B0-C431D588D5F9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 23:04:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T23:04:57.252 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:05:18.127 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:05:18.127 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:05:18.127 [Cloud] Queued cloud request. 2026-09-15T23:05:18.127 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:05:18.127 [Cloud] Dequeued cloud request. 2026-09-15T23:05:18.127 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:05:20.861 [Cloud] End of cloud request. 2026-09-15T23:05:21.361 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:06:44.705 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:06:44.705 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:06:44.705 [Cloud] Queued cloud request. 2026-09-15T23:06:44.705 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:06:44.705 [Cloud] Dequeued cloud request. 2026-09-15T23:06:44.705 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:06:44.861 [Cloud] End of cloud request. 2026-09-15T23:06:45.361 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:07:07.423 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:07:07.423 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:07:07.423 [Cloud] Queued cloud request. 2026-09-15T23:07:07.423 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:07:07.423 [Cloud] Dequeued cloud request. 2026-09-15T23:07:07.423 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:07:07.502 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8E8F2557-5737-2BF9-C736-0C2E50A3946E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 23:07:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T23:07:08.017 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:07:18.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:07:18.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:07:18.049 [Cloud] Queued cloud request. 2026-09-15T23:07:18.049 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:07:18.049 [Cloud] Dequeued cloud request. 2026-09-15T23:07:18.049 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:07:18.127 [Cloud] End of cloud request. 2026-09-15T23:07:18.627 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:09:14.785 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:09:14.785 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:09:14.785 [Cloud] Queued cloud request. 2026-09-15T23:09:14.785 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:09:14.785 [Cloud] Dequeued cloud request. 2026-09-15T23:09:14.785 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:09:14.926 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{569A7700-1FAC-D30B-CB71-71908010D02D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 23:09:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T23:09:15.441 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:11:12.849 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:11:12.849 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:11:12.849 [Cloud] Queued cloud request. 2026-09-15T23:11:12.849 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:11:12.849 [Cloud] Dequeued cloud request. 2026-09-15T23:11:12.849 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:11:12.989 [Cloud] End of cloud request. 2026-09-15T23:11:13.489 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:14:45.241 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:14:45.241 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:14:45.241 [Cloud] Queued cloud request. 2026-09-15T23:14:45.241 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:14:45.428 [Cloud] Dequeued cloud request. 2026-09-15T23:14:45.428 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:14:45.616 [Cloud] End of cloud request. 2026-09-15T23:14:46.131 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:15:03.116 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T23:15:45.334 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:15:45.334 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:15:45.334 [Cloud] Queued cloud request. 2026-09-15T23:15:45.334 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:15:45.334 [Cloud] Dequeued cloud request. 2026-09-15T23:15:45.334 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:15:45.678 [Cloud] End of cloud request. 2026-09-15T23:15:46.178 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:17:13.850 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:17:13.850 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:17:13.850 [Cloud] Queued cloud request. 2026-09-15T23:17:13.850 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:17:13.850 [Cloud] Dequeued cloud request. 2026-09-15T23:17:13.850 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:17:14.006 [Cloud] End of cloud request. 2026-09-15T23:17:14.522 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:20:50.181 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:20:50.181 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:20:50.181 [Cloud] Queued cloud request. 2026-09-15T23:20:50.181 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:20:50.181 [Cloud] Dequeued cloud request. 2026-09-15T23:20:50.181 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:20:50.322 [Cloud] End of cloud request. 2026-09-15T23:20:50.822 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:21:27.588 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:21:27.588 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:21:27.588 [Cloud] Queued cloud request. 2026-09-15T23:21:27.588 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:21:27.588 [Cloud] Dequeued cloud request. 2026-09-15T23:21:27.588 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:21:27.666 [Cloud] End of cloud request. 2026-09-15T23:21:28.166 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:22:51.402 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:22:51.402 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:22:51.402 [Cloud] Queued cloud request. 2026-09-15T23:22:51.402 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:22:51.402 [Cloud] Dequeued cloud request. 2026-09-15T23:22:51.402 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:22:51.542 [Cloud] End of cloud request. 2026-09-15T23:22:52.042 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:23:39.339 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:23:39.339 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:23:39.339 [Cloud] Queued cloud request. 2026-09-15T23:23:39.339 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:23:39.339 [Cloud] Dequeued cloud request. 2026-09-15T23:23:39.339 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:23:49.355 [Cloud] End of cloud request. 2026-09-15T23:23:49.870 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:24:15.652 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:24:15.652 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:24:15.652 [Cloud] Queued cloud request. 2026-09-15T23:24:15.652 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:24:15.652 [Cloud] Dequeued cloud request. 2026-09-15T23:24:15.652 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:24:15.730 [Cloud] End of cloud request. 2026-09-15T23:24:16.230 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:26:10.980 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:26:10.980 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:26:10.980 [Cloud] Queued cloud request. 2026-09-15T23:26:10.980 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:26:10.980 [Cloud] Dequeued cloud request. 2026-09-15T23:26:10.980 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:26:11.199 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DDA033F7-7917-8D61-DB93-723B0B09915E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 23:26:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T23:26:11.699 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:28:44.686 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 7930, Count: 561, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-15T23:28:44.686 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 3851, Count: 309, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-15T23:28:44.686 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-15T23:28:44.686 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 1345, Count: 91, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-15T23:28:44.686 ProcessImageName: AgentShellService.exe, Pid: 2684, TotalTime: 728, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-15T23:28:44.686 ProcessImageName: WmiPrvSE.exe, Pid: 3308, TotalTime: 662, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-15T23:28:44.686 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-15T23:28:44.686 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 135, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-15T23:28:44.686 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-15T23:28:44.686 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-15T23:28:44.686 ProcessImageName: powershell.exe, Pid: 8004, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-15T23:28:44.686 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-15T23:28:44.686 ProcessImageName: powershell.exe, Pid: 1628, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB1B5.tmp, EstimatedImpact: 0% 2026-09-15T23:28:44.686 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16985-0.MAI, EstimatedImpact: 0% 2026-09-15T23:28:44.686 ProcessImageName: taskhostw.exe, Pid: 2100, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-15T23:29:14.311 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:29:14.311 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:29:14.311 [Cloud] Queued cloud request. 2026-09-15T23:29:14.311 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:29:14.514 [Cloud] Dequeued cloud request. 2026-09-15T23:29:14.514 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:29:14.686 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3F4CEAA2-DCB1-B98E-F124-71DC82D57A5B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 23:29:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T23:29:15.201 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:30:08.123 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T23:30:41.576 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:30:41.576 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:30:41.576 [Cloud] Queued cloud request. 2026-09-15T23:30:41.576 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:30:41.576 [Cloud] Dequeued cloud request. 2026-09-15T23:30:41.576 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:30:41.764 [Cloud] End of cloud request. 2026-09-15T23:30:42.264 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:33:51.860 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:33:51.860 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:33:51.860 [Cloud] Queued cloud request. 2026-09-15T23:33:51.860 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:33:51.860 [Cloud] Dequeued cloud request. 2026-09-15T23:33:51.860 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:33:52.048 [Cloud] End of cloud request. 2026-09-15T23:33:52.563 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:36:43.610 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:36:43.610 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:36:43.610 [Cloud] Queued cloud request. 2026-09-15T23:36:43.610 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:36:43.610 [Cloud] Dequeued cloud request. 2026-09-15T23:36:43.610 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:36:43.798 [Cloud] End of cloud request. 2026-09-15T23:36:44.298 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:39:05.769 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:39:05.769 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:39:05.769 [Cloud] Queued cloud request. 2026-09-15T23:39:05.769 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:39:05.769 [Cloud] Dequeued cloud request. 2026-09-15T23:39:05.769 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:39:06.254 [Cloud] End of cloud request. 2026-09-15T23:39:06.769 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:41:41.239 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:41:41.239 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:41:41.239 [Cloud] Queued cloud request. 2026-09-15T23:41:41.239 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:41:41.239 [Cloud] Dequeued cloud request. 2026-09-15T23:41:41.239 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:41:41.380 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6EFD6697-C0EE-0871-C671-6E07C7304950} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-15-2026 23:41:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-15T23:41:41.880 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-15T23:45:13.131 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-15T23:48:07.102 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-15T23:48:07.102 [Cloud] Start of cloud request. Passive mode: 0 2026-09-15T23:48:07.102 [Cloud] Queued cloud request. 2026-09-15T23:48:07.102 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-15T23:48:07.102 [Cloud] Dequeued cloud request. 2026-09-15T23:48:07.102 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-15T23:48:07.336 [Cloud] End of cloud request. 2026-09-15T23:48:07.852 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:00:18.138 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T00:14:14.082 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:9B20B2F2-828B-440C-AF42-8E35B742D053, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-16T00:14:14.082 Scheduled scan with Id 9B20B2F2-828B-440C-AF42-8E35B742D053 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-16T00:14:14.082 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-16T00:14:14.082 [SFC] System file cache build is not needed (already completed) 2026-09-16T00:14:34.441 Engine:Triggered AR EMS scan 2026-09-16T00:14:34.457 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.472 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.488 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.488 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.488 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.519 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.519 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.535 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.551 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.551 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.551 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.551 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.566 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.566 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.566 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.582 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.582 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.597 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.597 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.613 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.629 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.629 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.629 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.629 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.644 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.644 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.660 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.676 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.676 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.676 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.676 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.691 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.707 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.707 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.725 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.725 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.738 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.738 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.738 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.738 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.754 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.754 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.754 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.769 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.769 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.785 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.785 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.801 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.801 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.816 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.832 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.832 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.848 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.863 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.879 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.894 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.910 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.926 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.941 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.941 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:14:34.957 Engine:EMS scan for process: svchost pid: 7484, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-16T00:15:12.285 QuickScan:ScanID:9B20B2F2-828B-440C-AF42-8E35B742D053: Quick scan finished with error 0 2026-09-16T00:15:12.801 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-16T00:15:12.801 [RTP] Duplicating the current plugin configuration object... 2026-09-16T00:15:12.801 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-16T00:15:12.801 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-16T00:15:12.801 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-16T00:15:12.801 [RTP] No config change detected. Not updating plugin configuration. 2026-09-16T00:15:12.801 [RTP] No config changes found. No configuration switch. 2026-09-16T00:15:12.801 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-16T00:15:23.145 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T00:19:01.039 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:19:01.039 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:19:01.039 [Cloud] Queued cloud request. 2026-09-16T00:19:01.039 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:19:01.195 [Cloud] Dequeued cloud request. 2026-09-16T00:19:01.195 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:19:06.148 [Cloud] End of cloud request. 2026-09-16T00:19:06.648 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:20:36.179 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:20:36.179 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:20:36.179 [Cloud] Queued cloud request. 2026-09-16T00:20:36.179 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:20:36.179 [Cloud] Dequeued cloud request. 2026-09-16T00:20:36.179 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:20:36.336 [Cloud] End of cloud request. 2026-09-16T00:20:36.836 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:21:08.290 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:21:08.290 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:21:08.290 [Cloud] Queued cloud request. 2026-09-16T00:21:08.290 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:21:08.290 [Cloud] Dequeued cloud request. 2026-09-16T00:21:08.290 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:21:08.368 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{382DEF08-7204-D070-AE51-567B510E2C1D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 00:21:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T00:21:08.868 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:23:33.916 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:23:33.916 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:23:33.916 [Cloud] Queued cloud request. 2026-09-16T00:23:33.916 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:23:33.916 [Cloud] Dequeued cloud request. 2026-09-16T00:23:33.916 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:23:34.041 [Cloud] End of cloud request. 2026-09-16T00:23:34.541 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:27:02.996 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:27:02.996 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:27:02.996 [Cloud] Queued cloud request. 2026-09-16T00:27:02.996 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:27:02.996 [Cloud] Dequeued cloud request. 2026-09-16T00:27:02.996 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:27:03.137 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{86F798DE-B53A-CA4F-54D7-20326B9191EF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 00:27:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T00:27:03.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:27:16.730 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:27:16.730 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:27:16.730 [Cloud] Queued cloud request. 2026-09-16T00:27:16.730 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:27:16.730 [Cloud] Dequeued cloud request. 2026-09-16T00:27:16.730 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:27:16.808 [Cloud] End of cloud request. 2026-09-16T00:27:17.324 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:30:01.122 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:30:01.122 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:30:01.122 [Cloud] Queued cloud request. 2026-09-16T00:30:01.122 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:30:01.122 [Cloud] Dequeued cloud request. 2026-09-16T00:30:01.122 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:30:01.278 [Cloud] End of cloud request. 2026-09-16T00:30:01.778 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:30:28.153 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T00:36:35.624 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:36:35.624 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:36:35.624 [Cloud] Queued cloud request. 2026-09-16T00:36:35.624 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:36:35.624 [Cloud] Dequeued cloud request. 2026-09-16T00:36:35.624 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:36:35.765 [Cloud] End of cloud request. 2026-09-16T00:36:36.265 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:38:34.502 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:38:34.502 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:38:34.502 [Cloud] Queued cloud request. 2026-09-16T00:38:34.502 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:38:34.502 [Cloud] Dequeued cloud request. 2026-09-16T00:38:34.502 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:38:34.643 [Cloud] End of cloud request. 2026-09-16T00:38:35.143 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:38:42.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:38:42.643 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:38:42.643 [Cloud] Queued cloud request. 2026-09-16T00:38:42.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:38:42.643 [Cloud] Dequeued cloud request. 2026-09-16T00:38:42.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:38:42.721 [Cloud] End of cloud request. 2026-09-16T00:38:43.236 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:42:18.393 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:42:18.393 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:42:18.393 [Cloud] Queued cloud request. 2026-09-16T00:42:18.393 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:42:18.393 [Cloud] Dequeued cloud request. 2026-09-16T00:42:18.393 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:42:18.580 [Cloud] End of cloud request. 2026-09-16T00:42:19.080 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:43:39.393 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:43:39.393 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:43:39.393 [Cloud] Queued cloud request. 2026-09-16T00:43:39.393 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:43:39.393 [Cloud] Dequeued cloud request. 2026-09-16T00:43:39.393 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:43:39.580 [Cloud] End of cloud request. 2026-09-16T00:43:40.080 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:45:33.161 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T00:50:40.366 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:50:40.366 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:50:40.366 [Cloud] Queued cloud request. 2026-09-16T00:50:40.366 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:50:40.366 [Cloud] Dequeued cloud request. 2026-09-16T00:50:40.366 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:50:40.554 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{90579714-60BA-7382-741B-2E02DBA39542} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 00:50:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T00:50:41.054 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:53:28.056 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:53:28.056 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:53:28.056 [Cloud] Queued cloud request. 2026-09-16T00:53:28.056 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:53:28.056 [Cloud] Dequeued cloud request. 2026-09-16T00:53:28.056 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:53:28.244 [Cloud] End of cloud request. 2026-09-16T00:53:28.744 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T00:56:19.759 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T00:56:19.759 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T00:56:19.759 [Cloud] Queued cloud request. 2026-09-16T00:56:19.759 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T00:56:19.759 [Cloud] Dequeued cloud request. 2026-09-16T00:56:19.759 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T00:56:19.931 [Cloud] End of cloud request. 2026-09-16T00:56:20.447 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T01:00:02.309 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448468, FileId: 0x3e00000003974b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.309 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448467, FileId: 0x1c00000003d025, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.324 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448474, FileId: 0x4000000003974b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.324 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448475, FileId: 0x1e00000003d025, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.340 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448480, FileId: 0x4200000003974b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.340 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448481, FileId: 0x2000000003d025, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.356 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448486, FileId: 0x2200000003d025, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.356 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448487, FileId: 0x4400000003974b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.371 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448493, FileId: 0x2400000003d025, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.371 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448492, FileId: 0x4600000003974b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.387 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448498, FileId: 0x2600000003d025, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.387 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448499, FileId: 0x4800000003974b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.402 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448504, FileId: 0x4a00000003974b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.402 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448505, FileId: 0x2800000003d025, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.402 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448510, FileId: 0x2a00000003d025, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.402 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448511, FileId: 0x4c00000003974b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.418 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448516, FileId: 0x2c00000003d025, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.418 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448517, FileId: 0x4e00000003974b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.434 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448522, FileId: 0x2e00000003d025, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.434 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448523, FileId: 0x5000000003974b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.449 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448529, FileId: 0x5200000003974b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.449 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448528, FileId: 0x3000000003d025, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.465 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448534, FileId: 0x3200000003d025, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:02.465 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-169cd-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6448535, FileId: 0x5400000003974b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T01:00:38.168 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T01:06:38.922 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T01:06:38.922 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T01:06:38.922 [Cloud] Queued cloud request. 2026-09-16T01:06:38.922 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T01:06:38.922 [Cloud] Dequeued cloud request. 2026-09-16T01:06:38.922 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T01:06:39.062 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0597EC16-4CB0-F1E7-5EA5-654D21553D96} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 01:06:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T01:06:39.562 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T01:14:20.189 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T01:14:20.189 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T01:14:20.189 [Cloud] Queued cloud request. 2026-09-16T01:14:20.189 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T01:14:20.189 [Cloud] Dequeued cloud request. 2026-09-16T01:14:20.189 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T01:14:20.346 [Cloud] End of cloud request. 2026-09-16T01:14:20.861 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T01:15:43.174 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T01:21:13.257 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T01:21:13.257 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T01:21:13.257 [Cloud] Queued cloud request. 2026-09-16T01:21:13.257 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T01:21:13.257 [Cloud] Dequeued cloud request. 2026-09-16T01:21:13.257 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T01:21:14.335 [Cloud] End of cloud request. 2026-09-16T01:21:14.835 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T01:21:23.054 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T01:21:23.054 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T01:21:23.054 [Cloud] Queued cloud request. 2026-09-16T01:21:23.054 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T01:21:23.054 [Cloud] Dequeued cloud request. 2026-09-16T01:21:23.054 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T01:21:23.132 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D8165FB3-F035-887E-395E-322249E06545} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 01:21:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T01:21:23.647 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T01:28:29.480 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T01:28:29.480 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T01:28:29.480 [Cloud] Queued cloud request. 2026-09-16T01:28:29.480 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T01:28:29.480 [Cloud] Dequeued cloud request. 2026-09-16T01:28:29.480 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T01:28:29.667 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{08123C3B-AB4A-56F8-BD1E-285EB918DEE3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 01:28:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T01:28:30.183 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T01:28:44.761 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 17628, Count: 1217, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-16T01:28:44.761 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 3851, Count: 309, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T01:28:44.761 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 3627, Count: 274, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-16T01:28:44.761 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-16T01:28:44.761 ProcessImageName: AgentShellService.exe, Pid: 2684, TotalTime: 728, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-16T01:28:44.761 ProcessImageName: WmiPrvSE.exe, Pid: 3308, TotalTime: 662, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-16T01:28:44.761 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 316, Count: 25, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-16T01:28:44.761 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T01:28:44.761 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-16T01:28:44.761 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T01:28:44.761 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16985-0.MAI, EstimatedImpact: 0% 2026-09-16T01:28:44.761 ProcessImageName: powershell.exe, Pid: 8004, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-16T01:28:44.761 ProcessImageName: mysqldump.exe, Pid: 6180, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-16T01:28:44.761 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-16T01:28:44.761 ProcessImageName: powershell.exe, Pid: 1628, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB1B5.tmp, EstimatedImpact: 0% 2026-09-16T01:28:44.761 ProcessImageName: DeviceCensus.exe, Pid: 4900, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 1% 2026-09-16T01:28:44.761 ProcessImageName: taskhostw.exe, Pid: 2100, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-16T01:29:35.214 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T01:29:35.214 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T01:29:35.214 [Cloud] Queued cloud request. 2026-09-16T01:29:35.214 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T01:29:35.214 [Cloud] Dequeued cloud request. 2026-09-16T01:29:35.214 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T01:29:35.386 [Cloud] End of cloud request. 2026-09-16T01:29:35.901 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T01:29:47.089 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T01:29:47.089 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T01:29:47.089 [Cloud] Queued cloud request. 2026-09-16T01:29:47.089 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T01:29:47.089 [Cloud] Dequeued cloud request. 2026-09-16T01:29:47.089 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T01:29:47.198 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1555976B-DA65-611E-2909-1E8C00578E5F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 01:29:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T01:29:47.714 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T01:30:48.183 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T01:41:33.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T01:41:33.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T01:41:33.297 [Cloud] Queued cloud request. 2026-09-16T01:41:33.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T01:41:33.453 [Cloud] Dequeued cloud request. 2026-09-16T01:41:33.453 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T01:41:33.641 [Cloud] End of cloud request. 2026-09-16T01:41:34.141 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T01:44:49.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T01:44:49.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T01:44:49.297 [Cloud] Queued cloud request. 2026-09-16T01:44:49.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T01:44:49.297 [Cloud] Dequeued cloud request. 2026-09-16T01:44:49.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T01:44:49.485 [Cloud] End of cloud request. 2026-09-16T01:44:49.985 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T01:45:53.190 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T01:47:51.005 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T01:47:51.005 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T01:47:51.005 [Cloud] Queued cloud request. 2026-09-16T01:47:51.005 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T01:47:51.005 [Cloud] Dequeued cloud request. 2026-09-16T01:47:51.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T01:47:51.192 [Cloud] End of cloud request. 2026-09-16T01:47:51.692 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T01:54:08.742 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T01:54:08.742 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T01:54:08.742 [Cloud] Queued cloud request. 2026-09-16T01:54:08.742 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T01:54:08.742 [Cloud] Dequeued cloud request. 2026-09-16T01:54:08.742 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T01:54:08.929 [Cloud] End of cloud request. 2026-09-16T01:54:09.429 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T01:59:51.463 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T01:59:51.463 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T01:59:51.463 [Cloud] Queued cloud request. 2026-09-16T01:59:51.463 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T01:59:51.463 [Cloud] Dequeued cloud request. 2026-09-16T01:59:51.463 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T01:59:51.635 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CA852DD1-6594-14F6-09B3-F70A67702EBB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 01:59:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T01:59:52.150 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T02:00:29.510 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T02:00:29.510 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T02:00:29.510 [Cloud] Queued cloud request. 2026-09-16T02:00:29.510 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T02:00:29.510 [Cloud] Dequeued cloud request. 2026-09-16T02:00:29.510 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T02:00:29.588 [Cloud] End of cloud request. 2026-09-16T02:00:30.103 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T02:00:58.197 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T02:16:03.205 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T02:23:39.194 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T02:23:39.194 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T02:23:39.194 [Cloud] Queued cloud request. 2026-09-16T02:23:39.194 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T02:23:39.194 [Cloud] Dequeued cloud request. 2026-09-16T02:23:39.194 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T02:23:39.522 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{69A03E31-667B-33F9-36CA-3313A71D358E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 02:23:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T02:23:40.022 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T02:26:45.446 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T02:26:45.446 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T02:26:45.446 [Cloud] Queued cloud request. 2026-09-16T02:26:45.446 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T02:26:45.446 [Cloud] Dequeued cloud request. 2026-09-16T02:26:45.446 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T02:26:55.586 [Cloud] End of cloud request. 2026-09-16T02:26:56.102 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T02:30:44.165 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T02:30:44.165 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T02:30:44.165 [Cloud] Queued cloud request. 2026-09-16T02:30:44.165 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T02:30:44.165 [Cloud] Dequeued cloud request. 2026-09-16T02:30:44.165 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T02:30:46.869 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{00E280C7-E144-4FFA-C9C0-70E172CDC5DB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 02:30:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T02:30:47.369 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T02:31:08.213 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T02:46:13.220 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T02:54:30.928 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T02:54:30.928 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T02:54:30.928 [Cloud] Queued cloud request. 2026-09-16T02:54:30.928 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T02:54:30.928 [Cloud] Dequeued cloud request. 2026-09-16T02:54:30.928 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T02:54:31.116 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F0A778DA-1580-353E-9DD3-0E7CCD2B75E2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 02:54:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T02:54:31.631 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T03:01:18.227 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T03:04:50.290 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T03:04:50.290 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T03:04:50.290 [Cloud] Queued cloud request. 2026-09-16T03:04:50.290 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T03:04:50.290 [Cloud] Dequeued cloud request. 2026-09-16T03:04:50.290 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T03:04:50.556 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B4ED60F1-C853-D028-EDA3-E409CBEC05A2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 03:04:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T03:04:51.071 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T03:07:07.042 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-16T03:07:07.042 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-16T03:07:07.042 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-16T03:07:07.042 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-16T03:07:07.042 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-16T03:07:07.089 [AutoPurge] Cleanup Routine tasks have started. 2026-09-16T03:07:07.089 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-16T03:07:07.104 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-16T03:07:07.104 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-16T03:07:07.104 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-16-2026 03:07:07 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-16-2026 03:07:07 2026-09-16T03:07:07.104 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-16T03:07:07.104 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-16T03:07:07.104 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-16T03:07:07.104 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-16T03:07:07.104 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-16T03:07:07.151 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-16T03:07:07.245 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-16T03:07:07.245 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-16T03:07:07.276 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-16T03:07:07.276 [AutoPurge] Removing expired default signature package ... 2026-09-16T03:07:07.464 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-16T03:07:07.526 Job Notification: New process added to job (7132) 2026-09-16T03:07:07.589 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-16T03:07:08.042 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:07:08.479 Job Notification: Process exited from job (7132) 2026-09-16T03:07:08.542 [AutoPurge] Verification Routine tasks have ended. 2026-09-16T03:07:08.682 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-16T03:07:08.792 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-16T03:07:09.276 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-16T03:07:09.339 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-16T03:07:09.510 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-16T03:07:11.120 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:11.479 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-16T03:07:11.745 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-16T03:07:11.760 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:11.979 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-16T03:07:12.589 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-16T03:07:13.229 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-16T03:07:13.339 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-16T03:07:13.479 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-16T03:07:13.776 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:07:13.917 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-16T03:07:14.245 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-16T03:07:14.354 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-16T03:07:14.526 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:14.635 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:14.698 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:14.713 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-16T03:07:14.885 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:07:14.979 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-16T03:07:15.057 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-16T03:07:15.120 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-16T03:07:15.260 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-16T03:07:15.667 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:15.713 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-16T03:07:16.135 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:07:16.276 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-16T03:07:16.932 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-16T03:07:17.526 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:17.667 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:07:17.948 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-16T03:07:18.354 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-16T03:07:18.448 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-16T03:07:18.870 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-16T03:07:18.995 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:19.495 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:07:19.604 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-16T03:07:19.620 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-16T03:07:19.682 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-16T03:07:19.870 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-16T03:07:19.933 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-16T03:07:19.979 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:20.058 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-16T03:07:20.308 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-16T03:07:20.729 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-16T03:07:20.995 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-16T03:07:21.480 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-16T03:07:22.824 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-16T03:07:23.308 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-16T03:07:23.339 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-16T03:07:23.355 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-16T03:07:23.370 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-16T03:07:23.386 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-16T03:07:23.527 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-16T03:07:23.777 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-16T03:07:23.808 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:23.886 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-16T03:07:24.246 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-16T03:07:24.292 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-16T03:07:24.292 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-16T03:07:24.355 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-16T03:07:24.839 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:25.027 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:25.058 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-16T03:07:25.105 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-16T03:07:25.121 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:25.777 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-16T03:07:26.121 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-16T03:07:26.136 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:26.824 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-16T03:07:26.855 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-16T03:07:27.496 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:07:27.855 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-16T03:07:28.262 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-16T03:07:28.418 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:28.574 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:28.730 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-16T03:07:28.949 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-16T03:07:29.012 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-16T03:07:29.059 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:29.621 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-16T03:07:29.918 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-16T03:07:29.965 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-16T03:07:30.012 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:07:30.371 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:07:30.465 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.269.9\psmachine_64.dll", hr=0x0 2026-09-16T03:07:30.574 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-16T03:07:30.699 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-16T03:07:30.824 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-16T03:07:30.856 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-16T03:07:30.934 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-16T03:07:31.496 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-16T03:07:31.934 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-16T03:07:32.059 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-16T03:07:32.184 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-16T03:07:32.778 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-16T03:07:32.825 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:33.153 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-16T03:07:33.246 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-16T03:07:33.246 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-16T03:07:33.293 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-16T03:07:33.387 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-16T03:07:33.418 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-16T03:07:33.450 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-16T03:07:33.715 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.269.9\microsoftedgeupdatesetup_x86_1.3.269.9.exe", hr=0x0 2026-09-16T03:07:33.825 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-16T03:07:33.825 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-16T03:07:34.153 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-16T03:07:34.325 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:34.434 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-16T03:07:34.450 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-16T03:07:34.668 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:07:34.918 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-16T03:07:35.325 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:07:35.637 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-16T03:07:35.762 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-16T03:07:36.137 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-16T03:07:36.153 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:36.294 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-16T03:07:36.419 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-16T03:07:36.919 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-16T03:07:36.965 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-16T03:07:37.169 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:37.169 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-16T03:07:37.356 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-16T03:07:37.419 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-16T03:07:37.622 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:07:37.965 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:07:38.106 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-16T03:07:38.153 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-16T03:07:38.825 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-16T03:07:38.841 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-16T03:07:39.106 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-16T03:07:39.262 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-16T03:07:39.559 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-16T03:07:40.309 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:07:40.497 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-16T03:07:40.903 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-16T03:07:41.200 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-16T03:07:41.387 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-16T03:07:41.419 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:41.419 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-16T03:07:41.544 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-16T03:07:41.778 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-16T03:07:42.153 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-16T03:07:42.231 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-16T03:07:42.434 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-16T03:07:42.716 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-16T03:07:42.763 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-16T03:07:43.153 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:07:43.341 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-16T03:07:43.528 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-16T03:07:44.247 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:07:44.325 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-16T03:07:44.403 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-16T03:07:44.450 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-16T03:07:45.466 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-16T03:07:45.544 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-16T03:07:45.638 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-16T03:07:45.794 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-16T03:07:45.997 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-16T03:07:46.169 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-16T03:07:46.903 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-16T03:07:46.950 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-16T03:07:46.981 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-16T03:07:47.060 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-16T03:07:47.169 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-16T03:07:47.513 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-16T03:07:47.653 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-16T03:07:47.669 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-16T03:07:47.685 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-16T03:07:47.778 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:47.810 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-16T03:07:47.856 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-16T03:07:48.185 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-16T03:07:48.310 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-16T03:07:48.591 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-16T03:07:48.700 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:48.950 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-16T03:07:49.325 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-16T03:07:49.388 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-16T03:07:49.607 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-16T03:07:49.857 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-16T03:07:49.919 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-16T03:07:49.997 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:07:50.153 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:07:50.357 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-16T03:07:50.419 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-16T03:07:50.607 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:07:50.778 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-16T03:07:50.857 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:07:51.138 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:07:51.169 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-16T03:07:51.216 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-16T03:07:51.403 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-16T03:07:51.450 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-16T03:07:51.450 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-16T03:07:51.919 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-16T03:07:51.982 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:52.013 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-16T03:07:52.107 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:07:52.294 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:07:52.435 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-16T03:07:53.044 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-16T03:07:53.185 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-16T03:07:53.247 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-16T03:07:53.560 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-16T03:07:53.591 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-16T03:07:53.653 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-16T03:07:54.044 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-16T03:07:54.091 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-16T03:07:54.419 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-16T03:07:54.497 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-16T03:07:54.544 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-16T03:07:54.560 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:54.575 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:54.607 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:07:54.622 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-16T03:07:54.638 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:55.279 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-16T03:07:55.591 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-16T03:07:55.904 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:07:55.982 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-16T03:07:56.247 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:56.263 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:07:56.388 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-16T03:07:56.716 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:56.732 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-16T03:07:56.919 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-16T03:07:56.935 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-16T03:07:57.075 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-16T03:07:57.154 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-16T03:07:57.169 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-16T03:07:57.419 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-16T03:07:57.450 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-16T03:07:57.450 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-16T03:07:57.622 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-16T03:07:57.810 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:57.997 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-16T03:07:58.404 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\systemapps\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-16T03:07:58.529 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-16T03:07:58.654 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-16T03:07:58.857 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-16T03:07:59.029 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-16T03:07:59.044 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-16T03:07:59.060 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:07:59.325 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-16T03:07:59.341 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-16T03:07:59.544 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-16T03:07:59.685 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-16T03:07:59.685 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-16T03:08:00.497 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:08:00.497 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-16T03:08:00.607 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-16T03:08:00.732 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:08:00.747 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:08:01.575 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:02.029 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-16T03:08:02.247 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:02.247 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-16T03:08:02.466 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:02.497 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-16T03:08:02.622 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-16T03:08:02.763 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-16T03:08:02.825 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-16T03:08:03.154 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-16T03:08:03.200 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:03.450 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:08:03.466 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:03.529 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-16T03:08:04.107 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-16T03:08:04.638 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-16T03:08:04.685 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:04.732 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-16T03:08:04.841 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:05.044 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:05.122 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-16T03:08:05.419 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-16T03:08:05.888 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:05.919 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-16T03:08:06.154 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:08:06.310 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-16T03:08:06.513 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-16T03:08:06.529 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:06.794 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-16T03:08:07.169 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-16T03:08:07.201 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:07.310 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:07.435 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-16T03:08:07.466 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-16T03:08:07.841 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-16T03:08:07.966 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:08.154 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-16T03:08:08.185 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-16T03:08:08.201 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:08.232 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:08.388 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-16T03:08:08.466 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:08.841 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-16T03:08:08.935 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-16T03:08:09.435 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-16T03:08:09.497 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-16T03:08:09.560 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-16T03:08:09.669 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-16T03:08:09.716 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:09.747 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-16T03:08:09.794 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-16T03:08:10.247 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-16T03:08:10.451 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-16T03:08:10.716 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-16T03:08:10.732 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-16T03:08:11.060 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-16T03:08:11.060 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:11.372 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-16T03:08:11.732 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-16T03:08:11.997 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-16T03:08:12.060 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-16T03:08:12.138 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-16T03:08:12.201 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:12.341 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-16T03:08:12.388 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-16T03:08:12.435 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-16T03:08:12.513 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-16T03:08:12.857 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-16T03:08:12.919 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:08:12.982 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:08:13.451 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-16T03:08:13.544 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:08:13.716 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-16T03:08:13.951 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-16T03:08:14.232 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-16T03:08:14.247 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:14.607 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-16T03:08:14.622 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-16T03:08:14.669 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-16T03:08:14.919 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-16T03:08:15.154 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-16T03:08:15.169 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-16T03:08:15.497 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-16T03:08:15.591 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-16T03:08:15.716 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-16T03:08:15.810 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:15.826 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-16T03:08:15.966 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-16T03:08:16.169 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-16T03:08:16.357 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-16T03:08:16.435 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-16T03:08:16.607 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-16T03:08:18.044 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-16T03:08:18.482 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-16T03:08:18.638 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-16T03:08:18.872 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:19.122 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-16T03:08:19.294 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-16T03:08:19.576 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-16T03:08:19.826 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-16T03:08:19.919 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-16T03:08:19.951 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-16T03:08:19.966 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-16T03:08:20.107 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-16T03:08:20.388 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-16T03:08:20.419 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:20.419 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-16T03:08:20.497 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-16T03:08:20.529 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-16T03:08:20.654 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-16T03:08:21.091 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-16T03:08:21.201 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-16T03:08:21.388 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-16T03:08:21.404 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:21.513 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-16T03:08:21.513 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-16T03:08:21.716 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-16T03:08:21.779 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:08:22.029 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-16T03:08:22.357 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-16T03:08:22.810 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:23.326 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-16T03:08:23.419 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-16T03:08:23.904 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-16T03:08:24.294 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:08:24.372 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:24.638 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-16T03:08:24.919 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-16T03:08:24.982 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-16T03:08:25.154 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-16T03:08:25.310 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-16T03:08:25.747 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-16T03:08:26.529 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-16T03:08:26.607 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-16T03:08:26.701 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-16T03:08:27.326 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-16T03:08:27.451 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-16T03:08:27.763 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-16T03:08:27.841 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-16T03:08:27.935 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-16T03:08:27.935 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-16T03:08:28.466 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-16T03:08:28.591 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-16T03:08:28.607 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:28.638 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-16T03:08:28.935 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-16T03:08:28.951 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:08:29.154 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-16T03:08:29.279 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-16T03:08:29.607 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-16T03:08:30.091 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-16T03:08:30.201 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:08:30.388 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:30.607 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-16T03:08:30.951 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:31.029 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-16T03:08:31.232 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-16T03:08:31.404 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-16T03:08:31.544 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:31.685 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-16T03:08:31.935 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-16T03:08:32.294 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-16T03:08:32.341 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-16T03:08:32.372 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-16T03:08:32.529 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:32.560 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-16T03:08:32.919 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-16T03:08:33.091 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-16T03:08:33.201 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:34.138 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-16T03:08:34.701 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-16T03:08:34.732 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-16T03:08:34.794 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-16T03:08:34.841 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-16T03:08:35.185 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:35.247 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-16T03:08:35.451 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-16T03:08:35.529 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-16T03:08:35.591 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-16T03:08:35.654 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:35.732 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-16T03:08:35.904 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-16T03:08:35.966 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-16T03:08:36.357 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-16T03:08:36.419 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-16T03:08:36.497 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:36.513 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-16T03:08:36.529 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-16T03:08:36.544 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-16T03:08:36.654 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-16T03:08:36.669 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:08:36.685 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-16T03:08:36.732 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-16T03:08:37.169 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-16T03:08:37.201 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-16T03:08:37.544 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:08:37.607 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-16T03:08:37.638 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-16T03:08:37.654 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-16T03:08:38.544 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-16T03:08:38.654 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:08:38.841 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:08:38.841 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-16T03:08:39.029 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-16T03:08:39.232 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-16T03:08:39.326 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-16T03:08:39.419 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:40.107 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-16T03:08:40.138 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-16T03:08:40.263 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-16T03:08:40.294 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-16T03:08:40.294 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:08:40.779 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:08:40.794 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-16T03:08:40.935 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-16T03:08:40.935 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-16T03:08:41.107 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-16T03:08:41.544 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-16T03:08:41.966 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-16T03:08:42.216 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:42.622 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-16T03:08:42.873 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-16T03:08:42.935 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-16T03:08:43.091 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-16T03:08:43.123 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-16T03:08:43.216 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-16T03:08:43.310 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-16T03:08:43.388 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-16T03:08:43.388 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:08:43.826 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-16T03:08:43.919 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-16T03:08:44.232 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-16T03:08:44.326 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:08:44.466 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-16T03:08:44.497 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:08:44.654 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\de-de\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:44.794 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-console-l1-1-0.dll", hr=0x0 2026-09-16T03:08:44.966 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0 2026-09-16T03:08:44.966 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-registry-l2-1-0.dll", hr=0x0 2026-09-16T03:08:45.294 Engine:Setting original file name "MrmCore.dll" for "c:\windows\winsxs\wow64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.20348.5020_none_9e6a80bbc86408d7\mrmcorer.dll", hr=0x0 2026-09-16T03:08:45.310 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:45.435 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_en-gb_56416fd74780e848\vsswmi.dll.mui", hr=0x0 2026-09-16T03:08:45.435 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\es-es\aerolite.msstyles.mui", hr=0x0 2026-09-16T03:08:45.607 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_7573f1c6d4639f87\penimc.dll", hr=0x0 2026-09-16T03:08:45.623 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.data.winmd", hr=0x0 2026-09-16T03:08:45.794 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\de-de\ndisimplatcim.dll.mui", hr=0x0 2026-09-16T03:08:45.888 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_4e347e352039867c\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:45.997 Engine:Setting original file name "winsqlite3" for "c:\windows\winsxs\wow64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.20348.4647_none_c9096b99901f19cd\winsqlite3.dll", hr=0x0 2026-09-16T03:08:46.029 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0 2026-09-16T03:08:46.029 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000c.dll", hr=0x0 2026-09-16T03:08:46.357 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-1-0.dll", hr=0x0 2026-09-16T03:08:46.357 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata000a.dll", hr=0x0 2026-09-16T03:08:46.638 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-2-0.dll", hr=0x0 2026-09-16T03:08:46.732 Engine:Setting original file name "wmic.exe" for "c:\windows\winsxs\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.20348.2849_none_54405a5933961199\wmic.exe", hr=0x0 2026-09-16T03:08:46.888 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.storage.winmd", hr=0x0 2026-09-16T03:08:47.248 Engine:Setting original file name "CRYPT32.DLL" for "c:\windows\systemresources\crypt32.dll.mun", hr=0x0 2026-09-16T03:08:47.513 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_7d8ffbc5cb37c8e0\bootmgr.exe.mui", hr=0x0 2026-09-16T03:08:47.560 Engine:Setting original file name "mstsc.exe" for "c:\windows\systemresources\mstsc.exe.mun", hr=0x0 2026-09-16T03:08:47.763 Engine:Setting original file name "SYSTEMCPL.DLL" for "c:\windows\systemresources\systemcpl.dll.mun", hr=0x0 2026-09-16T03:08:47.810 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0 2026-09-16T03:08:47.935 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1e6e07718388e886\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:47.998 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0 2026-09-16T03:08:48.669 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0 2026-09-16T03:08:48.685 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mpg4decd_31bf3856ad364e35_10.0.20348.2849_none_08e768f194682e23\mpg4decd.dll", hr=0x0 2026-09-16T03:08:48.685 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0 2026-09-16T03:08:48.732 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0 2026-09-16T03:08:48.935 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-1.dll", hr=0x0 2026-09-16T03:08:48.951 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\naturallanguage6.dll", hr=0x0 2026-09-16T03:08:49.419 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0 2026-09-16T03:08:49.701 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0 2026-09-16T03:08:50.044 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ja-jp_5634cc97d85965d9\bootmgr_ex.efi.mui", hr=0x0 2026-09-16T03:08:50.044 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0 2026-09-16T03:08:50.263 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_d7c56d20c9fb1c22\diagpackage.dll.mui", hr=0x0 2026-09-16T03:08:50.529 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:50.638 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mpg4decd.dll", hr=0x0 2026-09-16T03:08:50.826 Engine:Setting original file name "SYSMON.OCX" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\sysmon.ocx.mun", hr=0x0 2026-09-16T03:08:50.873 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgfw_ex.efi.mui", hr=0x0 2026-09-16T03:08:50.904 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\uk-ua\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:08:51.123 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgfw.efi.mui", hr=0x0 2026-09-16T03:08:51.169 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-profile-l1-1-0.dll", hr=0x0 2026-09-16T03:08:51.248 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-convert-l1-1-0.dll", hr=0x0 2026-09-16T03:08:51.404 OriginalFileName Maintenance::28320 files in Moac, 0 skipped (cached), 545 filename set 2026-09-16T03:08:51.404 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-16T03:10:14.779 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T03:10:14.779 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T03:10:14.779 [Cloud] Queued cloud request. 2026-09-16T03:10:14.779 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T03:10:14.779 [Cloud] Dequeued cloud request. 2026-09-16T03:10:14.779 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T03:10:24.873 [Cloud] End of cloud request. 2026-09-16T03:10:25.373 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-16T03:10:25.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T03:10:25.404 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-16T03:10:25.404 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-16T03:10:25.404 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-16T03:10:25.404 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-16T03:10:25.404 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-16T03:10:25.404 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-16T03:10:25.404 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-16T03:10:25.404 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-16T03:10:25.404 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-16T03:10:25.404 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-16T03:10:25.404 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-16T03:10:25.404 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-16T03:10:25.404 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-16T03:10:25.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T03:10:25.404 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-16T03:10:25.404 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-16T03:10:25.404 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-16T03:10:25.404 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-16T03:10:25.404 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-16T03:10:25.404 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-16T03:10:25.404 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-16T03:10:25.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T03:10:25.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T03:10:25.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T03:10:27.982 [RTP] Duplicating the current plugin configuration object... 2026-09-16T03:10:27.982 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-16T03:10:27.982 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-16T03:10:27.982 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-16T03:10:27.982 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-16T03:10:27.982 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-16T03:13:19.187 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T03:13:19.187 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T03:13:19.187 [Cloud] Queued cloud request. 2026-09-16T03:13:19.187 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T03:13:19.187 [Cloud] Dequeued cloud request. 2026-09-16T03:13:19.359 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T03:13:29.453 [Cloud] End of cloud request. 2026-09-16T03:13:29.953 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T03:16:23.235 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T03:20:01.362 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T03:20:01.362 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T03:20:01.362 [Cloud] Queued cloud request. 2026-09-16T03:20:01.362 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T03:20:01.362 [Cloud] Dequeued cloud request. 2026-09-16T03:20:01.362 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T03:20:01.549 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9EDEDB8F-F734-0BE1-2B44-EFB7A36CAE5F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 03:20:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T03:20:02.065 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T03:28:44.835 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 22406, Count: 1612, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-16T03:28:44.835 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 5700, Count: 460, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-16T03:28:44.835 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 3851, Count: 309, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T03:28:44.835 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-16T03:28:44.835 ProcessImageName: AgentShellService.exe, Pid: 2684, TotalTime: 728, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-16T03:28:44.835 ProcessImageName: WmiPrvSE.exe, Pid: 3308, TotalTime: 662, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-16T03:28:44.835 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 437, Count: 33, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-16T03:28:44.835 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T03:28:44.835 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T03:28:44.835 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-16T03:28:44.835 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16985-0.MAI, EstimatedImpact: 0% 2026-09-16T03:28:44.835 ProcessImageName: powershell.exe, Pid: 8004, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-16T03:28:44.835 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-16T03:28:44.835 ProcessImageName: mysqldump.exe, Pid: 6180, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-16T03:28:44.835 ProcessImageName: powershell.exe, Pid: 1628, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB1B5.tmp, EstimatedImpact: 0% 2026-09-16T03:28:44.835 ProcessImageName: DeviceCensus.exe, Pid: 4900, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 1% 2026-09-16T03:28:44.835 ProcessImageName: taskhostw.exe, Pid: 2100, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-16T03:28:44.835 ProcessImageName: cmd.exe, Pid: 6156, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-16T03:31:28.243 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T03:46:33.250 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T03:50:38.361 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T03:50:38.361 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T03:50:38.361 [Cloud] Queued cloud request. 2026-09-16T03:50:38.361 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T03:50:38.361 [Cloud] Dequeued cloud request. 2026-09-16T03:50:38.361 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T03:50:38.517 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{17F9E1B1-41D4-1435-9A4F-653361478590} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 03:50:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T03:50:39.017 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T03:50:56.267 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T03:50:56.267 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T03:50:56.267 [Cloud] Queued cloud request. 2026-09-16T03:50:56.267 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T03:50:56.267 [Cloud] Dequeued cloud request. 2026-09-16T03:50:56.267 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T03:50:56.345 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{61654D37-FB9E-A4C2-C0A5-7B9EAF4A54C9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 03:50:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T03:50:56.861 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T03:54:59.989 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T03:54:59.989 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T03:54:59.989 [Cloud] Queued cloud request. 2026-09-16T03:54:59.989 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T03:54:59.989 [Cloud] Dequeued cloud request. 2026-09-16T03:54:59.989 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T03:55:00.160 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F22967AE-356C-445B-30D0-D46395642ACE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 03:55:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T03:55:00.660 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:00:48.131 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:00:48.131 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:00:48.131 [Cloud] Queued cloud request. 2026-09-16T04:00:48.131 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:00:48.131 [Cloud] Dequeued cloud request. 2026-09-16T04:00:48.131 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:00:48.288 [Cloud] End of cloud request. 2026-09-16T04:00:48.788 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:01:38.256 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T04:02:02.085 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:02:02.085 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:02:02.085 [Cloud] Queued cloud request. 2026-09-16T04:02:02.085 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:02:02.085 [Cloud] Dequeued cloud request. 2026-09-16T04:02:02.085 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:02:02.272 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{09F07D13-9517-5D55-9288-F957574DCC3F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 04:02:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T04:02:02.772 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:14:22.326 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:14:22.326 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:14:22.326 [Cloud] Queued cloud request. 2026-09-16T04:14:22.326 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:14:22.326 [Cloud] Dequeued cloud request. 2026-09-16T04:14:22.326 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:14:22.467 [Cloud] End of cloud request. 2026-09-16T04:14:22.982 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:16:43.265 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T04:17:24.187 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:17:24.187 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:17:24.187 [Cloud] Queued cloud request. 2026-09-16T04:17:24.187 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:17:24.187 [Cloud] Dequeued cloud request. 2026-09-16T04:17:24.187 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:17:24.312 [Cloud] End of cloud request. 2026-09-16T04:17:24.812 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:23:36.206 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:23:36.206 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:23:36.206 [Cloud] Queued cloud request. 2026-09-16T04:23:36.206 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:23:36.206 [Cloud] Dequeued cloud request. 2026-09-16T04:23:36.206 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:23:36.362 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{34E85B0D-C635-85C2-C59D-99FFF0A2A68D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 04:23:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T04:23:36.878 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:24:44.784 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:24:44.784 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:24:44.784 [Cloud] Queued cloud request. 2026-09-16T04:24:44.784 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:24:44.784 [Cloud] Dequeued cloud request. 2026-09-16T04:24:44.784 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:24:44.956 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{45D73EC0-52EF-0F1D-3EF0-47A5A9423F91} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 04:24:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T04:24:45.456 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:31:48.271 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T04:32:27.006 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:32:27.006 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:32:27.006 [Cloud] Queued cloud request. 2026-09-16T04:32:27.006 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:32:27.006 [Cloud] Dequeued cloud request. 2026-09-16T04:32:27.006 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:32:27.193 [Cloud] End of cloud request. 2026-09-16T04:32:27.693 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:36:23.930 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:36:23.930 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:36:23.930 [Cloud] Queued cloud request. 2026-09-16T04:36:23.930 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:36:23.930 [Cloud] Dequeued cloud request. 2026-09-16T04:36:23.930 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:36:24.071 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8371CAA-1F58-86F9-E931-0AB70893D8D1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 04:36:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T04:36:24.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:37:35.072 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:37:35.072 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:37:35.072 [Cloud] Queued cloud request. 2026-09-16T04:37:35.072 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:37:35.072 [Cloud] Dequeued cloud request. 2026-09-16T04:37:35.072 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:37:35.213 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E86247E8-E9A1-7BA3-1736-CD51B262A64B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 04:37:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T04:37:35.713 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:38:31.370 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:38:31.370 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:38:31.370 [Cloud] Queued cloud request. 2026-09-16T04:38:31.370 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:38:31.370 [Cloud] Dequeued cloud request. 2026-09-16T04:38:31.370 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:38:31.448 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{83871A84-8C3B-00FE-20AF-BC200F38C1C5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 04:38:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T04:38:31.948 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:46:53.279 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T04:52:46.376 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:52:46.376 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:52:46.376 [Cloud] Queued cloud request. 2026-09-16T04:52:46.376 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:52:46.376 [Cloud] Dequeued cloud request. 2026-09-16T04:52:46.376 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:52:46.548 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D9AEA93F-C222-02C5-3571-4C6CA2514B6A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 04:52:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T04:52:47.064 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:56:54.533 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:56:54.533 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:56:54.533 [Cloud] Queued cloud request. 2026-09-16T04:56:54.533 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:56:54.533 [Cloud] Dequeued cloud request. 2026-09-16T04:56:54.533 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:56:54.674 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F01BE2E0-A05A-A399-DD93-FE8FA168E2C2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 04:56:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T04:56:55.190 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T04:59:56.489 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T04:59:56.489 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T04:59:56.489 [Cloud] Queued cloud request. 2026-09-16T04:59:56.489 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T04:59:56.489 [Cloud] Dequeued cloud request. 2026-09-16T04:59:56.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T04:59:56.646 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9CFBBD7B-7E54-D554-5524-B047E25021E3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 04:59:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T04:59:57.161 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T05:01:58.287 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T05:09:42.979 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T05:09:42.979 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T05:09:42.979 [Cloud] Queued cloud request. 2026-09-16T05:09:42.979 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T05:09:42.979 [Cloud] Dequeued cloud request. 2026-09-16T05:09:42.979 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T05:09:43.135 [Cloud] End of cloud request. 2026-09-16T05:09:43.651 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T05:16:10.668 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T05:16:10.668 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T05:16:10.668 [Cloud] Queued cloud request. 2026-09-16T05:16:10.668 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T05:16:10.668 [Cloud] Dequeued cloud request. 2026-09-16T05:16:10.668 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T05:16:10.809 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0F491BBC-4D60-D317-BF8F-26DEF7724A7B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 05:16:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T05:16:11.325 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T05:17:03.293 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T05:23:27.876 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T05:23:27.876 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T05:23:27.876 [Cloud] Queued cloud request. 2026-09-16T05:23:27.876 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T05:23:27.876 [Cloud] Dequeued cloud request. 2026-09-16T05:23:27.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T05:23:28.282 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AA0CBC09-2141-15FB-90CD-FE9CFAF5F4F6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 05:23:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T05:23:28.782 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T05:25:22.939 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T05:25:22.939 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T05:25:22.939 [Cloud] Queued cloud request. 2026-09-16T05:25:22.939 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T05:25:22.939 [Cloud] Dequeued cloud request. 2026-09-16T05:25:22.939 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T05:25:23.079 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F5A7E840-5215-FCB4-ED0D-5247CE74DF47} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 05:25:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T05:25:23.595 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T05:26:10.189 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T05:26:10.189 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T05:26:10.189 [Cloud] Queued cloud request. 2026-09-16T05:26:10.189 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T05:26:10.189 [Cloud] Dequeued cloud request. 2026-09-16T05:26:10.189 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T05:26:10.267 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F65B984-082F-5183-3470-9758F9A8FC40} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 05:26:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T05:26:10.782 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T05:28:44.894 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 24760, Count: 1822, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-16T05:28:44.894 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 7852, Count: 654, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-16T05:28:44.894 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 3851, Count: 309, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T05:28:44.894 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-16T05:28:44.894 ProcessImageName: AgentShellService.exe, Pid: 2684, TotalTime: 728, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-16T05:28:44.894 ProcessImageName: WmiPrvSE.exe, Pid: 3308, TotalTime: 662, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-16T05:28:44.894 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 437, Count: 33, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-16T05:28:44.894 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T05:28:44.894 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 108, Count: 3, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T05:28:44.894 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-16T05:28:44.894 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16985-0.MAI, EstimatedImpact: 0% 2026-09-16T05:28:44.894 ProcessImageName: powershell.exe, Pid: 8004, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-16T05:28:44.894 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-16T05:28:44.894 ProcessImageName: mysqldump.exe, Pid: 6180, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-16T05:28:44.894 ProcessImageName: powershell.exe, Pid: 1628, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB1B5.tmp, EstimatedImpact: 0% 2026-09-16T05:28:44.894 ProcessImageName: DeviceCensus.exe, Pid: 4900, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 1% 2026-09-16T05:28:44.894 ProcessImageName: taskhostw.exe, Pid: 2100, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-16T05:28:44.894 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-16T05:28:44.894 ProcessImageName: cmd.exe, Pid: 6156, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-16T05:32:08.300 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T05:47:13.308 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T05:55:31.235 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T05:55:31.235 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T05:55:31.235 [Cloud] Queued cloud request. 2026-09-16T05:55:31.235 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T05:55:31.235 [Cloud] Dequeued cloud request. 2026-09-16T05:55:31.235 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T05:55:31.470 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FC380A0D-57DE-EAE2-D088-3F8D5A90C51C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 05:55:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T05:55:31.970 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T06:02:18.316 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T06:11:56.775 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T06:11:56.775 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T06:11:56.775 [Cloud] Queued cloud request. 2026-09-16T06:11:56.775 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T06:11:56.775 [Cloud] Dequeued cloud request. 2026-09-16T06:11:56.775 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T06:11:56.962 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2FB8115A-17F4-A42A-3462-53F384FE84E1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 06:11:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T06:11:57.478 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T06:12:36.025 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T06:12:36.025 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T06:12:36.025 [Cloud] Queued cloud request. 2026-09-16T06:12:36.025 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T06:12:36.025 [Cloud] Dequeued cloud request. 2026-09-16T06:12:36.025 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T06:12:36.103 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{407C158E-3B5D-04CD-875C-25A0904F2966} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 06:12:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T06:12:36.603 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T06:17:23.323 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T06:19:09.763 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T06:19:09.763 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T06:19:09.763 [Cloud] Queued cloud request. 2026-09-16T06:19:09.763 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T06:19:09.966 [Cloud] Dequeued cloud request. 2026-09-16T06:19:09.966 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T06:19:10.138 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C4A3ECA6-C6CB-8283-B65A-E8D2DA6A5CA9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 06:19:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T06:19:10.653 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T06:32:28.331 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T06:33:21.394 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T06:33:21.394 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T06:33:21.394 [Cloud] Queued cloud request. 2026-09-16T06:33:21.394 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T06:33:21.394 [Cloud] Dequeued cloud request. 2026-09-16T06:33:21.394 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T06:33:21.582 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B11261B2-8EEA-EF9C-460A-CD4A3A1FE69D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 06:33:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T06:33:22.097 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T06:38:38.991 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T06:38:38.991 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T06:38:38.991 [Cloud] Queued cloud request. 2026-09-16T06:38:38.991 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T06:38:38.991 [Cloud] Dequeued cloud request. 2026-09-16T06:38:38.991 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T06:38:39.350 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{20C8D2D5-9385-941C-8048-8467CC9572B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 06:38:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T06:38:39.866 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T06:42:09.335 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T06:42:09.335 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T06:42:09.335 [Cloud] Queued cloud request. 2026-09-16T06:42:09.335 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T06:42:09.335 [Cloud] Dequeued cloud request. 2026-09-16T06:42:09.335 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T06:42:09.538 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{13821DD8-2D9C-70C7-0DC3-F28F78EC27D2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 06:42:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T06:42:10.038 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T06:47:33.339 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T06:58:46.844 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T06:58:46.844 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T06:58:46.844 [Cloud] Queued cloud request. 2026-09-16T06:58:46.844 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T06:58:46.844 [Cloud] Dequeued cloud request. 2026-09-16T06:58:46.844 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T06:58:47.048 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3C656084-FA9D-0A0F-C52B-728CDCD1AFD6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 06:58:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T06:58:47.563 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T07:02:38.346 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T07:15:16.868 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T07:15:16.868 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T07:15:16.868 [Cloud] Queued cloud request. 2026-09-16T07:15:16.868 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T07:15:16.868 [Cloud] Dequeued cloud request. 2026-09-16T07:15:16.868 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T07:15:17.103 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{00E0281D-10EB-FEA0-9BC0-D6FFCDB48625} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 07:15:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T07:15:17.603 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T07:17:43.354 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T07:25:23.215 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T07:25:23.215 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T07:25:23.215 [Cloud] Queued cloud request. 2026-09-16T07:25:23.215 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T07:25:23.215 [Cloud] Dequeued cloud request. 2026-09-16T07:25:23.215 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T07:25:23.622 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BF5EF15D-D5CF-E872-CCFD-7AC256E5AA4E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 07:25:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T07:25:24.122 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T07:28:44.953 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27986, Count: 2133, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-16T07:28:44.953 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 9894, Count: 830, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-16T07:28:44.953 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 3851, Count: 309, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T07:28:44.953 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-16T07:28:44.953 ProcessImageName: AgentShellService.exe, Pid: 2684, TotalTime: 728, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-16T07:28:44.953 ProcessImageName: WmiPrvSE.exe, Pid: 3308, TotalTime: 662, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-16T07:28:44.953 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 452, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-16T07:28:44.953 ProcessImageName: powershell.exe, Pid: 8156, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-16T07:28:44.953 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T07:28:44.953 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T07:28:44.953 ProcessImageName: python.exe, Pid: 5932, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 4% 2026-09-16T07:28:44.953 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-16T07:28:44.953 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 62, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16985-0.MAI, EstimatedImpact: 0% 2026-09-16T07:28:44.953 ProcessImageName: powershell.exe, Pid: 8004, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-16T07:28:44.953 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-16T07:28:44.953 ProcessImageName: mysqldump.exe, Pid: 6180, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-16T07:28:44.953 ProcessImageName: powershell.exe, Pid: 1628, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB1B5.tmp, EstimatedImpact: 0% 2026-09-16T07:28:44.953 ProcessImageName: DeviceCensus.exe, Pid: 4900, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 1% 2026-09-16T07:28:44.953 ProcessImageName: taskhostw.exe, Pid: 2100, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-16T07:28:44.953 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-16T07:28:44.953 ProcessImageName: cmd.exe, Pid: 6156, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-16T07:32:11.625 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T07:32:11.625 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T07:32:11.625 [Cloud] Queued cloud request. 2026-09-16T07:32:11.625 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T07:32:11.625 [Cloud] Dequeued cloud request. 2026-09-16T07:32:11.625 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T07:32:11.828 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EF100857-548B-934D-9F7F-7227409C7EEE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 07:32:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T07:32:12.344 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T07:32:48.359 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T07:47:53.369 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T08:02:58.376 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T08:12:03.162 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T08:12:03.162 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T08:12:03.162 [Cloud] Queued cloud request. 2026-09-16T08:12:03.162 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T08:12:03.162 [Cloud] Dequeued cloud request. 2026-09-16T08:12:03.162 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T08:12:03.428 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B68A3BDB-EB49-8226-72E9-231E526461DB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 08:12:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T08:12:03.943 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T08:18:03.384 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T08:26:49.652 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\$Extend\$Deleted\00200000000137BF6511D679. Process: \Device\HarddiskVolume2\Windows\System32\svchost.exe, Status: 0xc0000001, State: 0, ScanRequest #6597047, FileId: 0x200000000137bf, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x2000, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T08:33:08.391 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T08:40:10.690 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T08:40:10.690 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T08:40:10.690 [Cloud] Queued cloud request. 2026-09-16T08:40:10.690 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T08:40:10.690 [Cloud] Dequeued cloud request. 2026-09-16T08:40:10.690 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T08:40:10.847 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6701B341-E07D-363F-1E39-ABE300AA3C80} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 08:40:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T08:40:11.362 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T08:48:13.399 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T08:50:02.508 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T08:50:02.508 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T08:50:02.508 [Cloud] Queued cloud request. 2026-09-16T08:50:02.508 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T08:50:02.664 [Cloud] Dequeued cloud request. 2026-09-16T08:50:02.664 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T08:50:02.805 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8A299EB3-C693-CF10-1420-E2D79D80CB3D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 08:50:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T08:50:03.305 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T09:01:13.903 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T09:01:13.903 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T09:01:13.903 [Cloud] Queued cloud request. 2026-09-16T09:01:13.903 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T09:01:13.903 [Cloud] Dequeued cloud request. 2026-09-16T09:01:13.903 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T09:01:28.357 [Cloud] End of cloud request. 2026-09-16T09:01:28.857 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T09:03:18.406 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T09:05:51.859 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T09:05:51.859 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T09:05:51.859 [Cloud] Queued cloud request. 2026-09-16T09:05:51.859 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T09:05:51.859 [Cloud] Dequeued cloud request. 2026-09-16T09:05:51.859 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T09:05:55.062 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2A47EE34-B9B4-8376-3268-EDC5C595F540} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 09:05:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T09:05:55.562 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T09:16:24.537 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T09:16:24.537 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T09:16:24.537 [Cloud] Queued cloud request. 2026-09-16T09:16:24.537 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T09:16:24.537 [Cloud] Dequeued cloud request. 2026-09-16T09:16:24.537 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T09:16:24.678 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DBF0AAE5-0E77-83AF-10F7-14326E63C3D8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 09:16:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T09:16:25.193 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T09:17:07.944 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T09:17:07.944 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T09:17:07.944 [Cloud] Queued cloud request. 2026-09-16T09:17:07.944 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T09:17:07.944 [Cloud] Dequeued cloud request. 2026-09-16T09:17:07.944 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T09:17:17.959 [Cloud] End of cloud request. 2026-09-16T09:17:18.459 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T09:18:22.054 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T09:18:22.054 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T09:18:22.054 [Cloud] Queued cloud request. 2026-09-16T09:18:22.054 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T09:18:22.054 [Cloud] Dequeued cloud request. 2026-09-16T09:18:22.054 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T09:18:22.210 [Cloud] End of cloud request. 2026-09-16T09:18:22.726 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T09:18:23.413 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T09:21:22.554 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T09:21:22.554 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T09:21:22.554 [Cloud] Queued cloud request. 2026-09-16T09:21:22.554 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T09:21:22.554 [Cloud] Dequeued cloud request. 2026-09-16T09:21:22.554 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T09:21:22.710 [Cloud] End of cloud request. 2026-09-16T09:21:23.226 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T09:28:45.028 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 31109, Count: 2363, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-16T09:28:45.028 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 11983, Count: 1000, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-16T09:28:45.028 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 3851, Count: 309, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T09:28:45.028 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-16T09:28:45.028 ProcessImageName: AgentShellService.exe, Pid: 2684, TotalTime: 728, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-16T09:28:45.028 ProcessImageName: WmiPrvSE.exe, Pid: 3308, TotalTime: 662, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-16T09:28:45.028 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 482, Count: 37, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-16T09:28:45.028 ProcessImageName: powershell.exe, Pid: 8156, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-16T09:28:45.028 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T09:28:45.028 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T09:28:45.028 ProcessImageName: python.exe, Pid: 5932, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 4% 2026-09-16T09:28:45.028 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-16T09:28:45.028 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16985-0.MAI, EstimatedImpact: 0% 2026-09-16T09:28:45.028 ProcessImageName: powershell.exe, Pid: 8004, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-16T09:28:45.028 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-16T09:28:45.028 ProcessImageName: mysqldump.exe, Pid: 6180, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-16T09:28:45.028 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-16T09:28:45.028 ProcessImageName: powershell.exe, Pid: 1628, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB1B5.tmp, EstimatedImpact: 0% 2026-09-16T09:28:45.028 ProcessImageName: DeviceCensus.exe, Pid: 4900, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 1% 2026-09-16T09:28:45.028 ProcessImageName: taskhostw.exe, Pid: 2100, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-16T09:28:45.028 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-16T09:28:45.028 ProcessImageName: cmd.exe, Pid: 6156, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-16T09:31:22.044 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T09:31:22.044 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T09:31:22.044 [Cloud] Queued cloud request. 2026-09-16T09:31:22.044 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T09:31:22.044 [Cloud] Dequeued cloud request. 2026-09-16T09:31:22.044 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T09:31:32.185 [Cloud] End of cloud request. 2026-09-16T09:31:32.685 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T09:33:06.029 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T09:33:06.029 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T09:33:06.029 [Cloud] Queued cloud request. 2026-09-16T09:33:06.029 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T09:33:06.029 [Cloud] Dequeued cloud request. 2026-09-16T09:33:06.294 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T09:33:06.497 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8372CF8A-FFF6-8CF4-6BF0-B59F4A82E20E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 09:33:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T09:33:07.013 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T09:33:28.419 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T09:36:24.716 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T09:36:24.716 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T09:36:24.716 [Cloud] Queued cloud request. 2026-09-16T09:36:24.716 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T09:36:24.716 [Cloud] Dequeued cloud request. 2026-09-16T09:36:24.716 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T09:36:24.904 [Cloud] End of cloud request. 2026-09-16T09:36:25.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T09:36:29.091 [RTP] [Mini-filter] Copy hint telemetry notification (\Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\AgentShell.exe) sent successfully. 2026-09-16T09:42:17.050 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T09:42:17.050 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T09:42:17.050 [Cloud] Queued cloud request. 2026-09-16T09:42:17.050 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T09:42:17.050 [Cloud] Dequeued cloud request. 2026-09-16T09:42:17.050 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T09:42:17.206 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E49E44A5-4D9D-1ECB-2CF1-9674A3454650} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 09:42:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T09:42:17.722 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T09:46:53.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T09:46:53.925 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T09:46:53.925 [Cloud] Queued cloud request. 2026-09-16T09:46:53.925 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T09:46:53.925 [Cloud] Dequeued cloud request. 2026-09-16T09:46:53.925 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T09:46:54.128 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AA459B3F-AADD-6EA7-24ED-8C3889D4A961} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 09:46:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T09:46:54.644 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T09:48:33.428 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T10:03:38.435 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T10:09:12.438 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:09:12.438 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:09:12.438 [Cloud] Queued cloud request. 2026-09-16T10:09:12.438 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:09:12.688 [Cloud] Dequeued cloud request. 2026-09-16T10:09:12.875 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:09:13.110 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9132DC40-9D81-3C7D-CA60-C73A3F4D0BCF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 10:09:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T10:09:13.625 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:18:43.443 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T10:18:48.489 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:18:48.489 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:18:48.489 [Cloud] Queued cloud request. 2026-09-16T10:18:48.489 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:18:48.489 [Cloud] Dequeued cloud request. 2026-09-16T10:18:48.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:18:48.630 [Cloud] End of cloud request. 2026-09-16T10:18:49.130 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:18:53.318 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:18:53.318 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:18:53.318 [Cloud] Queued cloud request. 2026-09-16T10:18:53.318 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:18:53.318 [Cloud] Dequeued cloud request. 2026-09-16T10:18:53.318 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:18:53.411 [Cloud] End of cloud request. 2026-09-16T10:18:53.911 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:18:56.864 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:18:56.864 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:18:56.864 [Cloud] Queued cloud request. 2026-09-16T10:18:56.864 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:18:56.864 [Cloud] Dequeued cloud request. 2026-09-16T10:18:56.864 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:18:56.958 [Cloud] End of cloud request. 2026-09-16T10:18:57.474 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:18:59.036 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:18:59.036 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:18:59.036 [Cloud] Queued cloud request. 2026-09-16T10:18:59.036 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:18:59.036 [Cloud] Dequeued cloud request. 2026-09-16T10:18:59.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:18:59.130 [Cloud] End of cloud request. 2026-09-16T10:18:59.630 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:19:08.833 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:19:08.833 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:19:08.833 [Cloud] Queued cloud request. 2026-09-16T10:19:08.833 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:19:08.833 [Cloud] Dequeued cloud request. 2026-09-16T10:19:08.833 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:19:08.958 [Cloud] End of cloud request. 2026-09-16T10:19:09.458 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:19:14.739 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:19:14.739 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:19:14.739 [Cloud] Queued cloud request. 2026-09-16T10:19:14.739 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:19:14.739 [Cloud] Dequeued cloud request. 2026-09-16T10:19:14.739 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:19:15.880 [Cloud] End of cloud request. 2026-09-16T10:19:16.380 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:19:16.646 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:19:16.646 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:19:16.646 [Cloud] Queued cloud request. 2026-09-16T10:19:16.646 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:19:16.646 [Cloud] Dequeued cloud request. 2026-09-16T10:19:16.646 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:19:17.755 [Cloud] End of cloud request. 2026-09-16T10:19:18.255 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:19:32.318 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:19:32.318 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:19:32.318 [Cloud] Queued cloud request. 2026-09-16T10:19:32.318 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:19:32.318 [Cloud] Dequeued cloud request. 2026-09-16T10:19:32.318 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:19:32.396 [Cloud] End of cloud request. 2026-09-16T10:19:32.411 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:19:32.411 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:19:32.411 [Cloud] Queued cloud request. 2026-09-16T10:19:32.411 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:19:32.411 [Cloud] Dequeued cloud request. 2026-09-16T10:19:32.411 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:19:32.489 [Cloud] End of cloud request. 2026-09-16T10:19:32.911 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:19:34.286 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:19:34.286 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:19:34.286 [Cloud] Queued cloud request. 2026-09-16T10:19:34.286 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:19:34.286 [Cloud] Dequeued cloud request. 2026-09-16T10:19:34.286 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:19:34.614 [Cloud] End of cloud request. 2026-09-16T10:19:35.114 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:19:37.443 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:19:37.443 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:19:37.443 [Cloud] Queued cloud request. 2026-09-16T10:19:37.443 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:19:37.443 [Cloud] Dequeued cloud request. 2026-09-16T10:19:37.443 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:19:37.536 [Cloud] End of cloud request. 2026-09-16T10:19:37.536 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:19:37.536 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:19:37.536 [Cloud] Queued cloud request. 2026-09-16T10:19:37.536 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:19:37.536 [Cloud] Dequeued cloud request. 2026-09-16T10:19:37.536 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:19:37.630 [Cloud] End of cloud request. 2026-09-16T10:19:37.646 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:19:37.646 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:19:37.646 [Cloud] Queued cloud request. 2026-09-16T10:19:37.646 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:19:37.646 [Cloud] Dequeued cloud request. 2026-09-16T10:19:37.646 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:19:37.755 [Cloud] End of cloud request. 2026-09-16T10:19:38.036 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:19:40.552 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:19:40.552 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:19:40.552 [Cloud] Queued cloud request. 2026-09-16T10:19:40.552 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:19:40.552 [Cloud] Dequeued cloud request. 2026-09-16T10:19:40.552 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:19:40.630 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2BD3CEE1-31A0-9D69-3FAA-FAD9990F7E57} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 10:19:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T10:19:41.130 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:19:52.333 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:19:52.333 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:19:52.333 [Cloud] Queued cloud request. 2026-09-16T10:19:52.333 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:19:52.333 [Cloud] Dequeued cloud request. 2026-09-16T10:19:52.333 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:19:52.411 [Cloud] End of cloud request. 2026-09-16T10:19:52.911 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:19:57.786 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:19:57.786 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:19:57.786 [Cloud] Queued cloud request. 2026-09-16T10:19:57.786 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:19:57.786 [Cloud] Dequeued cloud request. 2026-09-16T10:19:57.786 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:20:01.802 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:20:01.802 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:20:01.802 [Cloud] Queued cloud request. 2026-09-16T10:20:01.802 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:20:01.802 [Cloud] Dequeued cloud request. 2026-09-16T10:20:01.802 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:20:02.161 [Cloud] End of cloud request. 2026-09-16T10:20:02.161 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:20:02.161 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:20:02.161 [Cloud] Queued cloud request. 2026-09-16T10:20:02.161 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:20:02.161 [Cloud] Dequeued cloud request. 2026-09-16T10:20:02.161 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:20:02.239 [Cloud] End of cloud request. 2026-09-16T10:20:02.255 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:20:02.255 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:20:02.255 [Cloud] Queued cloud request. 2026-09-16T10:20:02.255 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:20:02.255 [Cloud] Dequeued cloud request. 2026-09-16T10:20:02.255 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:20:02.349 [Cloud] End of cloud request. 2026-09-16T10:20:02.677 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:20:07.474 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:20:07.474 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:20:07.474 [Cloud] Queued cloud request. 2026-09-16T10:20:07.474 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:20:07.474 [Cloud] Dequeued cloud request. 2026-09-16T10:20:07.474 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:20:07.802 [Cloud] End of cloud request. 2026-09-16T10:20:07.818 [Cloud] End of cloud request. 2026-09-16T10:20:08.302 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:20:19.349 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:20:19.349 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:20:19.349 [Cloud] Queued cloud request. 2026-09-16T10:20:19.349 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:20:19.349 [Cloud] Dequeued cloud request. 2026-09-16T10:20:19.349 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:20:19.427 [Cloud] End of cloud request. 2026-09-16T10:20:19.943 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:20:23.693 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:20:23.693 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:20:23.693 [Cloud] Queued cloud request. 2026-09-16T10:20:23.693 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:20:23.693 [Cloud] Dequeued cloud request. 2026-09-16T10:20:23.693 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:20:23.771 [Cloud] End of cloud request. 2026-09-16T10:20:24.271 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:20:55.802 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:20:55.802 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:20:55.802 [Cloud] Queued cloud request. 2026-09-16T10:20:55.802 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:20:55.802 [Cloud] Dequeued cloud request. 2026-09-16T10:20:55.802 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:20:55.974 [Cloud] End of cloud request. 2026-09-16T10:20:56.474 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:20:57.974 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:20:57.974 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:20:57.974 [Cloud] Queued cloud request. 2026-09-16T10:20:57.974 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:20:57.974 [Cloud] Dequeued cloud request. 2026-09-16T10:20:57.974 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:20:58.068 [Cloud] End of cloud request. 2026-09-16T10:20:58.568 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:21:05.083 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:21:05.083 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:21:05.083 [Cloud] Queued cloud request. 2026-09-16T10:21:05.083 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:21:05.083 [Cloud] Dequeued cloud request. 2026-09-16T10:21:05.083 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:21:05.161 [Cloud] End of cloud request. 2026-09-16T10:21:05.661 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:21:08.318 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:21:08.318 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:21:08.318 [Cloud] Queued cloud request. 2026-09-16T10:21:08.318 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:21:08.318 [Cloud] Dequeued cloud request. 2026-09-16T10:21:08.318 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:21:08.396 [Cloud] End of cloud request. 2026-09-16T10:21:08.911 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:21:13.614 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:21:13.614 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:21:13.614 [Cloud] Queued cloud request. 2026-09-16T10:21:13.614 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:21:13.614 [Cloud] Dequeued cloud request. 2026-09-16T10:21:13.614 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:21:13.708 [Cloud] End of cloud request. 2026-09-16T10:21:14.208 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:21:21.427 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:21:21.427 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:21:21.427 [Cloud] Queued cloud request. 2026-09-16T10:21:21.427 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:21:21.427 [Cloud] Dequeued cloud request. 2026-09-16T10:21:21.427 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:21:21.505 [Cloud] End of cloud request. 2026-09-16T10:21:22.021 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:21:48.881 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:21:48.881 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:21:48.881 [Cloud] Queued cloud request. 2026-09-16T10:21:48.881 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:21:48.881 [Cloud] Dequeued cloud request. 2026-09-16T10:21:48.881 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:21:49.193 [Cloud] End of cloud request. 2026-09-16T10:21:49.709 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:21:55.819 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:21:55.819 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:21:55.819 [Cloud] Queued cloud request. 2026-09-16T10:21:55.819 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:21:55.819 [Cloud] Dequeued cloud request. 2026-09-16T10:21:55.819 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:21:55.959 [Cloud] End of cloud request. 2026-09-16T10:21:56.475 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:22:07.553 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:22:07.553 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:22:07.553 [Cloud] Queued cloud request. 2026-09-16T10:22:07.553 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:22:07.553 [Cloud] Dequeued cloud request. 2026-09-16T10:22:07.553 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:22:07.631 [Cloud] End of cloud request. 2026-09-16T10:22:08.131 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:22:11.725 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:22:11.725 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:22:11.725 [Cloud] Queued cloud request. 2026-09-16T10:22:11.725 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:22:11.725 [Cloud] Dequeued cloud request. 2026-09-16T10:22:11.725 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:22:12.038 [Cloud] End of cloud request. 2026-09-16T10:22:12.553 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:22:16.975 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:22:16.975 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:22:16.975 [Cloud] Queued cloud request. 2026-09-16T10:22:16.975 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:22:16.975 [Cloud] Dequeued cloud request. 2026-09-16T10:22:16.975 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:22:17.069 [Cloud] End of cloud request. 2026-09-16T10:22:17.585 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:22:42.944 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:22:42.944 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:22:42.944 [Cloud] Queued cloud request. 2026-09-16T10:22:42.944 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:22:42.944 [Cloud] Dequeued cloud request. 2026-09-16T10:22:42.944 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:22:43.023 [Cloud] End of cloud request. 2026-09-16T10:22:43.538 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:22:48.570 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:22:48.570 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:22:48.570 [Cloud] Queued cloud request. 2026-09-16T10:22:48.570 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:22:48.570 [Cloud] Dequeued cloud request. 2026-09-16T10:22:48.570 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:22:48.648 [Cloud] End of cloud request. 2026-09-16T10:22:48.648 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:22:48.648 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:22:48.648 [Cloud] Queued cloud request. 2026-09-16T10:22:48.648 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:22:48.648 [Cloud] Dequeued cloud request. 2026-09-16T10:22:48.648 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:22:48.773 [Cloud] End of cloud request. 2026-09-16T10:22:49.148 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:23:10.616 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:23:10.616 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:23:10.616 [Cloud] Queued cloud request. 2026-09-16T10:23:10.616 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:23:10.616 [Cloud] Dequeued cloud request. 2026-09-16T10:23:10.616 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:23:10.710 [Cloud] End of cloud request. 2026-09-16T10:23:11.210 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:23:18.538 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:23:18.538 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:23:18.538 [Cloud] Queued cloud request. 2026-09-16T10:23:18.538 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:23:18.538 [Cloud] Dequeued cloud request. 2026-09-16T10:23:18.538 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:23:18.679 [Cloud] End of cloud request. 2026-09-16T10:23:19.195 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:23:29.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:23:29.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:23:29.304 [Cloud] Queued cloud request. 2026-09-16T10:23:29.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:23:29.304 [Cloud] Dequeued cloud request. 2026-09-16T10:23:29.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:23:29.398 [Cloud] End of cloud request. 2026-09-16T10:23:29.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:23:45.882 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:23:45.882 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:23:45.882 [Cloud] Queued cloud request. 2026-09-16T10:23:45.882 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:23:45.882 [Cloud] Dequeued cloud request. 2026-09-16T10:23:45.882 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:23:45.960 [Cloud] End of cloud request. 2026-09-16T10:23:45.960 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:23:45.960 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:23:45.960 [Cloud] Queued cloud request. 2026-09-16T10:23:45.960 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:23:45.960 [Cloud] Dequeued cloud request. 2026-09-16T10:23:45.976 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:23:46.038 [Cloud] End of cloud request. 2026-09-16T10:23:46.476 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:24:04.054 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:24:04.054 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:24:04.054 [Cloud] Queued cloud request. 2026-09-16T10:24:04.054 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:24:04.054 [Cloud] Dequeued cloud request. 2026-09-16T10:24:04.054 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:24:04.163 [Cloud] End of cloud request. 2026-09-16T10:24:04.679 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:24:25.538 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:24:25.538 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:24:25.538 [Cloud] Queued cloud request. 2026-09-16T10:24:25.538 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:24:25.538 [Cloud] Dequeued cloud request. 2026-09-16T10:24:25.538 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:24:25.616 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F1E6C916-FAF5-87F3-26D3-F54222495D12} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 10:24:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T10:24:26.116 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:24:36.007 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:24:36.007 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:24:36.007 [Cloud] Queued cloud request. 2026-09-16T10:24:36.007 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:24:36.007 [Cloud] Dequeued cloud request. 2026-09-16T10:24:36.007 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:24:36.085 [Cloud] End of cloud request. 2026-09-16T10:24:36.601 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:24:45.632 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:24:45.632 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:24:45.632 [Cloud] Queued cloud request. 2026-09-16T10:24:45.632 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:24:45.632 [Cloud] Dequeued cloud request. 2026-09-16T10:24:45.632 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:24:45.741 [Cloud] End of cloud request. 2026-09-16T10:24:46.241 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:24:47.054 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:24:47.054 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:24:47.054 [Cloud] Queued cloud request. 2026-09-16T10:24:47.054 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:24:47.054 [Cloud] Dequeued cloud request. 2026-09-16T10:24:47.054 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:24:47.132 [Cloud] End of cloud request. 2026-09-16T10:24:47.632 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:25:06.757 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:25:06.757 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:25:06.757 [Cloud] Queued cloud request. 2026-09-16T10:25:06.757 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:25:06.757 [Cloud] Dequeued cloud request. 2026-09-16T10:25:06.757 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:25:06.835 [Cloud] End of cloud request. 2026-09-16T10:25:07.335 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:25:15.023 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:25:15.023 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:25:15.023 [Cloud] Queued cloud request. 2026-09-16T10:25:15.023 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:25:15.023 [Cloud] Dequeued cloud request. 2026-09-16T10:25:15.023 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:25:15.101 [Cloud] End of cloud request. 2026-09-16T10:25:15.616 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:25:29.710 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:25:29.710 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:25:29.710 [Cloud] Queued cloud request. 2026-09-16T10:25:29.710 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:25:29.710 [Cloud] Dequeued cloud request. 2026-09-16T10:25:29.710 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:25:29.804 [Cloud] End of cloud request. 2026-09-16T10:25:30.304 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:25:36.257 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:25:36.257 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:25:36.257 [Cloud] Queued cloud request. 2026-09-16T10:25:36.257 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:25:36.257 [Cloud] Dequeued cloud request. 2026-09-16T10:25:36.257 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:25:36.335 [Cloud] End of cloud request. 2026-09-16T10:25:36.835 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:25:39.773 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:25:39.773 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:25:39.773 [Cloud] Queued cloud request. 2026-09-16T10:25:39.773 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:25:39.773 [Cloud] Dequeued cloud request. 2026-09-16T10:25:39.773 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:25:39.851 [Cloud] End of cloud request. 2026-09-16T10:25:40.367 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:25:41.851 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:25:41.851 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:25:41.851 [Cloud] Queued cloud request. 2026-09-16T10:25:41.851 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:25:41.851 [Cloud] Dequeued cloud request. 2026-09-16T10:25:41.851 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:25:41.945 [Cloud] End of cloud request. 2026-09-16T10:25:42.445 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:26:01.460 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:26:01.460 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:26:01.460 [Cloud] Queued cloud request. 2026-09-16T10:26:01.460 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:26:01.460 [Cloud] Dequeued cloud request. 2026-09-16T10:26:01.460 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:26:01.570 [Cloud] End of cloud request. 2026-09-16T10:26:02.085 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:26:04.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:26:04.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:26:04.304 [Cloud] Queued cloud request. 2026-09-16T10:26:04.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:26:04.304 [Cloud] Dequeued cloud request. 2026-09-16T10:26:04.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:26:05.742 [Cloud] End of cloud request. 2026-09-16T10:26:06.242 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:26:11.382 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:26:11.382 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:26:11.382 [Cloud] Queued cloud request. 2026-09-16T10:26:11.382 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:26:11.382 [Cloud] Dequeued cloud request. 2026-09-16T10:26:11.382 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:26:11.460 [Cloud] End of cloud request. 2026-09-16T10:26:11.976 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:26:18.960 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:26:18.960 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:26:18.960 [Cloud] Queued cloud request. 2026-09-16T10:26:18.960 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:26:18.960 [Cloud] Dequeued cloud request. 2026-09-16T10:26:18.960 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:26:19.038 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EE0CFFF7-08BD-18BA-1E20-8F608C6A864B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 10:26:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T10:26:19.554 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:26:21.476 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:26:21.476 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:26:21.476 [Cloud] Queued cloud request. 2026-09-16T10:26:21.476 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:26:21.476 [Cloud] Dequeued cloud request. 2026-09-16T10:26:21.476 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:26:21.554 [Cloud] End of cloud request. 2026-09-16T10:26:22.054 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:26:49.757 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:26:49.757 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:26:49.757 [Cloud] Queued cloud request. 2026-09-16T10:26:49.757 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:26:49.757 [Cloud] Dequeued cloud request. 2026-09-16T10:26:49.757 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:26:49.851 [Cloud] End of cloud request. 2026-09-16T10:26:50.367 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:27:22.586 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:27:22.586 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:27:22.586 [Cloud] Queued cloud request. 2026-09-16T10:27:22.586 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:27:22.586 [Cloud] Dequeued cloud request. 2026-09-16T10:27:22.586 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:27:22.664 [Cloud] End of cloud request. 2026-09-16T10:27:23.164 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:27:56.307 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:27:56.307 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:27:56.307 [Cloud] Queued cloud request. 2026-09-16T10:27:56.307 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:27:56.307 [Cloud] Dequeued cloud request. 2026-09-16T10:27:56.307 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:27:56.385 [Cloud] End of cloud request. 2026-09-16T10:27:56.900 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:28:11.744 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:28:11.744 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:28:11.744 [Cloud] Queued cloud request. 2026-09-16T10:28:11.744 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:28:11.744 [Cloud] Dequeued cloud request. 2026-09-16T10:28:11.744 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:28:11.838 [Cloud] End of cloud request. 2026-09-16T10:28:12.338 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:28:17.697 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:28:17.697 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:28:17.697 [Cloud] Queued cloud request. 2026-09-16T10:28:17.697 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:28:17.697 [Cloud] Dequeued cloud request. 2026-09-16T10:28:17.697 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:28:17.775 [Cloud] End of cloud request. 2026-09-16T10:28:18.275 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:28:52.057 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:28:52.057 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:28:52.057 [Cloud] Queued cloud request. 2026-09-16T10:28:52.057 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:28:52.057 [Cloud] Dequeued cloud request. 2026-09-16T10:28:52.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:28:52.166 [Cloud] End of cloud request. 2026-09-16T10:28:52.666 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:29:46.947 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:29:46.947 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:29:46.947 [Cloud] Queued cloud request. 2026-09-16T10:29:46.947 [Cloud] Dequeued cloud request. 2026-09-16T10:29:46.947 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:29:46.947 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:29:47.026 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AEC41E91-895B-46FC-57C1-F9097E544260} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 10:29:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T10:29:47.526 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:30:03.291 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:30:03.291 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:30:03.291 [Cloud] Queued cloud request. 2026-09-16T10:30:03.291 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:30:03.291 [Cloud] Dequeued cloud request. 2026-09-16T10:30:03.291 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:30:03.463 [Cloud] End of cloud request. 2026-09-16T10:30:03.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:30:23.322 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:30:23.322 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:30:23.322 [Cloud] Queued cloud request. 2026-09-16T10:30:23.322 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:30:23.322 [Cloud] Dequeued cloud request. 2026-09-16T10:30:23.322 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:30:23.401 [Cloud] End of cloud request. 2026-09-16T10:30:23.916 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:30:37.713 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:30:37.713 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:30:37.713 [Cloud] Queued cloud request. 2026-09-16T10:30:37.713 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:30:37.713 [Cloud] Dequeued cloud request. 2026-09-16T10:30:37.713 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:30:37.791 [Cloud] End of cloud request. 2026-09-16T10:30:38.291 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:31:00.495 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:31:00.495 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:31:00.495 [Cloud] Queued cloud request. 2026-09-16T10:31:00.495 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:31:00.495 [Cloud] Dequeued cloud request. 2026-09-16T10:31:00.495 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:31:00.573 [Cloud] End of cloud request. 2026-09-16T10:31:01.073 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:31:05.042 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:31:05.042 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:31:05.042 [Cloud] Queued cloud request. 2026-09-16T10:31:05.042 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:31:05.042 [Cloud] Dequeued cloud request. 2026-09-16T10:31:05.042 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:31:05.120 [Cloud] End of cloud request. 2026-09-16T10:31:05.620 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:31:13.026 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:31:13.026 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:31:13.026 [Cloud] Queued cloud request. 2026-09-16T10:31:13.026 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:31:13.026 [Cloud] Dequeued cloud request. 2026-09-16T10:31:13.026 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:31:13.105 [Cloud] End of cloud request. 2026-09-16T10:31:13.605 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:31:34.745 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:31:34.745 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:31:34.745 [Cloud] Queued cloud request. 2026-09-16T10:31:34.745 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:31:34.745 [Cloud] Dequeued cloud request. 2026-09-16T10:31:34.745 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:31:34.824 [Cloud] End of cloud request. 2026-09-16T10:31:35.339 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:31:52.777 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:31:52.777 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:31:52.777 [Cloud] Queued cloud request. 2026-09-16T10:31:52.777 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:31:52.777 [Cloud] Dequeued cloud request. 2026-09-16T10:31:52.777 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:32:02.808 [Cloud] End of cloud request. 2026-09-16T10:32:03.308 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:32:05.230 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:32:05.230 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:32:05.230 [Cloud] Queued cloud request. 2026-09-16T10:32:05.230 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:32:05.230 [Cloud] Dequeued cloud request. 2026-09-16T10:32:05.230 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:32:05.371 [Cloud] End of cloud request. 2026-09-16T10:32:05.887 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:33:05.090 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:33:05.090 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:33:05.090 [Cloud] Queued cloud request. 2026-09-16T10:33:05.090 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:33:05.090 [Cloud] Dequeued cloud request. 2026-09-16T10:33:05.090 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:33:05.184 [Cloud] End of cloud request. 2026-09-16T10:33:05.684 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:33:48.449 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T10:33:49.137 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:33:49.137 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:33:49.137 [Cloud] Queued cloud request. 2026-09-16T10:33:49.137 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:33:49.137 [Cloud] Dequeued cloud request. 2026-09-16T10:33:49.137 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:33:49.216 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F71C91D7-4B61-DC6E-2222-27B25D61865D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 10:33:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T10:33:49.731 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:34:13.699 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:34:13.699 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:34:13.699 [Cloud] Queued cloud request. 2026-09-16T10:34:13.699 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:34:13.699 [Cloud] Dequeued cloud request. 2026-09-16T10:34:13.699 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:34:13.777 [Cloud] End of cloud request. 2026-09-16T10:34:14.293 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:35:18.918 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:35:18.918 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:35:18.918 [Cloud] Queued cloud request. 2026-09-16T10:35:18.918 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:35:18.918 [Cloud] Dequeued cloud request. 2026-09-16T10:35:18.918 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:35:19.090 [Cloud] End of cloud request. 2026-09-16T10:35:19.606 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:35:27.215 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:35:27.215 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:35:27.215 [Cloud] Queued cloud request. 2026-09-16T10:35:27.215 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:35:27.215 [Cloud] Dequeued cloud request. 2026-09-16T10:35:27.215 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:35:27.293 [Cloud] End of cloud request. 2026-09-16T10:35:27.809 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:35:54.652 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:35:54.652 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:35:54.652 [Cloud] Queued cloud request. 2026-09-16T10:35:54.652 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:35:54.652 [Cloud] Dequeued cloud request. 2026-09-16T10:35:54.652 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:35:54.731 [Cloud] End of cloud request. 2026-09-16T10:35:55.231 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:36:06.215 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:36:06.215 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:36:06.215 [Cloud] Queued cloud request. 2026-09-16T10:36:06.215 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:36:06.215 [Cloud] Dequeued cloud request. 2026-09-16T10:36:06.215 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:36:16.246 [Cloud] End of cloud request. 2026-09-16T10:36:16.746 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:36:17.903 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:36:17.903 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:36:17.903 [Cloud] Queued cloud request. 2026-09-16T10:36:17.903 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:36:17.903 [Cloud] Dequeued cloud request. 2026-09-16T10:36:17.903 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:36:18.012 [Cloud] End of cloud request. 2026-09-16T10:36:18.512 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:36:48.731 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:36:48.731 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:36:48.731 [Cloud] Queued cloud request. 2026-09-16T10:36:48.731 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:36:48.731 [Cloud] Dequeued cloud request. 2026-09-16T10:36:48.731 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:36:48.824 [Cloud] End of cloud request. 2026-09-16T10:36:49.309 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:36:50.590 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:36:50.590 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:36:50.590 [Cloud] Queued cloud request. 2026-09-16T10:36:50.590 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:36:50.590 [Cloud] Dequeued cloud request. 2026-09-16T10:36:50.590 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:36:50.684 [Cloud] End of cloud request. 2026-09-16T10:36:51.184 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:37:34.279 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:37:34.279 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:37:34.279 [Cloud] Queued cloud request. 2026-09-16T10:37:34.279 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:37:34.279 [Cloud] Dequeued cloud request. 2026-09-16T10:37:34.279 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:37:34.748 [Cloud] End of cloud request. 2026-09-16T10:37:35.248 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:39:25.078 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:39:25.078 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:39:25.078 [Cloud] Queued cloud request. 2026-09-16T10:39:25.078 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:39:25.078 [Cloud] Dequeued cloud request. 2026-09-16T10:39:25.078 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:39:25.749 [Cloud] End of cloud request. 2026-09-16T10:39:26.265 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:39:28.687 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:39:28.687 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:39:28.687 [Cloud] Queued cloud request. 2026-09-16T10:39:28.687 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:39:28.687 [Cloud] Dequeued cloud request. 2026-09-16T10:39:28.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:39:29.343 [Cloud] End of cloud request. 2026-09-16T10:39:29.843 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:39:43.953 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:39:43.953 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:39:43.953 [Cloud] Queued cloud request. 2026-09-16T10:39:43.953 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:39:43.953 [Cloud] Dequeued cloud request. 2026-09-16T10:39:43.953 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:39:44.046 [Cloud] End of cloud request. 2026-09-16T10:39:44.546 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:39:45.296 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:39:45.296 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:39:45.296 [Cloud] Queued cloud request. 2026-09-16T10:39:45.296 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:39:45.296 [Cloud] Dequeued cloud request. 2026-09-16T10:39:45.296 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:39:45.374 [Cloud] End of cloud request. 2026-09-16T10:39:45.890 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:40:01.812 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:40:01.812 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:40:01.812 [Cloud] Queued cloud request. 2026-09-16T10:40:01.812 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:40:01.812 [Cloud] Dequeued cloud request. 2026-09-16T10:40:01.812 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:40:01.921 [Cloud] End of cloud request. 2026-09-16T10:40:02.421 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:40:05.046 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:40:05.046 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:40:05.046 [Cloud] Queued cloud request. 2026-09-16T10:40:05.046 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:40:05.046 [Cloud] Dequeued cloud request. 2026-09-16T10:40:05.046 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:40:05.328 [Cloud] End of cloud request. 2026-09-16T10:40:05.828 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:40:07.562 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:40:07.562 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:40:07.562 [Cloud] Queued cloud request. 2026-09-16T10:40:07.562 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:40:07.562 [Cloud] Dequeued cloud request. 2026-09-16T10:40:07.562 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:40:07.656 [Cloud] End of cloud request. 2026-09-16T10:40:08.156 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:40:15.281 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:40:15.281 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:40:15.281 [Cloud] Queued cloud request. 2026-09-16T10:40:15.281 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:40:15.281 [Cloud] Dequeued cloud request. 2026-09-16T10:40:15.281 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:40:15.359 [Cloud] End of cloud request. 2026-09-16T10:40:15.874 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:40:49.374 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:40:49.374 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:40:49.374 [Cloud] Queued cloud request. 2026-09-16T10:40:49.374 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:40:49.374 [Cloud] Dequeued cloud request. 2026-09-16T10:40:49.374 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:40:49.578 [Cloud] End of cloud request. 2026-09-16T10:40:50.078 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:41:21.390 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:41:21.390 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:41:21.390 [Cloud] Queued cloud request. 2026-09-16T10:41:21.390 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:41:21.390 [Cloud] Dequeued cloud request. 2026-09-16T10:41:21.390 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:41:21.468 [Cloud] End of cloud request. 2026-09-16T10:41:21.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:41:24.874 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:41:24.874 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:41:24.874 [Cloud] Queued cloud request. 2026-09-16T10:41:24.874 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:41:24.874 [Cloud] Dequeued cloud request. 2026-09-16T10:41:24.874 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:41:24.953 [Cloud] End of cloud request. 2026-09-16T10:41:25.468 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:41:35.374 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:41:35.374 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:41:35.374 [Cloud] Queued cloud request. 2026-09-16T10:41:35.374 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:41:35.374 [Cloud] Dequeued cloud request. 2026-09-16T10:41:35.374 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:41:35.453 [Cloud] End of cloud request. 2026-09-16T10:41:35.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:41:36.593 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:41:36.593 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:41:36.593 [Cloud] Queued cloud request. 2026-09-16T10:41:36.593 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:41:36.593 [Cloud] Dequeued cloud request. 2026-09-16T10:41:36.593 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:41:36.687 [Cloud] End of cloud request. 2026-09-16T10:41:37.187 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:43:47.312 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:43:47.312 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:43:47.312 [Cloud] Queued cloud request. 2026-09-16T10:43:47.312 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:43:47.312 [Cloud] Dequeued cloud request. 2026-09-16T10:43:47.312 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:43:47.499 [Cloud] End of cloud request. 2026-09-16T10:43:48.015 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:44:41.734 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:44:41.734 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:44:41.734 [Cloud] Queued cloud request. 2026-09-16T10:44:41.734 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:44:41.734 [Cloud] Dequeued cloud request. 2026-09-16T10:44:41.734 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:44:51.765 [Cloud] End of cloud request. 2026-09-16T10:44:52.265 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:45:04.547 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:45:04.547 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:45:04.547 [Cloud] Queued cloud request. 2026-09-16T10:45:04.547 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:45:04.547 [Cloud] Dequeued cloud request. 2026-09-16T10:45:04.547 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:45:04.640 [Cloud] End of cloud request. 2026-09-16T10:45:05.140 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:46:44.986 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:46:44.986 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:46:44.986 [Cloud] Queued cloud request. 2026-09-16T10:46:44.986 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:46:44.986 [Cloud] Dequeued cloud request. 2026-09-16T10:46:44.986 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:46:45.189 [Cloud] End of cloud request. 2026-09-16T10:46:45.689 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:48:53.457 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T10:48:58.301 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:48:58.301 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:48:58.301 [Cloud] Queued cloud request. 2026-09-16T10:48:58.301 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:48:58.301 [Cloud] Dequeued cloud request. 2026-09-16T10:48:58.301 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:48:58.488 [Cloud] End of cloud request. 2026-09-16T10:48:58.988 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:49:04.270 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:49:04.270 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:49:04.270 [Cloud] Queued cloud request. 2026-09-16T10:49:04.270 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:49:04.270 [Cloud] Dequeued cloud request. 2026-09-16T10:49:04.270 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:49:04.348 [Cloud] End of cloud request. 2026-09-16T10:49:04.848 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:49:51.285 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:49:51.285 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:49:51.285 [Cloud] Queued cloud request. 2026-09-16T10:49:51.285 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:49:51.285 [Cloud] Dequeued cloud request. 2026-09-16T10:49:51.285 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:49:51.363 [Cloud] End of cloud request. 2026-09-16T10:49:51.863 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:50:04.192 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:50:04.192 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:50:04.192 [Cloud] Queued cloud request. 2026-09-16T10:50:04.192 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:50:04.192 [Cloud] Dequeued cloud request. 2026-09-16T10:50:04.192 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:50:11.613 [Cloud] End of cloud request. 2026-09-16T10:50:12.113 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:52:16.818 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:52:16.818 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:52:16.818 [Cloud] Queued cloud request. 2026-09-16T10:52:16.818 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:52:16.818 [Cloud] Dequeued cloud request. 2026-09-16T10:52:16.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:52:17.021 [Cloud] End of cloud request. 2026-09-16T10:52:17.537 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:53:28.850 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:53:28.850 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:53:28.850 [Cloud] Queued cloud request. 2026-09-16T10:53:28.850 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:53:28.850 [Cloud] Dequeued cloud request. 2026-09-16T10:53:28.850 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:53:29.397 [Cloud] End of cloud request. 2026-09-16T10:53:29.912 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:53:43.538 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:53:43.538 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:53:43.538 [Cloud] Queued cloud request. 2026-09-16T10:53:43.538 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:53:43.538 [Cloud] Dequeued cloud request. 2026-09-16T10:53:43.538 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:53:43.631 [Cloud] End of cloud request. 2026-09-16T10:53:44.147 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:54:00.038 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:54:00.038 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:54:00.038 [Cloud] Queued cloud request. 2026-09-16T10:54:00.038 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:54:00.038 [Cloud] Dequeued cloud request. 2026-09-16T10:54:00.038 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:54:00.147 [Cloud] End of cloud request. 2026-09-16T10:54:00.647 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:54:06.741 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:54:06.741 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:54:06.741 [Cloud] Queued cloud request. 2026-09-16T10:54:06.741 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:54:06.741 [Cloud] Dequeued cloud request. 2026-09-16T10:54:06.741 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:54:06.819 [Cloud] End of cloud request. 2026-09-16T10:54:07.319 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T10:56:05.288 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T10:56:05.288 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T10:56:05.288 [Cloud] Queued cloud request. 2026-09-16T10:56:05.288 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T10:56:05.288 [Cloud] Dequeued cloud request. 2026-09-16T10:56:05.288 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T10:56:05.475 [Cloud] End of cloud request. 2026-09-16T10:56:05.975 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:03:58.464 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T11:19:03.472 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T11:26:16.459 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:26:16.459 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:26:16.459 [Cloud] Queued cloud request. 2026-09-16T11:26:16.459 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:26:16.459 [Cloud] Dequeued cloud request. 2026-09-16T11:26:16.459 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:26:16.662 [Cloud] End of cloud request. 2026-09-16T11:26:17.177 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:28:45.102 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 32497, Count: 2447, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-16T11:28:45.102 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 14165, Count: 1177, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-16T11:28:45.102 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 3851, Count: 309, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T11:28:45.102 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-16T11:28:45.102 ProcessImageName: AgentShellService.exe, Pid: 2684, TotalTime: 728, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-16T11:28:45.102 ProcessImageName: WmiPrvSE.exe, Pid: 3308, TotalTime: 662, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-16T11:28:45.102 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 512, Count: 39, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-16T11:28:45.102 ProcessImageName: powershell.exe, Pid: 8156, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-16T11:28:45.102 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T11:28:45.102 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T11:28:45.102 ProcessImageName: python.exe, Pid: 5932, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 4% 2026-09-16T11:28:45.102 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-16T11:28:45.102 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16985-0.MAI, EstimatedImpact: 0% 2026-09-16T11:28:45.102 ProcessImageName: powershell.exe, Pid: 8004, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-16T11:28:45.102 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-16T11:28:45.102 ProcessImageName: mysqldump.exe, Pid: 6180, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-16T11:28:45.102 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-16T11:28:45.102 ProcessImageName: powershell.exe, Pid: 1628, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB1B5.tmp, EstimatedImpact: 0% 2026-09-16T11:28:45.102 ProcessImageName: DeviceCensus.exe, Pid: 4900, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 1% 2026-09-16T11:28:45.102 ProcessImageName: taskhostw.exe, Pid: 2100, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-16T11:28:45.102 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-16T11:28:45.102 ProcessImageName: cmd.exe, Pid: 6156, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-16T11:29:39.008 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:29:39.008 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:29:39.008 [Cloud] Queued cloud request. 2026-09-16T11:29:39.008 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:29:39.008 [Cloud] Dequeued cloud request. 2026-09-16T11:29:39.024 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:29:39.742 [Cloud] End of cloud request. 2026-09-16T11:29:40.258 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:30:04.258 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:30:04.258 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:30:04.258 [Cloud] Queued cloud request. 2026-09-16T11:30:04.258 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:30:04.258 [Cloud] Dequeued cloud request. 2026-09-16T11:30:04.258 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:30:04.602 [Cloud] End of cloud request. 2026-09-16T11:30:05.102 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:34:08.479 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T11:39:18.106 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:39:18.106 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:39:18.106 [Cloud] Queued cloud request. 2026-09-16T11:39:18.106 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:39:18.106 [Cloud] Dequeued cloud request. 2026-09-16T11:39:18.106 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:39:18.325 [Cloud] End of cloud request. 2026-09-16T11:39:18.825 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:40:45.482 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:40:45.482 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:40:45.482 [Cloud] Queued cloud request. 2026-09-16T11:40:45.482 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:40:45.482 [Cloud] Dequeued cloud request. 2026-09-16T11:40:45.482 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:40:45.670 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1FA964D1-45B6-F3E5-679F-EAC506FC29EF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 11:40:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T11:40:46.170 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:41:47.592 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:41:47.592 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:41:47.592 [Cloud] Queued cloud request. 2026-09-16T11:41:47.592 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:41:47.592 [Cloud] Dequeued cloud request. 2026-09-16T11:41:47.592 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:41:47.795 [Cloud] End of cloud request. 2026-09-16T11:41:48.311 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:42:18.732 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:42:18.732 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:42:18.732 [Cloud] Queued cloud request. 2026-09-16T11:42:18.732 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:42:18.732 [Cloud] Dequeued cloud request. 2026-09-16T11:42:18.732 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:42:18.826 [Cloud] End of cloud request. 2026-09-16T11:42:19.326 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:44:05.842 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:44:05.842 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:44:05.842 [Cloud] Queued cloud request. 2026-09-16T11:44:05.842 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:44:05.842 [Cloud] Dequeued cloud request. 2026-09-16T11:44:05.842 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:44:06.045 [Cloud] End of cloud request. 2026-09-16T11:44:06.545 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:47:12.015 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:47:12.015 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:47:12.015 [Cloud] Queued cloud request. 2026-09-16T11:47:12.015 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:47:12.015 [Cloud] Dequeued cloud request. 2026-09-16T11:47:12.015 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:47:12.468 [Cloud] End of cloud request. 2026-09-16T11:47:12.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:48:06.611 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:48:06.611 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:48:06.611 [Cloud] Queued cloud request. 2026-09-16T11:48:06.611 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:48:06.611 [Cloud] Dequeued cloud request. 2026-09-16T11:48:06.611 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:48:06.736 [Cloud] End of cloud request. 2026-09-16T11:48:07.236 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:49:13.486 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T11:50:19.596 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:50:19.596 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:50:19.596 [Cloud] Queued cloud request. 2026-09-16T11:50:19.596 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:50:19.596 [Cloud] Dequeued cloud request. 2026-09-16T11:50:19.596 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:50:19.783 [Cloud] End of cloud request. 2026-09-16T11:50:20.283 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:50:54.940 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16b40-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6664178, FileId: 0x2700000003d67b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T11:50:54.940 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16b40-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6664177, FileId: 0x1700000003d803, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T11:54:35.567 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:54:35.567 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:54:35.567 [Cloud] Queued cloud request. 2026-09-16T11:54:35.567 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:54:35.723 [Cloud] Dequeued cloud request. 2026-09-16T11:54:35.723 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:54:35.863 [Cloud] End of cloud request. 2026-09-16T11:54:36.379 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:56:48.426 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:56:48.426 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:56:48.426 [Cloud] Queued cloud request. 2026-09-16T11:56:48.426 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:56:48.426 [Cloud] Dequeued cloud request. 2026-09-16T11:56:48.426 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:56:48.567 [Cloud] End of cloud request. 2026-09-16T11:56:48.567 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:56:48.567 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:56:48.567 [Cloud] Queued cloud request. 2026-09-16T11:56:48.567 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:56:48.567 [Cloud] Dequeued cloud request. 2026-09-16T11:56:48.567 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:56:48.645 [Cloud] End of cloud request. 2026-09-16T11:56:49.067 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:57:02.067 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:57:02.067 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:57:02.067 [Cloud] Queued cloud request. 2026-09-16T11:57:02.067 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:57:02.067 [Cloud] Dequeued cloud request. 2026-09-16T11:57:02.067 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:57:09.723 [Cloud] End of cloud request. 2026-09-16T11:57:10.238 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T11:57:19.911 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T11:57:19.911 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T11:57:19.911 [Cloud] Queued cloud request. 2026-09-16T11:57:19.911 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T11:57:19.911 [Cloud] Dequeued cloud request. 2026-09-16T11:57:19.911 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T11:57:19.989 [Cloud] End of cloud request. 2026-09-16T11:57:20.489 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:00:25.710 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:00:25.710 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:00:25.710 [Cloud] Queued cloud request. 2026-09-16T12:00:25.710 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:00:25.710 [Cloud] Dequeued cloud request. 2026-09-16T12:00:25.710 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:00:25.850 [Cloud] End of cloud request. 2026-09-16T12:00:26.350 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:00:31.507 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:00:31.507 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:00:31.507 [Cloud] Queued cloud request. 2026-09-16T12:00:31.507 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:00:31.507 [Cloud] Dequeued cloud request. 2026-09-16T12:00:31.507 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:00:31.616 [Cloud] End of cloud request. 2026-09-16T12:00:32.116 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:01:08.132 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:01:08.132 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:01:08.132 [Cloud] Queued cloud request. 2026-09-16T12:01:08.132 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:01:08.132 [Cloud] Dequeued cloud request. 2026-09-16T12:01:08.132 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:01:08.210 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5375B064-2E45-30FB-6074-6F3F6DC35F63} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 12:01:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T12:01:08.710 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:04:18.493 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T12:04:48.962 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:04:48.962 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:04:48.962 [Cloud] Queued cloud request. 2026-09-16T12:04:48.962 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:04:48.962 [Cloud] Dequeued cloud request. 2026-09-16T12:04:48.962 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:04:49.197 [Cloud] End of cloud request. 2026-09-16T12:04:49.712 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:06:30.806 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:06:30.806 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:06:30.806 [Cloud] Queued cloud request. 2026-09-16T12:06:30.806 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:06:30.806 [Cloud] Dequeued cloud request. 2026-09-16T12:06:30.806 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:06:30.994 [Cloud] End of cloud request. 2026-09-16T12:06:31.509 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:08:04.058 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:08:04.058 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:08:04.058 [Cloud] Queued cloud request. 2026-09-16T12:08:04.058 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:08:04.058 [Cloud] Dequeued cloud request. 2026-09-16T12:08:04.058 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:08:04.246 [Cloud] End of cloud request. 2026-09-16T12:08:04.761 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:10:25.340 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:10:25.340 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:10:25.340 [Cloud] Queued cloud request. 2026-09-16T12:10:25.340 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:10:25.340 [Cloud] Dequeued cloud request. 2026-09-16T12:10:25.340 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:10:25.527 [Cloud] End of cloud request. 2026-09-16T12:10:26.027 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:12:01.355 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:12:01.355 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:12:01.355 [Cloud] Queued cloud request. 2026-09-16T12:12:01.355 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:12:01.355 [Cloud] Dequeued cloud request. 2026-09-16T12:12:01.355 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:12:01.543 [Cloud] End of cloud request. 2026-09-16T12:12:02.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:13:15.433 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:13:15.433 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:13:15.433 [Cloud] Queued cloud request. 2026-09-16T12:13:15.433 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:13:15.433 [Cloud] Dequeued cloud request. 2026-09-16T12:13:15.433 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:13:15.637 [Cloud] End of cloud request. 2026-09-16T12:13:16.152 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:14:59.530 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:14:59.530 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:14:59.530 [Cloud] Queued cloud request. 2026-09-16T12:14:59.530 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:14:59.530 [Cloud] Dequeued cloud request. 2026-09-16T12:14:59.530 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:15:00.343 [Cloud] End of cloud request. 2026-09-16T12:15:00.843 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:18:40.407 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:18:40.407 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:18:40.407 [Cloud] Queued cloud request. 2026-09-16T12:18:40.407 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:18:40.407 [Cloud] Dequeued cloud request. 2026-09-16T12:18:40.407 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:18:40.548 [Cloud] End of cloud request. 2026-09-16T12:18:41.063 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:19:23.501 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T12:21:32.940 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:21:32.940 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:21:32.940 [Cloud] Queued cloud request. 2026-09-16T12:21:32.940 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:21:32.940 [Cloud] Dequeued cloud request. 2026-09-16T12:21:32.940 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:21:33.096 [Cloud] End of cloud request. 2026-09-16T12:21:33.612 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:24:04.675 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:24:04.675 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:24:04.675 [Cloud] Queued cloud request. 2026-09-16T12:24:04.675 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:24:04.675 [Cloud] Dequeued cloud request. 2026-09-16T12:24:04.675 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:24:04.831 [Cloud] End of cloud request. 2026-09-16T12:24:04.831 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:24:04.831 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:24:04.831 [Cloud] Queued cloud request. 2026-09-16T12:24:04.831 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:24:04.831 [Cloud] Dequeued cloud request. 2026-09-16T12:24:04.831 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:24:04.941 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B61E2B83-31E0-5E90-7B49-EDE615D95D47} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 12:24:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T12:24:05.331 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:26:18.238 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:26:18.238 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:26:18.238 [Cloud] Queued cloud request. 2026-09-16T12:26:18.238 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:26:18.238 [Cloud] Dequeued cloud request. 2026-09-16T12:26:18.394 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:26:18.550 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F37C8C35-E473-BDBB-F468-49398D2D06A3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 12:26:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T12:26:19.050 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:27:24.301 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:27:24.301 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:27:24.301 [Cloud] Queued cloud request. 2026-09-16T12:27:24.301 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:27:24.301 [Cloud] Dequeued cloud request. 2026-09-16T12:27:24.301 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:27:24.457 [Cloud] End of cloud request. 2026-09-16T12:27:24.957 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:27:59.334 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:27:59.334 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:27:59.334 [Cloud] Queued cloud request. 2026-09-16T12:27:59.334 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:27:59.334 [Cloud] Dequeued cloud request. 2026-09-16T12:27:59.334 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:27:59.412 [Cloud] End of cloud request. 2026-09-16T12:27:59.927 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:28:36.912 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:28:36.912 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:28:36.912 [Cloud] Queued cloud request. 2026-09-16T12:28:36.912 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:28:36.912 [Cloud] Dequeued cloud request. 2026-09-16T12:28:36.912 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:28:36.990 [Cloud] End of cloud request. 2026-09-16T12:28:37.506 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:29:20.756 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:29:20.756 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:29:20.756 [Cloud] Queued cloud request. 2026-09-16T12:29:20.756 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:29:20.756 [Cloud] Dequeued cloud request. 2026-09-16T12:29:20.756 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:29:21.068 [Cloud] End of cloud request. 2026-09-16T12:29:21.584 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:30:45.021 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:30:45.021 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:30:45.021 [Cloud] Queued cloud request. 2026-09-16T12:30:45.021 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:30:45.021 [Cloud] Dequeued cloud request. 2026-09-16T12:30:45.178 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:30:45.318 [Cloud] End of cloud request. 2026-09-16T12:30:45.818 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:30:52.803 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:30:52.803 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:30:52.803 [Cloud] Queued cloud request. 2026-09-16T12:30:52.803 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:30:52.803 [Cloud] Dequeued cloud request. 2026-09-16T12:30:52.803 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:30:52.912 [Cloud] End of cloud request. 2026-09-16T12:30:53.412 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:30:58.006 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:30:58.006 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:30:58.006 [Cloud] Queued cloud request. 2026-09-16T12:30:58.006 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:30:58.006 [Cloud] Dequeued cloud request. 2026-09-16T12:30:58.006 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:30:58.099 [Cloud] End of cloud request. 2026-09-16T12:30:58.599 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:33:08.475 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:33:08.475 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:33:08.475 [Cloud] Queued cloud request. 2026-09-16T12:33:08.475 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:33:08.475 [Cloud] Dequeued cloud request. 2026-09-16T12:33:08.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:33:08.632 [Cloud] End of cloud request. 2026-09-16T12:33:09.132 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:33:13.226 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:33:13.226 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:33:13.226 [Cloud] Queued cloud request. 2026-09-16T12:33:13.226 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:33:13.226 [Cloud] Dequeued cloud request. 2026-09-16T12:33:13.226 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:33:13.351 [Cloud] End of cloud request. 2026-09-16T12:33:13.866 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:34:05.852 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:34:05.852 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:34:05.852 [Cloud] Queued cloud request. 2026-09-16T12:34:05.852 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:34:05.852 [Cloud] Dequeued cloud request. 2026-09-16T12:34:05.852 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:34:05.930 [Cloud] End of cloud request. 2026-09-16T12:34:06.446 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:34:28.508 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T12:36:37.368 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:36:37.368 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:36:37.368 [Cloud] Queued cloud request. 2026-09-16T12:36:37.368 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:36:37.368 [Cloud] Dequeued cloud request. 2026-09-16T12:36:37.368 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:36:37.836 [Cloud] End of cloud request. 2026-09-16T12:36:38.352 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:42:38.403 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16b80-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6681573, FileId: 0x1d00000003c7d9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T12:42:38.403 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16b80-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6681572, FileId: 0x1800000003d88a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T12:46:30.342 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16b85-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6682864, FileId: 0x37000000037a94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T12:46:30.342 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16b85-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6682863, FileId: 0x1e00000003d909, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T12:48:08.906 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:48:08.906 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:48:08.906 [Cloud] Queued cloud request. 2026-09-16T12:48:08.906 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:48:09.078 [Cloud] Dequeued cloud request. 2026-09-16T12:48:09.078 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:48:09.250 [Cloud] End of cloud request. 2026-09-16T12:48:09.687 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16b88-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6683409, FileId: 0x2200000003d6e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T12:48:09.687 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16b88-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6683408, FileId: 0x1f00000003d909, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T12:48:09.765 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:48:52.703 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:48:52.703 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:48:52.703 [Cloud] Queued cloud request. 2026-09-16T12:48:52.703 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:48:52.703 [Cloud] Dequeued cloud request. 2026-09-16T12:48:52.703 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:48:52.797 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D502FAD9-FAAB-1D5D-5653-35ADBF3D7BDA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 12:48:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T12:48:53.297 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:49:27.531 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:49:27.531 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:49:27.531 [Cloud] Queued cloud request. 2026-09-16T12:49:27.531 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:49:27.531 [Cloud] Dequeued cloud request. 2026-09-16T12:49:27.531 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:49:28.000 [Cloud] End of cloud request. 2026-09-16T12:49:28.500 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:49:33.515 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T12:50:59.391 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:50:59.391 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:50:59.391 [Cloud] Queued cloud request. 2026-09-16T12:50:59.391 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:50:59.391 [Cloud] Dequeued cloud request. 2026-09-16T12:50:59.391 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:50:59.844 [Cloud] End of cloud request. 2026-09-16T12:51:00.360 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:51:51.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:51:51.657 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:51:51.657 [Cloud] Queued cloud request. 2026-09-16T12:51:51.657 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:51:51.657 [Cloud] Dequeued cloud request. 2026-09-16T12:51:51.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:51:52.376 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{711AD4A0-5098-B598-205B-31E1A9C0FBF0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 12:51:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T12:51:52.876 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:52:26.454 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:52:26.454 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:52:26.454 [Cloud] Queued cloud request. 2026-09-16T12:52:26.454 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:52:26.454 [Cloud] Dequeued cloud request. 2026-09-16T12:52:26.454 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:52:26.611 [Cloud] End of cloud request. 2026-09-16T12:52:27.111 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T12:54:05.080 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T12:54:05.080 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T12:54:05.080 [Cloud] Queued cloud request. 2026-09-16T12:54:05.080 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T12:54:05.080 [Cloud] Dequeued cloud request. 2026-09-16T12:54:05.080 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T12:54:05.268 [Cloud] End of cloud request. 2026-09-16T12:54:05.768 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:03:40.100 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16b9c-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6688526, FileId: 0x1700000003d76c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T13:03:40.100 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16b9c-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6688525, FileId: 0x1900000003d945, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T13:04:38.522 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T13:05:56.553 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:05:56.553 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:05:56.553 [Cloud] Queued cloud request. 2026-09-16T13:05:56.553 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:05:56.553 [Cloud] Dequeued cloud request. 2026-09-16T13:05:56.553 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:05:56.757 [Cloud] End of cloud request. 2026-09-16T13:05:57.272 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:06:05.147 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16ba0-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6689317, FileId: 0x1800000003d76c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T13:06:05.147 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16ba0-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6689316, FileId: 0x1a00000003d945, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T13:07:11.053 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16ba2-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6689684, FileId: 0x360000000378ce, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T13:07:11.053 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16ba2-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6689683, FileId: 0x1b00000003d945, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-16T13:09:04.681 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:09:04.681 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:09:04.681 [Cloud] Queued cloud request. 2026-09-16T13:09:04.681 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:09:04.681 [Cloud] Dequeued cloud request. 2026-09-16T13:09:04.681 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:09:04.869 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4FD12454-6897-EE10-F28A-8192C9D8BFE1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 13:09:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T13:09:05.369 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:09:30.525 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:09:30.525 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:09:30.525 [Cloud] Queued cloud request. 2026-09-16T13:09:30.525 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:09:30.525 [Cloud] Dequeued cloud request. 2026-09-16T13:09:30.525 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:09:30.603 [Cloud] End of cloud request. 2026-09-16T13:09:31.103 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:15:20.825 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:15:20.825 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:15:20.825 [Cloud] Queued cloud request. 2026-09-16T13:15:20.825 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:15:20.825 [Cloud] Dequeued cloud request. 2026-09-16T13:15:20.825 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:15:21.138 [Cloud] End of cloud request. 2026-09-16T13:15:21.653 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:19:43.530 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T13:24:35.624 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:24:35.624 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:24:35.624 [Cloud] Queued cloud request. 2026-09-16T13:24:35.624 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:24:35.624 [Cloud] Dequeued cloud request. 2026-09-16T13:24:35.624 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:24:35.812 [Cloud] End of cloud request. 2026-09-16T13:24:36.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:26:07.188 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:26:07.188 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:26:07.188 [Cloud] Queued cloud request. 2026-09-16T13:26:07.188 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:26:07.188 [Cloud] Dequeued cloud request. 2026-09-16T13:26:07.188 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:26:08.500 [Cloud] End of cloud request. 2026-09-16T13:26:09.000 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:28:45.160 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 40044, Count: 3170, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-16T13:28:45.160 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 16430, Count: 1342, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-16T13:28:45.160 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 3851, Count: 309, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T13:28:45.160 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-16T13:28:45.160 ProcessImageName: AgentShellService.exe, Pid: 2684, TotalTime: 728, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-16T13:28:45.160 ProcessImageName: WmiPrvSE.exe, Pid: 3308, TotalTime: 662, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-16T13:28:45.160 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 572, Count: 43, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-16T13:28:45.160 ProcessImageName: WmiPrvSE.exe, Pid: 6352, TotalTime: 362, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-16T13:28:45.160 ProcessImageName: powershell.exe, Pid: 8156, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-16T13:28:45.160 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T13:28:45.160 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 82, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16985-0.MAI, EstimatedImpact: 0% 2026-09-16T13:28:45.160 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T13:28:45.160 ProcessImageName: python.exe, Pid: 5932, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 4% 2026-09-16T13:28:45.160 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-16T13:28:45.160 ProcessImageName: powershell.exe, Pid: 8004, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-16T13:28:45.160 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-16T13:28:45.160 ProcessImageName: mysqldump.exe, Pid: 6180, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-16T13:28:45.160 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-16T13:28:45.160 ProcessImageName: powershell.exe, Pid: 1628, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB1B5.tmp, EstimatedImpact: 0% 2026-09-16T13:28:45.160 ProcessImageName: DeviceCensus.exe, Pid: 4900, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 1% 2026-09-16T13:28:45.160 ProcessImageName: taskhostw.exe, Pid: 2100, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-16T13:28:45.160 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-16T13:28:45.160 ProcessImageName: cmd.exe, Pid: 6156, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-16T13:30:12.550 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:30:12.550 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:30:12.550 [Cloud] Queued cloud request. 2026-09-16T13:30:12.550 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:30:12.550 [Cloud] Dequeued cloud request. 2026-09-16T13:30:12.550 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:30:12.754 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{16E1BDC1-E334-6749-F6A8-96271B5DC681} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 13:30:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T13:30:13.254 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:34:48.537 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T13:36:11.209 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:36:11.209 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:36:11.209 [Cloud] Queued cloud request. 2026-09-16T13:36:11.209 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:36:11.209 [Cloud] Dequeued cloud request. 2026-09-16T13:36:11.209 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:36:11.397 [Cloud] End of cloud request. 2026-09-16T13:36:11.897 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:37:51.555 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:37:51.555 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:37:51.555 [Cloud] Queued cloud request. 2026-09-16T13:37:51.555 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:37:51.555 [Cloud] Dequeued cloud request. 2026-09-16T13:37:51.555 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:37:51.742 [Cloud] End of cloud request. 2026-09-16T13:37:52.242 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:40:02.165 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:40:02.165 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:40:02.165 [Cloud] Queued cloud request. 2026-09-16T13:40:02.165 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:40:02.165 [Cloud] Dequeued cloud request. 2026-09-16T13:40:02.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:40:02.524 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C8F5C78E-324E-5E6D-9C81-64D010C0D227} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 13:40:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T13:40:03.024 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:45:35.543 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:45:35.543 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:45:35.543 [Cloud] Queued cloud request. 2026-09-16T13:45:35.543 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:45:35.543 [Cloud] Dequeued cloud request. 2026-09-16T13:45:35.543 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:45:35.730 [Cloud] End of cloud request. 2026-09-16T13:45:36.246 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:47:32.138 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:47:32.138 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:47:32.138 [Cloud] Queued cloud request. 2026-09-16T13:47:32.138 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:47:32.138 [Cloud] Dequeued cloud request. 2026-09-16T13:47:32.138 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:47:32.325 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2166D088-2335-6451-5D1F-D69CF4F9E941} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 13:47:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T13:47:32.841 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:49:53.545 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T13:50:01.123 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:50:01.123 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:50:01.123 [Cloud] Queued cloud request. 2026-09-16T13:50:01.123 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:50:01.123 [Cloud] Dequeued cloud request. 2026-09-16T13:50:01.123 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:50:07.123 [Cloud] End of cloud request. 2026-09-16T13:50:07.638 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:52:13.498 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:52:13.498 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:52:13.498 [Cloud] Queued cloud request. 2026-09-16T13:52:13.498 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:52:13.498 [Cloud] Dequeued cloud request. 2026-09-16T13:52:13.498 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:52:13.685 [Cloud] End of cloud request. 2026-09-16T13:52:14.185 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:57:23.032 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:57:23.032 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:57:23.032 [Cloud] Queued cloud request. 2026-09-16T13:57:23.032 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:57:23.282 [Cloud] Dequeued cloud request. 2026-09-16T13:57:23.282 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:57:23.454 [Cloud] End of cloud request. 2026-09-16T13:57:23.969 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:59:20.175 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:59:20.175 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:59:20.175 [Cloud] Queued cloud request. 2026-09-16T13:59:20.175 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:59:20.175 [Cloud] Dequeued cloud request. 2026-09-16T13:59:20.175 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:59:20.378 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{08A0A4AF-F0ED-0F57-4D3B-8BCB25DD1A43} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 13:59:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T13:59:20.878 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T13:59:47.019 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T13:59:47.019 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T13:59:47.019 [Cloud] Queued cloud request. 2026-09-16T13:59:47.019 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T13:59:47.019 [Cloud] Dequeued cloud request. 2026-09-16T13:59:47.019 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T13:59:47.097 [Cloud] End of cloud request. 2026-09-16T13:59:47.597 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T14:01:12.082 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T14:01:12.082 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T14:01:12.082 [Cloud] Queued cloud request. 2026-09-16T14:01:12.082 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T14:01:12.082 [Cloud] Dequeued cloud request. 2026-09-16T14:01:12.082 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T14:01:12.379 [Cloud] End of cloud request. 2026-09-16T14:01:12.879 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T14:02:01.098 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T14:02:01.098 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T14:02:01.098 [Cloud] Queued cloud request. 2026-09-16T14:02:01.098 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T14:02:01.098 [Cloud] Dequeued cloud request. 2026-09-16T14:02:01.098 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T14:02:01.191 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{997D4A65-F372-BCE7-7FFB-E9920C7EE227} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 14:02:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T14:02:01.691 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T14:03:03.457 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T14:03:03.457 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T14:03:03.457 [Cloud] Queued cloud request. 2026-09-16T14:03:03.457 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T14:03:03.457 [Cloud] Dequeued cloud request. 2026-09-16T14:03:03.457 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T14:03:03.644 [Cloud] End of cloud request. 2026-09-16T14:03:04.144 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T14:04:58.551 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T14:06:59.505 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T14:06:59.505 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T14:06:59.505 [Cloud] Queued cloud request. 2026-09-16T14:06:59.505 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T14:06:59.661 [Cloud] Dequeued cloud request. 2026-09-16T14:06:59.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T14:07:00.005 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B56DA1C6-B506-E680-6F38-D4A501C8E1EA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 14:07:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T14:07:00.521 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T14:20:03.559 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T14:35:08.566 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T14:40:51.460 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T14:40:51.460 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T14:40:51.460 [Cloud] Queued cloud request. 2026-09-16T14:40:51.460 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T14:40:51.460 [Cloud] Dequeued cloud request. 2026-09-16T14:40:51.460 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T14:40:51.631 [Cloud] End of cloud request. 2026-09-16T14:40:52.147 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T14:45:43.212 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T14:45:43.212 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T14:45:43.212 [Cloud] Queued cloud request. 2026-09-16T14:45:43.212 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T14:45:43.212 [Cloud] Dequeued cloud request. 2026-09-16T14:45:43.212 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T14:45:43.368 [Cloud] End of cloud request. 2026-09-16T14:45:43.884 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T14:46:17.431 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T14:46:17.431 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T14:46:17.431 [Cloud] Queued cloud request. 2026-09-16T14:46:17.431 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T14:46:17.431 [Cloud] Dequeued cloud request. 2026-09-16T14:46:17.431 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T14:46:17.509 [Cloud] End of cloud request. 2026-09-16T14:46:18.025 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T14:50:13.574 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T14:56:38.108 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T14:56:38.108 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T14:56:38.108 [Cloud] Queued cloud request. 2026-09-16T14:56:38.108 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T14:56:38.108 [Cloud] Dequeued cloud request. 2026-09-16T14:56:38.108 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T14:56:38.264 [Cloud] End of cloud request. 2026-09-16T14:56:38.764 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:05:18.580 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T15:08:38.193 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:08:38.193 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:08:38.193 [Cloud] Queued cloud request. 2026-09-16T15:08:38.193 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:08:38.365 [Cloud] Dequeued cloud request. 2026-09-16T15:08:38.365 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:08:38.505 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9174500C-9D08-9189-7EC8-921F82AF37B4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 15:08:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T15:08:39.021 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:10:46.396 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:10:46.396 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:10:46.396 [Cloud] Queued cloud request. 2026-09-16T15:10:46.396 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:10:46.396 [Cloud] Dequeued cloud request. 2026-09-16T15:10:46.396 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:10:46.630 [Cloud] End of cloud request. 2026-09-16T15:10:47.146 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:14:48.727 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:14:48.727 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:14:48.727 [Cloud] Queued cloud request. 2026-09-16T15:14:48.727 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:14:48.727 [Cloud] Dequeued cloud request. 2026-09-16T15:14:48.727 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:14:48.883 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1E8A787F-60A8-CD3D-806D-DFD4F1AA2008} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 15:14:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T15:14:49.383 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:17:07.414 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:17:07.414 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:17:07.414 [Cloud] Queued cloud request. 2026-09-16T15:17:07.414 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:17:07.414 [Cloud] Dequeued cloud request. 2026-09-16T15:17:07.414 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:17:07.571 [Cloud] End of cloud request. 2026-09-16T15:17:08.071 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:18:02.479 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:18:02.479 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:18:02.479 [Cloud] Queued cloud request. 2026-09-16T15:18:02.479 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:18:02.479 [Cloud] Dequeued cloud request. 2026-09-16T15:18:02.479 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:18:02.604 [Cloud] End of cloud request. 2026-09-16T15:18:03.104 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:20:15.354 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:20:15.354 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:20:15.354 [Cloud] Queued cloud request. 2026-09-16T15:20:15.354 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:20:15.354 [Cloud] Dequeued cloud request. 2026-09-16T15:20:15.354 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:20:23.588 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T15:20:25.479 [Cloud] End of cloud request. 2026-09-16T15:20:25.995 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:20:54.527 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:20:54.527 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:20:54.527 [Cloud] Queued cloud request. 2026-09-16T15:20:54.527 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:20:54.527 [Cloud] Dequeued cloud request. 2026-09-16T15:20:54.527 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:20:54.605 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8D110223-CC64-2AD5-19EC-5C2B8DFA52E7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 15:20:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T15:20:55.105 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:22:37.746 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:22:37.746 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:22:37.746 [Cloud] Queued cloud request. 2026-09-16T15:22:37.746 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:22:37.746 [Cloud] Dequeued cloud request. 2026-09-16T15:22:37.746 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:22:37.949 [Cloud] End of cloud request. 2026-09-16T15:22:38.449 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:24:30.888 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:24:30.888 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:24:30.888 [Cloud] Queued cloud request. 2026-09-16T15:24:30.888 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:24:30.888 [Cloud] Dequeued cloud request. 2026-09-16T15:24:30.888 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:24:31.107 [Cloud] End of cloud request. 2026-09-16T15:24:31.622 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:24:57.372 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:24:57.372 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:24:57.372 [Cloud] Queued cloud request. 2026-09-16T15:24:57.372 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:24:57.372 [Cloud] Dequeued cloud request. 2026-09-16T15:24:57.372 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:24:59.279 [Cloud] End of cloud request. 2026-09-16T15:24:59.779 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:27:09.310 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:27:09.310 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:27:09.310 [Cloud] Queued cloud request. 2026-09-16T15:27:09.310 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:27:09.310 [Cloud] Dequeued cloud request. 2026-09-16T15:27:09.310 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:27:09.497 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F55BB68D-4EEA-1754-7C4E-46417040D484} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 15:27:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T15:27:09.997 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:27:36.280 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:27:36.280 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:27:36.280 [Cloud] Queued cloud request. 2026-09-16T15:27:36.280 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:27:36.280 [Cloud] Dequeued cloud request. 2026-09-16T15:27:36.280 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:27:36.358 [Cloud] End of cloud request. 2026-09-16T15:27:36.858 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:28:45.218 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 40441, Count: 3196, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-16T15:28:45.218 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 18600, Count: 1513, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-16T15:28:45.218 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 3851, Count: 309, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T15:28:45.218 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-16T15:28:45.218 ProcessImageName: AgentShellService.exe, Pid: 2684, TotalTime: 728, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-16T15:28:45.218 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 708, Count: 51, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-16T15:28:45.218 ProcessImageName: WmiPrvSE.exe, Pid: 3308, TotalTime: 662, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-16T15:28:45.218 ProcessImageName: WmiPrvSE.exe, Pid: 6352, TotalTime: 362, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-16T15:28:45.218 ProcessImageName: powershell.exe, Pid: 8156, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-16T15:28:45.218 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T15:28:45.218 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 82, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16985-0.MAI, EstimatedImpact: 0% 2026-09-16T15:28:45.218 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T15:28:45.218 ProcessImageName: python.exe, Pid: 5932, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 4% 2026-09-16T15:28:45.218 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-16T15:28:45.218 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 75, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\413BEACF254440BAA7258AEC91B5336B.MAI, EstimatedImpact: 53% 2026-09-16T15:28:45.218 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-16T15:28:45.218 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-16T15:28:45.218 ProcessImageName: powershell.exe, Pid: 8004, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-16T15:28:45.218 ProcessImageName: mysqldump.exe, Pid: 6180, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-16T15:28:45.218 ProcessImageName: powershell.exe, Pid: 1628, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB1B5.tmp, EstimatedImpact: 0% 2026-09-16T15:28:45.218 ProcessImageName: DeviceCensus.exe, Pid: 4900, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 1% 2026-09-16T15:28:45.218 ProcessImageName: taskhostw.exe, Pid: 2100, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-16T15:28:45.218 ProcessImageName: cmd.exe, Pid: 6156, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-16T15:28:45.218 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-16T15:33:59.111 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:33:59.111 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:33:59.111 [Cloud] Queued cloud request. 2026-09-16T15:33:59.111 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:33:59.111 [Cloud] Dequeued cloud request. 2026-09-16T15:33:59.111 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:33:59.299 [Cloud] End of cloud request. 2026-09-16T15:33:59.799 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:35:28.596 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T15:35:46.018 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:35:46.018 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:35:46.018 [Cloud] Queued cloud request. 2026-09-16T15:35:46.018 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:35:46.018 [Cloud] Dequeued cloud request. 2026-09-16T15:35:46.033 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:35:46.174 [Cloud] End of cloud request. 2026-09-16T15:35:46.690 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:37:12.627 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:37:12.627 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:37:12.627 [Cloud] Queued cloud request. 2026-09-16T15:37:12.627 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:37:12.627 [Cloud] Dequeued cloud request. 2026-09-16T15:37:12.627 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:37:12.768 [Cloud] End of cloud request. 2026-09-16T15:37:13.283 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:37:16.424 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:37:16.424 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:37:16.424 [Cloud] Queued cloud request. 2026-09-16T15:37:16.424 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:37:16.424 [Cloud] Dequeued cloud request. 2026-09-16T15:37:16.424 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:37:16.518 [Cloud] End of cloud request. 2026-09-16T15:37:17.018 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:37:38.613 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:37:38.613 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:37:38.613 [Cloud] Queued cloud request. 2026-09-16T15:37:38.613 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:37:38.613 [Cloud] Dequeued cloud request. 2026-09-16T15:37:38.613 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:37:38.691 [Cloud] End of cloud request. 2026-09-16T15:37:39.207 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:38:01.379 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:38:01.379 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:38:01.379 [Cloud] Queued cloud request. 2026-09-16T15:38:01.379 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:38:01.379 [Cloud] Dequeued cloud request. 2026-09-16T15:38:01.379 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:38:01.457 [Cloud] End of cloud request. 2026-09-16T15:38:01.957 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:39:34.457 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:39:34.457 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:39:34.457 [Cloud] Queued cloud request. 2026-09-16T15:39:34.457 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:39:34.457 [Cloud] Dequeued cloud request. 2026-09-16T15:39:34.457 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:39:40.129 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:39:40.129 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:39:40.129 [Cloud] Queued cloud request. 2026-09-16T15:39:40.129 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:39:40.129 [Cloud] Dequeued cloud request. 2026-09-16T15:39:40.129 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:39:40.301 [Cloud] End of cloud request. 2026-09-16T15:39:40.817 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:39:44.536 [Cloud] End of cloud request. 2026-09-16T15:39:45.051 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:40:08.723 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:40:08.723 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:40:08.723 [Cloud] Queued cloud request. 2026-09-16T15:40:08.723 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:40:08.723 [Cloud] Dequeued cloud request. 2026-09-16T15:40:08.723 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:40:18.739 [Cloud] End of cloud request. 2026-09-16T15:40:19.254 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:40:56.629 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:40:56.629 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:40:56.629 [Cloud] Queued cloud request. 2026-09-16T15:40:56.629 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:40:56.629 [Cloud] Dequeued cloud request. 2026-09-16T15:40:56.629 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:40:56.707 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{777B72CC-7E84-F534-A27A-3E6641DE3130} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 15:40:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T15:40:57.223 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:41:34.036 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:41:34.036 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:41:34.036 [Cloud] Queued cloud request. 2026-09-16T15:41:34.036 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:41:34.036 [Cloud] Dequeued cloud request. 2026-09-16T15:41:34.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:41:40.348 [Cloud] End of cloud request. 2026-09-16T15:41:40.864 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:46:33.506 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:46:33.506 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:46:33.506 [Cloud] Queued cloud request. 2026-09-16T15:46:33.506 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:46:33.506 [Cloud] Dequeued cloud request. 2026-09-16T15:46:33.506 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:46:33.647 [Cloud] End of cloud request. 2026-09-16T15:46:34.147 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:48:38.244 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:48:38.244 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:48:38.244 [Cloud] Queued cloud request. 2026-09-16T15:48:38.244 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:48:38.244 [Cloud] Dequeued cloud request. 2026-09-16T15:48:38.244 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:48:38.384 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C8AAD463-251F-877D-9155-701F39FE8A39} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 15:48:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T15:48:38.884 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:50:33.603 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T15:54:59.340 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:54:59.340 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:54:59.340 [Cloud] Queued cloud request. 2026-09-16T15:54:59.340 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:54:59.340 [Cloud] Dequeued cloud request. 2026-09-16T15:54:59.340 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:54:59.481 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F221CF9C-AC9C-DDC8-6E81-585A3C5710A0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 15:54:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T15:54:59.997 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T15:55:56.622 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T15:55:56.622 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T15:55:56.622 [Cloud] Queued cloud request. 2026-09-16T15:55:56.622 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T15:55:56.622 [Cloud] Dequeued cloud request. 2026-09-16T15:55:56.622 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T15:55:56.700 [Cloud] End of cloud request. 2026-09-16T15:55:57.216 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:00:02.170 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:00:02.170 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:00:02.170 [Cloud] Queued cloud request. 2026-09-16T16:00:02.170 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:00:02.170 [Cloud] Dequeued cloud request. 2026-09-16T16:00:02.170 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:00:12.452 [Cloud] End of cloud request. 2026-09-16T16:00:12.952 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:02:13.594 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:02:13.594 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:02:13.594 [Cloud] Queued cloud request. 2026-09-16T16:02:13.594 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:02:13.594 [Cloud] Dequeued cloud request. 2026-09-16T16:02:13.594 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:02:23.719 [Cloud] End of cloud request. 2026-09-16T16:02:24.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:02:27.422 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:02:27.422 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:02:27.422 [Cloud] Queued cloud request. 2026-09-16T16:02:27.422 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:02:27.422 [Cloud] Dequeued cloud request. 2026-09-16T16:02:27.422 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:02:27.516 [Cloud] End of cloud request. 2026-09-16T16:02:28.031 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:05:20.344 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:05:20.344 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:05:20.344 [Cloud] Queued cloud request. 2026-09-16T16:05:20.344 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:05:20.344 [Cloud] Dequeued cloud request. 2026-09-16T16:05:20.344 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:05:20.547 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B99E8BAE-13B9-3A62-8EAE-7E07C83EEDC4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 16:05:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T16:05:21.047 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:05:38.610 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T16:12:12.349 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:12:12.349 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:12:12.349 [Cloud] Queued cloud request. 2026-09-16T16:12:12.349 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:12:12.349 [Cloud] Dequeued cloud request. 2026-09-16T16:12:12.349 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:12:12.489 [Cloud] End of cloud request. 2026-09-16T16:12:13.005 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:15:14.053 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:15:14.053 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:15:14.053 [Cloud] Queued cloud request. 2026-09-16T16:15:14.053 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:15:14.053 [Cloud] Dequeued cloud request. 2026-09-16T16:15:14.053 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:15:14.194 [Cloud] End of cloud request. 2026-09-16T16:15:14.710 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:16:05.444 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:16:05.444 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:16:05.444 [Cloud] Queued cloud request. 2026-09-16T16:16:05.444 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:16:05.444 [Cloud] Dequeued cloud request. 2026-09-16T16:16:05.444 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:16:05.522 [Cloud] End of cloud request. 2026-09-16T16:16:06.038 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:19:40.758 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:19:40.758 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:19:40.758 [Cloud] Queued cloud request. 2026-09-16T16:19:40.758 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:19:40.758 [Cloud] Dequeued cloud request. 2026-09-16T16:19:40.758 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:19:40.899 [Cloud] End of cloud request. 2026-09-16T16:19:41.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:20:43.618 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T16:22:41.524 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:22:41.524 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:22:41.524 [Cloud] Queued cloud request. 2026-09-16T16:22:41.524 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:22:41.524 [Cloud] Dequeued cloud request. 2026-09-16T16:22:41.524 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:22:41.790 [Cloud] End of cloud request. 2026-09-16T16:22:42.290 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:23:17.086 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:23:17.086 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:23:17.086 [Cloud] Queued cloud request. 2026-09-16T16:23:17.086 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:23:17.243 [Cloud] Dequeued cloud request. 2026-09-16T16:23:17.430 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:23:17.539 [Cloud] End of cloud request. 2026-09-16T16:23:18.040 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:27:24.543 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:27:24.543 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:27:24.543 [Cloud] Queued cloud request. 2026-09-16T16:27:24.543 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:27:24.543 [Cloud] Dequeued cloud request. 2026-09-16T16:27:24.543 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:27:24.730 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EAADE3C2-E5A3-845F-71AC-5D80CF7D3F9D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 16:27:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T16:27:25.246 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:27:33.200 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:27:33.200 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:27:33.200 [Cloud] Queued cloud request. 2026-09-16T16:27:33.200 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:27:33.200 [Cloud] Dequeued cloud request. 2026-09-16T16:27:33.200 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:27:43.231 [Cloud] End of cloud request. 2026-09-16T16:27:43.731 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:35:48.624 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T16:37:25.157 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:37:25.157 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:37:25.157 [Cloud] Queued cloud request. 2026-09-16T16:37:25.157 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:37:25.360 [Cloud] Dequeued cloud request. 2026-09-16T16:37:25.360 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:37:25.532 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DE8CDD5D-BDF4-1EE0-3F60-89AEF9F8D55F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 16:37:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T16:37:26.048 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:37:42.689 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:37:42.689 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:37:42.689 [Cloud] Queued cloud request. 2026-09-16T16:37:42.689 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:37:42.689 [Cloud] Dequeued cloud request. 2026-09-16T16:37:42.689 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:37:42.768 [Cloud] End of cloud request. 2026-09-16T16:37:43.283 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:43:28.255 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:43:28.255 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:43:28.255 [Cloud] Queued cloud request. 2026-09-16T16:43:28.255 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:43:28.255 [Cloud] Dequeued cloud request. 2026-09-16T16:43:28.255 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:43:28.442 [Cloud] End of cloud request. 2026-09-16T16:43:28.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:50:53.633 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T16:52:58.992 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:52:58.992 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:52:58.992 [Cloud] Queued cloud request. 2026-09-16T16:52:58.992 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:52:58.992 [Cloud] Dequeued cloud request. 2026-09-16T16:52:58.992 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:52:59.180 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{23BA5F9C-A7FB-E015-F676-C581C2759E5B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 16:52:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T16:52:59.680 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T16:55:24.493 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T16:55:24.493 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T16:55:24.493 [Cloud] Queued cloud request. 2026-09-16T16:55:24.493 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T16:55:24.649 [Cloud] Dequeued cloud request. 2026-09-16T16:55:24.649 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T16:55:24.821 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{37B42434-68C6-12B3-739F-930A3F010D67} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 16:55:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T16:55:25.321 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T17:01:49.795 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T17:01:49.795 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T17:01:49.795 [Cloud] Queued cloud request. 2026-09-16T17:01:49.795 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T17:01:49.795 [Cloud] Dequeued cloud request. 2026-09-16T17:01:49.795 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T17:01:49.983 [Cloud] End of cloud request. 2026-09-16T17:01:50.498 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T17:03:03.624 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T17:03:03.624 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T17:03:03.624 [Cloud] Queued cloud request. 2026-09-16T17:03:03.624 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T17:03:03.624 [Cloud] Dequeued cloud request. 2026-09-16T17:03:03.624 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T17:03:03.889 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8960989E-0AA5-3E1E-7BDC-508B8BD71370} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 17:03:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T17:03:04.405 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T17:05:58.640 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T17:15:39.707 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T17:15:39.707 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T17:15:39.707 [Cloud] Queued cloud request. 2026-09-16T17:15:39.707 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T17:15:39.707 [Cloud] Dequeued cloud request. 2026-09-16T17:15:39.707 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T17:15:39.864 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{772236AA-DFA1-0906-C1D2-A19B415B0A38} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 17:15:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T17:15:40.364 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T17:18:04.553 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T17:18:04.553 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T17:18:04.553 [Cloud] Queued cloud request. 2026-09-16T17:18:04.553 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T17:18:04.553 [Cloud] Dequeued cloud request. 2026-09-16T17:18:04.553 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T17:18:04.694 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E2719428-3228-FA4C-E26E-02E9E2D95060} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 17:18:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T17:18:05.194 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T17:21:03.648 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T17:27:14.478 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T17:27:14.478 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T17:27:14.478 [Cloud] Queued cloud request. 2026-09-16T17:27:14.478 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T17:27:14.478 [Cloud] Dequeued cloud request. 2026-09-16T17:27:14.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T17:27:14.791 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9293BAD5-C670-52CA-C001-350D7402DE72} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 17:27:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T17:27:15.291 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T17:28:45.277 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 40824, Count: 3211, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-16T17:28:45.277 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 20847, Count: 1687, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-16T17:28:45.277 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 3851, Count: 309, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T17:28:45.277 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-16T17:28:45.277 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 738, Count: 53, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-16T17:28:45.277 ProcessImageName: AgentShellService.exe, Pid: 2684, TotalTime: 728, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-16T17:28:45.277 ProcessImageName: WmiPrvSE.exe, Pid: 3308, TotalTime: 662, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-16T17:28:45.277 ProcessImageName: WmiPrvSE.exe, Pid: 6352, TotalTime: 362, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-16T17:28:45.277 ProcessImageName: powershell.exe, Pid: 8156, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-16T17:28:45.277 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T17:28:45.277 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 150, Count: 84, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16985-0.MAI, EstimatedImpact: 0% 2026-09-16T17:28:45.277 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T17:28:45.277 ProcessImageName: python.exe, Pid: 5932, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 4% 2026-09-16T17:28:45.277 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-16T17:28:45.277 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 75, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\413BEACF254440BAA7258AEC91B5336B.MAI, EstimatedImpact: 53% 2026-09-16T17:28:45.277 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-16T17:28:45.277 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-16T17:28:45.277 ProcessImageName: powershell.exe, Pid: 8004, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-16T17:28:45.277 ProcessImageName: mysqldump.exe, Pid: 6180, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-16T17:28:45.277 ProcessImageName: powershell.exe, Pid: 1628, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB1B5.tmp, EstimatedImpact: 0% 2026-09-16T17:28:45.277 ProcessImageName: DeviceCensus.exe, Pid: 4900, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 1% 2026-09-16T17:28:45.277 ProcessImageName: taskhostw.exe, Pid: 2100, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-16T17:28:45.277 ProcessImageName: cmd.exe, Pid: 6156, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-16T17:28:45.277 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-16T17:32:26.576 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T17:32:26.576 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T17:32:26.576 [Cloud] Queued cloud request. 2026-09-16T17:32:26.576 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T17:32:26.576 [Cloud] Dequeued cloud request. 2026-09-16T17:32:26.576 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T17:32:26.732 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{77E97CC7-AD34-A556-94B3-B867B104094F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 17:32:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T17:32:27.232 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T17:36:08.654 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T17:37:43.188 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T17:37:43.188 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T17:37:43.188 [Cloud] Queued cloud request. 2026-09-16T17:37:43.188 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T17:37:43.422 [Cloud] Dequeued cloud request. 2026-09-16T17:37:43.422 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T17:37:45.282 [Cloud] End of cloud request. 2026-09-16T17:37:45.782 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T17:47:50.740 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T17:47:50.740 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T17:47:50.740 [Cloud] Queued cloud request. 2026-09-16T17:47:50.740 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T17:47:50.740 [Cloud] Dequeued cloud request. 2026-09-16T17:47:50.927 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T17:47:51.084 [Cloud] End of cloud request. 2026-09-16T17:47:51.584 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T17:49:48.037 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T17:49:48.037 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T17:49:48.037 [Cloud] Queued cloud request. 2026-09-16T17:49:48.037 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T17:49:48.037 [Cloud] Dequeued cloud request. 2026-09-16T17:49:48.037 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T17:49:48.178 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F8C3992A-0690-5E46-658C-AED4105675A5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 17:49:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T17:49:48.678 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T17:51:13.663 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T17:57:05.758 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T17:57:05.758 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T17:57:05.758 [Cloud] Queued cloud request. 2026-09-16T17:57:05.758 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T17:57:05.758 [Cloud] Dequeued cloud request. 2026-09-16T17:57:05.758 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T17:57:12.430 [Cloud] End of cloud request. 2026-09-16T17:57:12.930 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T17:59:14.448 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T17:59:14.448 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T17:59:14.448 [Cloud] Queued cloud request. 2026-09-16T17:59:14.448 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T17:59:14.448 [Cloud] Dequeued cloud request. 2026-09-16T17:59:14.448 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T17:59:14.636 [Cloud] End of cloud request. 2026-09-16T17:59:15.136 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:02:30.011 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:02:30.011 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:02:30.011 [Cloud] Queued cloud request. 2026-09-16T18:02:30.011 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:02:30.198 [Cloud] Dequeued cloud request. 2026-09-16T18:02:30.198 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:02:30.776 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{41A887B2-33C0-B33B-D145-C5A76B21BF8D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 18:02:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T18:02:31.276 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:05:37.465 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:05:37.465 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:05:37.465 [Cloud] Queued cloud request. 2026-09-16T18:05:37.465 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:05:37.465 [Cloud] Dequeued cloud request. 2026-09-16T18:05:37.465 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:05:37.653 [Cloud] End of cloud request. 2026-09-16T18:05:38.184 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:06:12.559 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:06:12.559 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:06:12.559 [Cloud] Queued cloud request. 2026-09-16T18:06:12.559 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:06:12.559 [Cloud] Dequeued cloud request. 2026-09-16T18:06:12.559 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:06:12.653 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C299FC21-CA81-089A-FCCE-16DE903DDC27} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 18:06:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T18:06:13.153 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:06:18.669 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T18:07:53.421 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:07:53.421 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:07:53.421 [Cloud] Queued cloud request. 2026-09-16T18:07:53.421 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:07:53.421 [Cloud] Dequeued cloud request. 2026-09-16T18:07:53.421 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:08:03.562 [Cloud] End of cloud request. 2026-09-16T18:08:04.062 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:08:15.515 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:08:15.515 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:08:15.515 [Cloud] Queued cloud request. 2026-09-16T18:08:15.515 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:08:15.515 [Cloud] Dequeued cloud request. 2026-09-16T18:08:15.515 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:08:15.750 [Cloud] End of cloud request. 2026-09-16T18:08:16.250 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:09:54.922 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:09:54.922 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:09:54.922 [Cloud] Queued cloud request. 2026-09-16T18:09:54.922 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:09:54.922 [Cloud] Dequeued cloud request. 2026-09-16T18:09:54.922 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:09:55.328 [Cloud] End of cloud request. 2026-09-16T18:09:55.828 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:10:28.609 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:10:28.609 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:10:28.609 [Cloud] Queued cloud request. 2026-09-16T18:10:28.609 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:10:28.609 [Cloud] Dequeued cloud request. 2026-09-16T18:10:28.609 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:10:28.922 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C9B92A7B-8E49-11B5-27FA-19CAB5472D1A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 18:10:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T18:10:29.422 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:14:49.034 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:14:49.034 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:14:49.034 [Cloud] Queued cloud request. 2026-09-16T18:14:49.034 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:14:49.034 [Cloud] Dequeued cloud request. 2026-09-16T18:14:49.034 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:14:49.299 [Cloud] End of cloud request. 2026-09-16T18:14:49.800 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:15:17.878 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:15:17.878 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:15:17.878 [Cloud] Queued cloud request. 2026-09-16T18:15:17.878 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:15:17.878 [Cloud] Dequeued cloud request. 2026-09-16T18:15:17.878 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:15:18.003 [Cloud] End of cloud request. 2026-09-16T18:15:18.518 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:15:50.784 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:15:50.784 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:15:50.784 [Cloud] Queued cloud request. 2026-09-16T18:15:50.784 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:15:50.784 [Cloud] Dequeued cloud request. 2026-09-16T18:15:50.784 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:15:50.940 [Cloud] End of cloud request. 2026-09-16T18:15:51.440 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:19:11.208 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:19:11.208 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:19:11.208 [Cloud] Queued cloud request. 2026-09-16T18:19:11.208 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:19:11.208 [Cloud] Dequeued cloud request. 2026-09-16T18:19:11.208 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:19:11.411 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E51D7BC9-04A1-A73B-5387-A61B86CE432C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 18:19:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T18:19:11.911 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:21:23.677 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T18:22:37.538 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:22:37.538 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:22:37.538 [Cloud] Queued cloud request. 2026-09-16T18:22:37.538 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:22:37.538 [Cloud] Dequeued cloud request. 2026-09-16T18:22:37.538 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:22:39.132 [Cloud] End of cloud request. 2026-09-16T18:22:39.632 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:23:21.429 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:23:21.429 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:23:21.429 [Cloud] Queued cloud request. 2026-09-16T18:23:21.429 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:23:21.429 [Cloud] Dequeued cloud request. 2026-09-16T18:23:21.429 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:23:21.507 [Cloud] End of cloud request. 2026-09-16T18:23:22.007 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:23:46.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:23:46.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:23:46.304 [Cloud] Queued cloud request. 2026-09-16T18:23:46.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:23:46.304 [Cloud] Dequeued cloud request. 2026-09-16T18:23:46.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:23:46.445 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3A66CDAD-987D-6625-192E-52AA202D08C2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 18:23:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T18:23:46.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:24:39.555 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:24:39.555 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:24:39.555 [Cloud] Queued cloud request. 2026-09-16T18:24:39.555 [Cloud] Dequeued cloud request. 2026-09-16T18:24:39.555 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:24:39.555 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:24:39.648 [Cloud] End of cloud request. 2026-09-16T18:24:40.148 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:24:52.570 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:24:52.570 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:24:52.570 [Cloud] Queued cloud request. 2026-09-16T18:24:52.570 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:24:52.570 [Cloud] Dequeued cloud request. 2026-09-16T18:24:52.570 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:24:52.664 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8DAA137E-F649-ABE5-85A2-9F23CB650B20} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 18:24:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T18:24:53.164 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:30:29.901 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:30:29.901 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:30:29.901 [Cloud] Queued cloud request. 2026-09-16T18:30:29.901 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:30:29.901 [Cloud] Dequeued cloud request. 2026-09-16T18:30:29.901 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:30:33.057 [Cloud] End of cloud request. 2026-09-16T18:30:33.557 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:34:37.434 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:34:37.434 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:34:37.434 [Cloud] Queued cloud request. 2026-09-16T18:34:37.434 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:34:37.606 [Cloud] Dequeued cloud request. 2026-09-16T18:34:37.871 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:34:38.059 [Cloud] End of cloud request. 2026-09-16T18:34:38.575 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:35:00.231 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:35:00.231 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:35:00.231 [Cloud] Queued cloud request. 2026-09-16T18:35:00.231 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:35:00.231 [Cloud] Dequeued cloud request. 2026-09-16T18:35:00.231 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:35:00.309 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C1140E7E-C7E6-F5E0-C0EF-CAC0AA4C2C5C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 18:35:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T18:35:00.825 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:35:22.512 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:35:22.512 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:35:22.512 [Cloud] Queued cloud request. 2026-09-16T18:35:22.512 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:35:22.512 [Cloud] Dequeued cloud request. 2026-09-16T18:35:22.512 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:35:22.590 [Cloud] End of cloud request. 2026-09-16T18:35:23.090 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:35:23.715 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:35:23.715 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:35:23.715 [Cloud] Queued cloud request. 2026-09-16T18:35:23.715 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:35:23.715 [Cloud] Dequeued cloud request. 2026-09-16T18:35:23.715 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:35:23.856 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{86022D4C-775A-5850-2616-C37BC2A29837} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 18:35:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T18:35:24.356 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:36:28.684 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T18:38:52.515 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:38:52.515 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:38:52.515 [Cloud] Queued cloud request. 2026-09-16T18:38:52.515 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:38:52.515 [Cloud] Dequeued cloud request. 2026-09-16T18:38:52.515 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:38:52.702 [Cloud] End of cloud request. 2026-09-16T18:38:53.218 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:40:11.624 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:40:11.624 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:40:11.624 [Cloud] Queued cloud request. 2026-09-16T18:40:11.624 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:40:11.624 [Cloud] Dequeued cloud request. 2026-09-16T18:40:11.624 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:40:11.812 [Cloud] End of cloud request. 2026-09-16T18:40:12.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:47:51.488 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:47:51.488 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:47:51.488 [Cloud] Queued cloud request. 2026-09-16T18:47:51.488 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:47:51.488 [Cloud] Dequeued cloud request. 2026-09-16T18:47:51.488 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:47:52.926 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{29789729-8147-5F5E-033C-2507ED528D47} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 18:47:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T18:47:53.426 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:50:37.005 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:50:37.005 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:50:37.005 [Cloud] Queued cloud request. 2026-09-16T18:50:37.005 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:50:37.005 [Cloud] Dequeued cloud request. 2026-09-16T18:50:37.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:50:37.145 [Cloud] End of cloud request. 2026-09-16T18:50:37.645 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:51:33.693 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T18:52:00.475 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:52:00.475 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:52:00.475 [Cloud] Queued cloud request. 2026-09-16T18:52:00.475 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:52:00.475 [Cloud] Dequeued cloud request. 2026-09-16T18:52:00.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:52:00.615 [Cloud] End of cloud request. 2026-09-16T18:52:01.115 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:52:09.100 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:52:09.100 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:52:09.100 [Cloud] Queued cloud request. 2026-09-16T18:52:09.100 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:52:09.100 [Cloud] Dequeued cloud request. 2026-09-16T18:52:09.100 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:52:09.178 [Cloud] End of cloud request. 2026-09-16T18:52:09.693 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:52:49.428 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:52:49.428 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:52:49.428 [Cloud] Queued cloud request. 2026-09-16T18:52:49.428 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:52:49.428 [Cloud] Dequeued cloud request. 2026-09-16T18:52:49.428 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:52:49.506 [Cloud] End of cloud request. 2026-09-16T18:52:50.006 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:55:49.601 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:55:49.601 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:55:49.601 [Cloud] Queued cloud request. 2026-09-16T18:55:49.601 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:55:49.601 [Cloud] Dequeued cloud request. 2026-09-16T18:55:49.616 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:55:49.757 [Cloud] End of cloud request. 2026-09-16T18:55:50.273 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T18:55:57.148 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T18:55:57.148 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T18:55:57.148 [Cloud] Queued cloud request. 2026-09-16T18:55:57.148 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T18:55:57.148 [Cloud] Dequeued cloud request. 2026-09-16T18:55:57.148 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T18:55:57.226 [Cloud] End of cloud request. 2026-09-16T18:55:57.726 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:03:53.494 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:03:53.494 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:03:53.494 [Cloud] Queued cloud request. 2026-09-16T19:03:53.494 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:03:53.494 [Cloud] Dequeued cloud request. 2026-09-16T19:03:53.494 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:03:53.635 [Cloud] End of cloud request. 2026-09-16T19:03:54.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:06:38.699 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T19:08:25.498 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:08:25.498 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:08:25.498 [Cloud] Queued cloud request. 2026-09-16T19:08:25.498 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:08:25.498 [Cloud] Dequeued cloud request. 2026-09-16T19:08:25.498 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:08:25.686 [Cloud] End of cloud request. 2026-09-16T19:08:26.202 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:09:43.468 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:09:43.468 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:09:43.468 [Cloud] Queued cloud request. 2026-09-16T19:09:43.468 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:09:43.468 [Cloud] Dequeued cloud request. 2026-09-16T19:09:43.468 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:09:43.609 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9B841571-DFD1-8522-91A6-C6C5443D1D90} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 19:09:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T19:09:44.124 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:12:17.843 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:12:17.843 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:12:17.843 [Cloud] Queued cloud request. 2026-09-16T19:12:17.843 [Cloud] Dequeued cloud request. 2026-09-16T19:12:17.843 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:12:17.843 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:12:18.000 [Cloud] End of cloud request. 2026-09-16T19:12:18.000 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:12:18.000 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:12:18.000 [Cloud] Queued cloud request. 2026-09-16T19:12:18.000 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:12:18.000 [Cloud] Dequeued cloud request. 2026-09-16T19:12:18.000 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:12:18.109 [Cloud] End of cloud request. 2026-09-16T19:12:18.500 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:13:52.032 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:13:52.032 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:13:52.032 [Cloud] Queued cloud request. 2026-09-16T19:13:52.032 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:13:52.032 [Cloud] Dequeued cloud request. 2026-09-16T19:13:52.282 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:13:52.423 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1B156636-8A94-61C6-A3B6-6B1DE6F485D2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 19:13:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T19:13:52.938 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:14:39.782 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:14:39.782 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:14:39.782 [Cloud] Queued cloud request. 2026-09-16T19:14:39.782 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:14:39.782 [Cloud] Dequeued cloud request. 2026-09-16T19:14:39.782 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:14:39.876 [Cloud] End of cloud request. 2026-09-16T19:14:40.376 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:16:31.360 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:16:31.360 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:16:31.360 [Cloud] Queued cloud request. 2026-09-16T19:16:31.360 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:16:31.360 [Cloud] Dequeued cloud request. 2026-09-16T19:16:31.360 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:16:31.548 [Cloud] End of cloud request. 2026-09-16T19:16:32.048 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:19:20.081 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:19:20.081 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:19:20.081 [Cloud] Queued cloud request. 2026-09-16T19:19:20.081 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:19:20.081 [Cloud] Dequeued cloud request. 2026-09-16T19:19:20.081 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:19:29.753 [Cloud] End of cloud request. 2026-09-16T19:19:30.253 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:21:43.708 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T19:22:42.974 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:22:42.974 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:22:42.974 [Cloud] Queued cloud request. 2026-09-16T19:22:42.974 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:22:42.974 [Cloud] Dequeued cloud request. 2026-09-16T19:22:42.974 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:22:43.130 [Cloud] End of cloud request. 2026-09-16T19:22:43.630 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:26:50.005 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:26:50.005 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:26:50.005 [Cloud] Queued cloud request. 2026-09-16T19:26:50.005 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:26:50.005 [Cloud] Dequeued cloud request. 2026-09-16T19:26:50.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:26:50.162 [Cloud] End of cloud request. 2026-09-16T19:26:50.662 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:27:30.022 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:27:30.022 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:27:30.022 [Cloud] Queued cloud request. 2026-09-16T19:27:30.022 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:27:30.022 [Cloud] Dequeued cloud request. 2026-09-16T19:27:30.022 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:27:30.101 [Cloud] End of cloud request. 2026-09-16T19:27:30.601 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:28:18.711 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-16T19:28:18.758 Job Notification: New process added to job (3224) 2026-09-16T19:28:18.774 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-16T19:28:18.774 Aggressive catchup quick scan threshold: 692446931361 / 25920000000000 2026-09-16T19:28:18.774 Job Notification: New process added to job (5008) 2026-09-16T19:28:18.789 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:3224] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:5008]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-16T19:28:18.977 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-16T19:28:18.992 Job Notification: New process added to job (4844) 2026-09-16T19:28:18.992 Job Notification: New process added to job (4628) 2026-09-16T19:28:19.039 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:4844] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:4628]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-16T19:28:19.196 Job Notification: New process added to job (4044) 2026-09-16T19:28:19.227 Task(GetDeviceTicket -AccessKey 84463CFD-88B0-EE12-2E71-9C41FCEF90BC ) launched as network service 2026-09-16T19:28:19.289 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-16T19:28:19.289 [RTP] Duplicating the current plugin configuration object... 2026-09-16T19:28:19.289 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-16T19:28:19.289 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-16T19:28:19.289 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-16T19:28:19.289 [RTP] No config change detected. Not updating plugin configuration. 2026-09-16T19:28:19.289 [RTP] No config changes found. No configuration switch. 2026-09-16T19:28:19.289 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-16T19:28:19.821 Job Notification: Process exited from job (4044) 2026-09-16T19:28:20.008 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-16T19:28:20.024 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:28:20.024 [Cloud] Queued cloud request. 2026-09-16T19:28:20.024 [Cloud] Dequeued cloud request. 2026-09-16T19:28:20.039 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:28:20.086 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-16T19:28:20.086 [Cloud] End of cloud request. 2026-09-16T19:28:20.555 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:28:36.149 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\64FA301B-074B-4E20-876F-7FB206D6394F1f94.1dd46118ffa912a 2026-09-16T19:28:36.227 Verifying engine and signature files (source: 0) ... 2026-09-16T19:28:36.227 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E}\mpengine.dll] due to PPL. 2026-09-16T19:28:36.227 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E}\mpasbase.vdm]. File not in cache (0x1) 2026-09-16T19:28:37.211 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E}\mpasbase.vdm] 2026-09-16T19:28:37.211 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-16T19:28:37.227 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E}\mpasdlta.vdm] 2026-09-16T19:28:37.227 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E}\mpavbase.vdm]. File not in cache (0x1) 2026-09-16T19:28:37.633 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E}\mpavbase.vdm] 2026-09-16T19:28:37.633 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-16T19:28:37.664 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E}\mpavdlta.vdm] 2026-09-16T19:28:37.852 [Engine] IsHybridMode: 0 2026-09-16T19:28:37.852 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-16T19:28:37.852 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-C6FC939F8E9CE9C9885BD5F6146C1A3167CDEBB9.bin): 0x00000002 2026-09-16T19:28:37.867 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-C6FC939F8E9CE9C9885BD5F6146C1A3167CDEBB9.bin) 2026-09-16T19:28:37.867 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-16T19:28:37.867 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-16T19:28:37.867 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-16T19:28:37.867 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff 2026-09-16T19:28:45.352 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 41500, Count: 3238, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-16T19:28:45.352 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 23174, Count: 1861, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-16T19:28:45.352 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 3851, Count: 309, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T19:28:45.352 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-16T19:28:45.352 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 813, Count: 60, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-16T19:28:45.352 ProcessImageName: AgentShellService.exe, Pid: 2684, TotalTime: 728, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-16T19:28:45.352 ProcessImageName: WmiPrvSE.exe, Pid: 3308, TotalTime: 662, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-16T19:28:45.352 ProcessImageName: WmiPrvSE.exe, Pid: 6352, TotalTime: 362, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-16T19:28:45.352 ProcessImageName: powershell.exe, Pid: 8156, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-16T19:28:45.352 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T19:28:45.352 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 150, Count: 84, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16985-0.MAI, EstimatedImpact: 0% 2026-09-16T19:28:45.352 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T19:28:45.352 ProcessImageName: python.exe, Pid: 5932, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 4% 2026-09-16T19:28:45.352 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-16T19:28:45.352 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 75, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\413BEACF254440BAA7258AEC91B5336B.MAI, EstimatedImpact: 53% 2026-09-16T19:28:45.352 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-16T19:28:45.352 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 60, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-16T19:28:45.352 ProcessImageName: powershell.exe, Pid: 8004, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-16T19:28:45.352 ProcessImageName: mysqldump.exe, Pid: 6180, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-16T19:28:45.352 ProcessImageName: powershell.exe, Pid: 1628, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB1B5.tmp, EstimatedImpact: 0% 2026-09-16T19:28:45.352 ProcessImageName: DeviceCensus.exe, Pid: 4900, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 1% 2026-09-16T19:28:45.352 ProcessImageName: taskhostw.exe, Pid: 2100, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-16T19:28:45.352 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-16T19:28:45.352 ProcessImageName: cmd.exe, Pid: 6156, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-16T19:28:50.117 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-16T19:28:50.117 [AutoExclusion] Applied roles from cache. 2026-09-16T19:28:50.117 [AutoExclusion] Started roles monitoring. 2026-09-16T19:28:50.274 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF68AB020, lRefCount: 6, hr=0 2026-09-16T19:28:50.274 [Engine] New active engine 00007FFCF4ABB020 replacing engine 00007FFCF68AB020. Number of active engines: 2 2026-09-16T19:28:50.305 EngineInit:Global ASOC is enabled 2026-09-16T19:28:50.305 EngineInit:ASOO is enabled for developer volumes 2026-09-16T19:28:50.399 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-16T19:28:50.399 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.399 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-16T19:28:50.399 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-16T19:28:50.399 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-16T19:28:50.399 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.399 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.399 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.399 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-16T19:28:50.399 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.414 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-16T19:28:50.414 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.414 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.414 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.414 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.414 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.414 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.414 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.414 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-16T19:28:50.430 MpWriteUupSignatureVersion 1.459.239.0, hr = 0 2026-09-16T19:28:50.446 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-16T19:28:50.477 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-16T19:28:50.477 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-16T19:28:50.477 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-16T19:28:50.477 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-16T19:28:50.492 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-16T19:28:50.492 [Plugin] Initializing RTP plugin state... 2026-09-16T19:28:50.492 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-16T19:28:50.492 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎15‎-‎2026 21:28:45 Last Perf:‎09‎-‎15‎-‎2026 21:28:44 First RTP Scan:‎09‎-‎15‎-‎2026 21:28:45 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1505 Misses:7903 BM Queue:0,130,0 Proc:0,26,0 File:0,130,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:6815932 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:-1067053820 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:15051 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:818382 TotalHits:23387243 InstanceCacheInserts:453825 InstanceCacheUpdates:0 InstanceCacheDeletes:69119 InstanceCacheHits:16954 InstanceCacheMisses:820797 InstanceCacheOverflows:367691 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:4ms (7308/1465) Success: 1465, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-16T19:28:50.492 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E} 2026-09-16T19:28:50.492 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D}\mpasbase.vdm in use, hr=0x80070020 2026-09-16T19:28:50.492 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-16T19:28:50.492 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{47A2C562-59F8-4DA6-9A0D-36AD6501BC82} removed 2026-09-16T19:28:50.492 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-16T19:28:50.492 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-16T19:28:50.492 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-16T19:28:50.492 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-16T19:28:50.492 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-16-2026 19:28:50 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-16-2026 19:28:50 2026-09-16T19:28:50.508 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-16T19:28:50.508 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-16T19:28:50.508 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-16T19:28:50.508 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-16T19:28:50.508 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:28:50.508 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-16T19:28:50.508 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-16T19:28:50.508 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-16T19:28:50.508 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-16T19:28:50.508 MdCoreSvc is supported in this platform and OS Signature updated on 09-16-2026 19:28:50 Product Version: 4.18.26080.3 Service Version: 4.18.26080.3 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.239.0 AV Signature Version: 1.459.239.0 ************************************************************ 2026-09-16T19:28:50.524 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-16T19:28:50.524 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\64FA301B-074B-4E20-876F-7FB206D6394F1f94.1dd46118ffa912a 2026-09-16T19:28:50.539 Process scan (postsignatureupdatescan) started. 2026-09-16T19:28:50.586 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-16T19:28:50.586 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-16-2026 19:28:50 ************************************************************ 2026-09-16T19:28:50.805 Job Notification: Process exited from job (4844) 2026-09-16T19:28:50.826 Job Notification: Process exited from job (4628) 2026-09-16T19:28:50.836 Job Notification: Process exited from job (3224) 2026-09-16T19:28:50.852 Job Notification: Process exited from job (5008) 2026-09-16T19:28:50.867 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-16T19:28:50.867 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-16T19:28:50.867 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-16T19:28:50.867 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-16T19:28:50.867 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-16T19:28:50.883 [Engine] Engine 00007FFCF68AB020 no longer in use. Number of active engines: 1 2026-09-16T19:28:50.883 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-16T19:28:50.883 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-16T19:28:50.946 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-16T19:28:50.946 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-16T19:28:50.946 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-16T19:28:51.477 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 41500, Count: 3238, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-16T19:28:51.477 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 23174, Count: 1861, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-16T19:28:51.477 ProcessImageName: AgentShell.exe, Pid: 1316, TotalTime: 3851, Count: 309, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T19:28:51.477 ProcessImageName: powershell.exe, Pid: 1540, TotalTime: 1689, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-16T19:28:51.477 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 813, Count: 60, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-16T19:28:51.477 ProcessImageName: AgentShellService.exe, Pid: 2684, TotalTime: 728, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-16T19:28:51.477 ProcessImageName: WmiPrvSE.exe, Pid: 3308, TotalTime: 662, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-16T19:28:51.477 ProcessImageName: WmiPrvSE.exe, Pid: 6352, TotalTime: 362, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-16T19:28:51.477 ProcessImageName: powershell.exe, Pid: 8156, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-16T19:28:51.477 ProcessImageName: WmiPrvSE.exe, Pid: 8072, TotalTime: 217, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T19:28:51.477 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 150, Count: 84, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-16985-0.MAI, EstimatedImpact: 0% 2026-09-16T19:28:51.477 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 123, Count: 4, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T19:28:51.477 ProcessImageName: python.exe, Pid: 5932, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 4% 2026-09-16T19:28:51.477 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-16T19:28:51.477 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 75, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\413BEACF254440BAA7258AEC91B5336B.MAI, EstimatedImpact: 53% 2026-09-16T19:28:51.539 [Engine] RSIG_UNLOADENGINE, 00007FFCF68AB020, err=0x0 2026-09-16T19:28:51.571 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3C549EEB-D3AD-41B8-ADE6-DA0C8479AA6D} removed 2026-09-16T19:29:04.914 Process scan (postsignatureupdatescan) completed. 2026-09-16T19:29:10.258 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:29:10.258 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:29:10.258 [Cloud] Queued cloud request. 2026-09-16T19:29:10.258 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:29:10.258 [Cloud] Dequeued cloud request. 2026-09-16T19:29:10.258 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:29:10.336 [Cloud] End of cloud request. 2026-09-16T19:29:10.836 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:29:16.836 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:29:16.836 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:29:16.836 [Cloud] Queued cloud request. 2026-09-16T19:29:16.836 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:29:16.836 [Cloud] Dequeued cloud request. 2026-09-16T19:29:16.836 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:29:16.914 [Cloud] End of cloud request. 2026-09-16T19:29:17.430 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:31:01.211 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:31:01.211 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:31:01.211 [Cloud] Queued cloud request. 2026-09-16T19:31:01.211 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:31:01.211 [Cloud] Dequeued cloud request. 2026-09-16T19:31:01.211 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:31:01.399 [Cloud] End of cloud request. 2026-09-16T19:31:01.899 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:33:44.057 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:33:44.057 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:33:44.057 [Cloud] Queued cloud request. 2026-09-16T19:33:44.057 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:33:44.260 [Cloud] Dequeued cloud request. 2026-09-16T19:33:44.260 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:33:44.417 [Cloud] End of cloud request. 2026-09-16T19:33:44.917 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:33:50.354 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-16T19:36:48.714 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T19:38:33.419 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:38:33.419 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:38:33.419 [Cloud] Queued cloud request. 2026-09-16T19:38:33.419 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:38:33.419 [Cloud] Dequeued cloud request. 2026-09-16T19:38:33.419 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:38:33.575 [Cloud] End of cloud request. 2026-09-16T19:38:34.091 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:38:47.497 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:38:47.497 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:38:47.497 [Cloud] Queued cloud request. 2026-09-16T19:38:47.497 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:38:47.497 [Cloud] Dequeued cloud request. 2026-09-16T19:38:47.497 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:38:47.591 [Cloud] End of cloud request. 2026-09-16T19:38:48.107 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:40:23.779 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:40:23.779 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:40:23.779 [Cloud] Queued cloud request. 2026-09-16T19:40:23.779 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:40:23.779 [Cloud] Dequeued cloud request. 2026-09-16T19:40:23.779 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:40:24.092 [Cloud] End of cloud request. 2026-09-16T19:40:24.592 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{1373082A-02A8-0D89-A51E-AAE8BF17AE1E} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-16-2026 19:40:29 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T19:40:30.686 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:40:30.686 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:40:30.686 [Cloud] Queued cloud request. 2026-09-16T19:40:30.686 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:40:30.686 [Cloud] Dequeued cloud request. 2026-09-16T19:40:30.686 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:40:40.701 [Cloud] End of cloud request. 2026-09-16T19:40:41.217 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:40:55.295 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:40:55.295 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:40:55.295 [Cloud] Queued cloud request. 2026-09-16T19:40:55.295 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:40:55.295 [Cloud] Dequeued cloud request. 2026-09-16T19:40:55.295 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:40:55.436 [Cloud] End of cloud request. 2026-09-16T19:40:55.936 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:41:28.420 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:41:28.420 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:41:28.420 [Cloud] Queued cloud request. 2026-09-16T19:41:28.420 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:41:28.436 [Cloud] Dequeued cloud request. 2026-09-16T19:41:28.436 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:41:28.498 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9541F5DA-686B-5418-20F8-806F5050F53F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 19:41:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T19:41:28.998 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:42:08.998 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:42:08.998 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:42:08.998 [Cloud] Queued cloud request. 2026-09-16T19:42:08.998 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:42:08.998 [Cloud] Dequeued cloud request. 2026-09-16T19:42:08.998 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:42:09.076 [Cloud] End of cloud request. 2026-09-16T19:42:09.092 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:42:09.092 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:42:09.092 [Cloud] Queued cloud request. 2026-09-16T19:42:09.092 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:42:09.092 [Cloud] Dequeued cloud request. 2026-09-16T19:42:09.092 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:42:09.170 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{85C8DA69-EBF1-25C7-EEA4-CDD18A67C0EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 19:42:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T19:42:09.576 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:42:17.654 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:42:17.654 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:42:17.654 [Cloud] Queued cloud request. 2026-09-16T19:42:17.654 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:42:17.654 [Cloud] Dequeued cloud request. 2026-09-16T19:42:17.654 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:42:21.342 [Cloud] End of cloud request. 2026-09-16T19:42:21.842 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:43:50.045 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:43:50.045 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:43:50.045 [Cloud] Queued cloud request. 2026-09-16T19:43:50.045 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:43:50.045 [Cloud] Dequeued cloud request. 2026-09-16T19:43:50.045 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:43:50.248 [Cloud] End of cloud request. 2026-09-16T19:43:50.764 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:46:41.531 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:46:41.531 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:46:41.531 [Cloud] Queued cloud request. 2026-09-16T19:46:41.531 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:46:41.531 [Cloud] Dequeued cloud request. 2026-09-16T19:46:41.531 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:46:41.734 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25A196D8-F765-2F35-E7D6-2C618F158E52} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 19:46:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T19:46:42.234 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:50:02.986 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:50:02.986 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:50:02.986 [Cloud] Queued cloud request. 2026-09-16T19:50:02.986 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:50:02.986 [Cloud] Dequeued cloud request. 2026-09-16T19:50:02.986 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:50:03.174 [Cloud] End of cloud request. 2026-09-16T19:50:03.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:50:19.236 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:50:19.236 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:50:19.236 [Cloud] Queued cloud request. 2026-09-16T19:50:19.236 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:50:19.236 [Cloud] Dequeued cloud request. 2026-09-16T19:50:19.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:50:19.314 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{614BDF4E-8AEF-17D1-2D1B-8B82B4074335} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 19:50:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T19:50:19.814 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:51:53.722 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T19:55:05.301 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:55:05.301 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:55:05.301 [Cloud] Queued cloud request. 2026-09-16T19:55:05.301 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:55:05.301 [Cloud] Dequeued cloud request. 2026-09-16T19:55:05.301 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:55:05.457 [Cloud] End of cloud request. 2026-09-16T19:55:05.957 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{CFF2DB92-36E1-9774-7B0E-7EC3EF070A54} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-16-2026 19:56:47 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T19:56:47.707 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:56:47.707 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:56:47.707 [Cloud] Queued cloud request. 2026-09-16T19:56:47.707 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:56:47.723 [Cloud] Dequeued cloud request. 2026-09-16T19:56:47.723 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:56:47.848 [Cloud] End of cloud request. 2026-09-16T19:56:48.348 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:58:57.335 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:58:57.335 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:58:57.335 [Cloud] Queued cloud request. 2026-09-16T19:58:57.335 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:58:57.335 [Cloud] Dequeued cloud request. 2026-09-16T19:58:57.335 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:58:57.507 [Cloud] End of cloud request. 2026-09-16T19:58:58.007 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:58:58.382 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:58:58.382 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:58:58.382 [Cloud] Queued cloud request. 2026-09-16T19:58:58.382 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:58:58.382 [Cloud] Dequeued cloud request. 2026-09-16T19:58:58.382 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:58:58.475 [Cloud] End of cloud request. 2026-09-16T19:58:58.975 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T19:59:12.507 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T19:59:12.507 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T19:59:12.507 [Cloud] Queued cloud request. 2026-09-16T19:59:12.507 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T19:59:12.507 [Cloud] Dequeued cloud request. 2026-09-16T19:59:12.507 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T19:59:12.585 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{159CA0DA-D39B-93CA-FD35-7BB6E592637A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 19:59:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T19:59:13.100 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:01:59.680 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:01:59.680 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:01:59.680 [Cloud] Queued cloud request. 2026-09-16T20:01:59.680 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:01:59.680 [Cloud] Dequeued cloud request. 2026-09-16T20:01:59.680 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:01:59.836 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{042FEF97-50F7-3170-6908-0FADF305DEFD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 20:01:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T20:02:00.336 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:03:10.805 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:03:10.805 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:03:10.805 [Cloud] Queued cloud request. 2026-09-16T20:03:10.805 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:03:10.805 [Cloud] Dequeued cloud request. 2026-09-16T20:03:10.805 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:03:11.055 [Cloud] End of cloud request. 2026-09-16T20:03:11.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:06:58.727 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T20:10:02.840 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:10:02.840 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:10:02.840 [Cloud] Queued cloud request. 2026-09-16T20:10:02.840 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:10:02.840 [Cloud] Dequeued cloud request. 2026-09-16T20:10:02.840 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:10:03.043 [Cloud] End of cloud request. 2026-09-16T20:10:03.559 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:13:40.685 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:13:40.685 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:13:40.685 [Cloud] Queued cloud request. 2026-09-16T20:13:40.685 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:13:40.685 [Cloud] Dequeued cloud request. 2026-09-16T20:13:40.685 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:13:40.872 [Cloud] End of cloud request. 2026-09-16T20:13:41.388 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:18:10.016 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:18:10.016 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:18:10.016 [Cloud] Queued cloud request. 2026-09-16T20:18:10.016 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:18:10.016 [Cloud] Dequeued cloud request. 2026-09-16T20:18:10.016 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:18:10.219 [Cloud] End of cloud request. 2026-09-16T20:18:10.719 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:22:03.736 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T20:29:00.927 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:29:00.927 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:29:00.927 [Cloud] Queued cloud request. 2026-09-16T20:29:00.927 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:29:00.927 [Cloud] Dequeued cloud request. 2026-09-16T20:29:00.943 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:29:01.130 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{16957E03-D31C-AD59-ED51-BBBE6606ACE3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 20:29:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T20:29:01.630 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:34:57.663 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:34:57.663 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:34:57.663 [Cloud] Queued cloud request. 2026-09-16T20:34:57.663 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:34:57.663 [Cloud] Dequeued cloud request. 2026-09-16T20:34:57.663 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:34:57.851 [Cloud] End of cloud request. 2026-09-16T20:34:58.366 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:35:35.491 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:35:35.491 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:35:35.491 [Cloud] Queued cloud request. 2026-09-16T20:35:35.491 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:35:35.491 [Cloud] Dequeued cloud request. 2026-09-16T20:35:35.491 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:35:38.226 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C9CAFDB4-4F42-BA4F-72C4-9C459B468DB1} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 20:35:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T20:35:38.726 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:36:33.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:36:33.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:36:33.304 [Cloud] Queued cloud request. 2026-09-16T20:36:33.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:36:33.304 [Cloud] Dequeued cloud request. 2026-09-16T20:36:33.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:36:33.382 [Cloud] End of cloud request. 2026-09-16T20:36:33.882 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:37:08.741 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T20:38:53.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:38:53.088 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:38:53.088 [Cloud] Queued cloud request. 2026-09-16T20:38:53.088 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:38:53.088 [Cloud] Dequeued cloud request. 2026-09-16T20:38:53.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:38:53.275 [Cloud] End of cloud request. 2026-09-16T20:38:53.775 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:42:11.074 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:42:11.074 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:42:11.074 [Cloud] Queued cloud request. 2026-09-16T20:42:11.074 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:42:11.074 [Cloud] Dequeued cloud request. 2026-09-16T20:42:11.074 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:42:11.855 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3C51B04B-36A4-5259-A945-C0D46A5BE5C3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 20:42:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T20:42:12.355 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:45:03.465 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:45:03.465 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:45:03.465 [Cloud] Queued cloud request. 2026-09-16T20:45:03.465 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:45:03.465 [Cloud] Dequeued cloud request. 2026-09-16T20:45:03.465 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:45:03.715 [Cloud] End of cloud request. 2026-09-16T20:45:04.215 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:47:08.840 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:47:08.840 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:47:08.840 [Cloud] Queued cloud request. 2026-09-16T20:47:08.840 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:47:08.840 [Cloud] Dequeued cloud request. 2026-09-16T20:47:08.840 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:47:09.043 [Cloud] End of cloud request. 2026-09-16T20:47:09.544 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:47:53.170 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:47:53.170 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:47:53.170 [Cloud] Queued cloud request. 2026-09-16T20:47:53.170 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:47:53.170 [Cloud] Dequeued cloud request. 2026-09-16T20:47:53.170 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:47:53.248 [Cloud] End of cloud request. 2026-09-16T20:47:53.748 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:48:26.499 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:48:26.499 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:48:26.499 [Cloud] Queued cloud request. 2026-09-16T20:48:26.499 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:48:26.499 [Cloud] Dequeued cloud request. 2026-09-16T20:48:26.499 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:48:26.577 [Cloud] End of cloud request. 2026-09-16T20:48:27.077 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:50:46.155 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:50:46.155 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:50:46.155 [Cloud] Queued cloud request. 2026-09-16T20:50:46.155 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:50:46.155 [Cloud] Dequeued cloud request. 2026-09-16T20:50:46.155 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:50:46.343 [Cloud] End of cloud request. 2026-09-16T20:50:46.843 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T20:52:12.608 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T20:52:12.608 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T20:52:12.608 [Cloud] Queued cloud request. 2026-09-16T20:52:12.608 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T20:52:12.608 [Cloud] Dequeued cloud request. 2026-09-16T20:52:12.608 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T20:52:13.749 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T20:52:17.515 [Cloud] End of cloud request. 2026-09-16T20:52:18.015 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:00:00.003 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:00:00.003 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:00:00.003 [Cloud] Queued cloud request. 2026-09-16T21:00:00.003 [Cloud] Dequeued cloud request. 2026-09-16T21:00:00.003 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:00:00.035 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:00:06.441 [Cloud] End of cloud request. 2026-09-16T21:00:06.941 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:05:43.240 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:05:43.240 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:05:43.240 [Cloud] Queued cloud request. 2026-09-16T21:05:43.240 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:05:43.240 [Cloud] Dequeued cloud request. 2026-09-16T21:05:43.240 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:05:43.396 [Cloud] End of cloud request. 2026-09-16T21:05:43.896 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:07:18.771 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T21:07:22.662 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:07:22.662 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:07:22.662 [Cloud] Queued cloud request. 2026-09-16T21:07:22.662 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:07:22.662 [Cloud] Dequeued cloud request. 2026-09-16T21:07:22.662 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:07:22.803 [Cloud] End of cloud request. 2026-09-16T21:07:23.303 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:10:22.758 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:10:22.758 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:10:22.758 [Cloud] Queued cloud request. 2026-09-16T21:10:22.758 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:10:22.758 [Cloud] Dequeued cloud request. 2026-09-16T21:10:22.758 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:10:22.930 [Cloud] End of cloud request. 2026-09-16T21:10:23.430 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:19:24.576 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:19:24.576 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:19:24.576 [Cloud] Queued cloud request. 2026-09-16T21:19:24.576 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:19:24.732 [Cloud] Dequeued cloud request. 2026-09-16T21:19:24.732 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:19:29.107 [Cloud] End of cloud request. 2026-09-16T21:19:29.623 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:22:23.764 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T21:23:19.296 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:23:19.296 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:23:19.296 [Cloud] Queued cloud request. 2026-09-16T21:23:19.296 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:23:19.296 [Cloud] Dequeued cloud request. 2026-09-16T21:23:19.296 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:23:19.452 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{69F57032-E393-FEC7-7EF6-AEF9E480F8D3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 21:23:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T21:23:19.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:23:31.218 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:23:31.218 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:23:31.218 [Cloud] Queued cloud request. 2026-09-16T21:23:31.218 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:23:31.218 [Cloud] Dequeued cloud request. 2026-09-16T21:23:31.218 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:23:31.311 [Cloud] End of cloud request. 2026-09-16T21:23:31.811 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:23:54.233 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:23:54.233 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:23:54.233 [Cloud] Queued cloud request. 2026-09-16T21:23:54.233 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:23:54.233 [Cloud] Dequeued cloud request. 2026-09-16T21:23:54.233 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:23:54.327 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A25A7578-4C53-94B6-8BA6-BDB0FE467910} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 21:23:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T21:23:54.827 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:28:05.236 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:28:05.236 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:28:05.236 [Cloud] Queued cloud request. 2026-09-16T21:28:05.236 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:28:05.236 [Cloud] Dequeued cloud request. 2026-09-16T21:28:05.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:28:05.376 [Cloud] End of cloud request. 2026-09-16T21:28:05.892 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:28:34.470 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:28:34.470 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:28:34.470 [Cloud] Queued cloud request. 2026-09-16T21:28:34.470 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:28:34.470 [Cloud] Dequeued cloud request. 2026-09-16T21:28:34.470 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:28:34.783 [Cloud] End of cloud request. 2026-09-16T21:28:35.283 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:28:50.330 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 6925, Count: 441, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-16T21:28:50.330 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 1966, Count: 186, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T21:28:50.330 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-16T21:28:50.330 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T21:28:50.330 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-16T21:28:50.330 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-16T21:28:50.330 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T21:28:50.330 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-16T21:28:50.330 ProcessImageName: taskhostw.exe, Pid: 1228, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-16T21:30:28.127 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:30:28.127 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:30:28.127 [Cloud] Queued cloud request. 2026-09-16T21:30:28.127 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:30:28.127 [Cloud] Dequeued cloud request. 2026-09-16T21:30:28.127 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:30:28.267 [Cloud] End of cloud request. 2026-09-16T21:30:28.783 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:31:08.814 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:31:08.814 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:31:08.814 [Cloud] Queued cloud request. 2026-09-16T21:31:08.814 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:31:08.814 [Cloud] Dequeued cloud request. 2026-09-16T21:31:08.814 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:31:09.064 [Cloud] End of cloud request. 2026-09-16T21:31:09.580 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:37:28.771 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T21:37:55.600 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:37:55.600 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:37:55.600 [Cloud] Queued cloud request. 2026-09-16T21:37:55.600 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:37:55.600 [Cloud] Dequeued cloud request. 2026-09-16T21:37:55.600 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:37:55.787 [Cloud] End of cloud request. 2026-09-16T21:37:56.287 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:38:36.350 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:38:36.350 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:38:36.350 [Cloud] Queued cloud request. 2026-09-16T21:38:36.350 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:38:36.350 [Cloud] Dequeued cloud request. 2026-09-16T21:38:36.350 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:38:36.428 [Cloud] End of cloud request. 2026-09-16T21:38:36.928 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:46:43.978 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:46:43.978 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:46:43.978 [Cloud] Queued cloud request. 2026-09-16T21:46:43.978 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:46:43.978 [Cloud] Dequeued cloud request. 2026-09-16T21:46:43.978 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:46:53.915 [Cloud] End of cloud request. 2026-09-16T21:46:54.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:46:55.884 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:46:55.884 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:46:55.884 [Cloud] Queued cloud request. 2026-09-16T21:46:55.884 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:46:55.884 [Cloud] Dequeued cloud request. 2026-09-16T21:46:55.884 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:46:55.962 [Cloud] End of cloud request. 2026-09-16T21:46:55.978 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:46:55.978 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:46:55.978 [Cloud] Queued cloud request. 2026-09-16T21:46:55.978 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:46:55.978 [Cloud] Dequeued cloud request. 2026-09-16T21:46:55.978 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:46:56.056 [Cloud] End of cloud request. 2026-09-16T21:46:56.478 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:47:03.431 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:47:03.431 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:47:03.431 [Cloud] Queued cloud request. 2026-09-16T21:47:03.431 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:47:03.431 [Cloud] Dequeued cloud request. 2026-09-16T21:47:03.431 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:47:03.572 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C867E143-0CA0-D5C2-5187-C5F467039784} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 21:47:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T21:47:04.072 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T21:52:33.776 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T21:54:38.044 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T21:54:38.044 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T21:54:38.044 [Cloud] Queued cloud request. 2026-09-16T21:54:38.044 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T21:54:38.200 [Cloud] Dequeued cloud request. 2026-09-16T21:54:38.200 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T21:54:38.404 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E9E41B18-1C28-F174-F5E6-068AF6102EEC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 21:54:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T21:54:38.904 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:00:09.156 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:00:09.156 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:00:09.156 [Cloud] Queued cloud request. 2026-09-16T22:00:09.156 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:00:09.156 [Cloud] Dequeued cloud request. 2026-09-16T22:00:09.156 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:00:19.250 [Cloud] End of cloud request. 2026-09-16T22:00:19.765 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:04:58.096 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:04:58.096 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:04:58.096 [Cloud] Queued cloud request. 2026-09-16T22:04:58.096 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:04:58.268 [Cloud] Dequeued cloud request. 2026-09-16T22:04:58.268 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:04:58.408 [Cloud] End of cloud request. 2026-09-16T22:04:58.924 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:07:38.785 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T22:13:32.100 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:13:32.100 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:13:32.100 [Cloud] Queued cloud request. 2026-09-16T22:13:32.100 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:13:32.100 [Cloud] Dequeued cloud request. 2026-09-16T22:13:32.100 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:13:32.287 [Cloud] End of cloud request. 2026-09-16T22:13:32.787 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:14:52.959 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:14:52.959 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:14:52.959 [Cloud] Queued cloud request. 2026-09-16T22:14:52.959 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:14:52.959 [Cloud] Dequeued cloud request. 2026-09-16T22:14:52.959 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:14:53.146 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{43F832B9-24A0-7D32-6989-0C03619AD6F5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 22:14:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T22:14:53.662 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:18:01.321 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:18:01.321 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:18:01.321 [Cloud] Queued cloud request. 2026-09-16T22:18:01.321 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:18:01.321 [Cloud] Dequeued cloud request. 2026-09-16T22:18:01.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:18:01.508 [Cloud] End of cloud request. 2026-09-16T22:18:02.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:21:05.383 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:21:05.383 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:21:05.383 [Cloud] Queued cloud request. 2026-09-16T22:21:05.383 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:21:05.383 [Cloud] Dequeued cloud request. 2026-09-16T22:21:05.383 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:21:05.571 [Cloud] End of cloud request. 2026-09-16T22:21:06.071 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:22:43.790 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T22:23:59.729 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:23:59.729 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:23:59.729 [Cloud] Queued cloud request. 2026-09-16T22:23:59.729 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:23:59.729 [Cloud] Dequeued cloud request. 2026-09-16T22:23:59.729 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:23:59.901 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D0D67083-C74F-6FA2-3640-BBC39FAB8C78} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 22:23:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T22:24:00.401 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:25:14.698 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:25:14.698 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:25:14.698 [Cloud] Queued cloud request. 2026-09-16T22:25:14.698 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:25:14.698 [Cloud] Dequeued cloud request. 2026-09-16T22:25:14.698 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:25:14.839 [Cloud] End of cloud request. 2026-09-16T22:25:15.355 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:25:38.417 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:25:38.417 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:25:38.417 [Cloud] Queued cloud request. 2026-09-16T22:25:38.417 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:25:38.417 [Cloud] Dequeued cloud request. 2026-09-16T22:25:38.417 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:25:38.495 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{71D4CF3B-843D-C1EA-4A53-473F9437C22A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 22:25:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T22:25:39.011 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:26:43.214 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:26:43.214 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:26:43.214 [Cloud] Queued cloud request. 2026-09-16T22:26:43.214 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:26:43.214 [Cloud] Dequeued cloud request. 2026-09-16T22:26:43.214 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:26:43.339 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{46402511-392F-632B-7803-36B202635F80} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 22:26:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T22:26:43.839 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:28:36.622 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:28:36.622 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:28:36.622 [Cloud] Queued cloud request. 2026-09-16T22:28:36.622 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:28:36.622 [Cloud] Dequeued cloud request. 2026-09-16T22:28:36.622 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:28:36.763 [Cloud] End of cloud request. 2026-09-16T22:28:37.279 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:30:51.747 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:30:51.747 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:30:51.747 [Cloud] Queued cloud request. 2026-09-16T22:30:51.747 [Cloud] Dequeued cloud request. 2026-09-16T22:30:51.747 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:30:51.747 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:30:51.904 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{46C7C499-730B-4631-BB4C-DDC607E0F71D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 22:30:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T22:30:52.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:33:05.937 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:33:05.937 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:33:05.937 [Cloud] Queued cloud request. 2026-09-16T22:33:05.937 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:33:05.937 [Cloud] Dequeued cloud request. 2026-09-16T22:33:05.937 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:33:06.109 [Cloud] End of cloud request. 2026-09-16T22:33:06.609 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:33:12.468 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:33:12.468 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:33:12.468 [Cloud] Queued cloud request. 2026-09-16T22:33:12.468 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:33:12.468 [Cloud] Dequeued cloud request. 2026-09-16T22:33:12.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:33:12.765 [Cloud] End of cloud request. 2026-09-16T22:33:13.265 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:37:22.031 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:37:22.031 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:37:22.031 [Cloud] Queued cloud request. 2026-09-16T22:37:22.031 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:37:22.031 [Cloud] Dequeued cloud request. 2026-09-16T22:37:22.031 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:37:22.219 [Cloud] End of cloud request. 2026-09-16T22:37:22.719 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:37:48.798 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T22:37:52.252 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:37:52.252 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:37:52.252 [Cloud] Queued cloud request. 2026-09-16T22:37:52.252 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:37:52.252 [Cloud] Dequeued cloud request. 2026-09-16T22:37:52.252 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:37:52.345 [Cloud] End of cloud request. 2026-09-16T22:37:52.861 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:38:36.346 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:38:36.346 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:38:36.346 [Cloud] Queued cloud request. 2026-09-16T22:38:36.346 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:38:36.346 [Cloud] Dequeued cloud request. 2026-09-16T22:38:36.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:38:36.424 [Cloud] End of cloud request. 2026-09-16T22:38:36.924 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:41:44.159 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:41:44.159 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:41:44.159 [Cloud] Queued cloud request. 2026-09-16T22:41:44.159 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:41:44.159 [Cloud] Dequeued cloud request. 2026-09-16T22:41:44.159 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:41:44.331 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{42E3C8ED-C592-F81F-DD49-BA2EA7329418} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 22:41:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T22:41:44.831 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:43:35.410 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:43:35.410 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:43:35.410 [Cloud] Queued cloud request. 2026-09-16T22:43:35.410 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:43:35.410 [Cloud] Dequeued cloud request. 2026-09-16T22:43:35.410 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:43:41.832 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:43:41.832 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:43:41.832 [Cloud] Queued cloud request. 2026-09-16T22:43:41.832 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:43:41.832 [Cloud] Dequeued cloud request. 2026-09-16T22:43:41.832 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:43:42.004 [Cloud] End of cloud request. 2026-09-16T22:43:42.504 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:43:43.300 [Cloud] End of cloud request. 2026-09-16T22:43:43.800 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:45:37.051 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:45:37.051 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:45:37.051 [Cloud] Queued cloud request. 2026-09-16T22:45:37.051 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:45:37.051 [Cloud] Dequeued cloud request. 2026-09-16T22:45:37.051 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:45:37.238 [Cloud] End of cloud request. 2026-09-16T22:45:37.738 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:46:59.238 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:46:59.238 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:46:59.238 [Cloud] Queued cloud request. 2026-09-16T22:46:59.238 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:46:59.238 [Cloud] Dequeued cloud request. 2026-09-16T22:46:59.238 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:46:59.441 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A69BA79D-AC22-D487-CE61-5412E2CA505F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 22:46:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T22:46:59.941 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:48:02.553 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:48:02.553 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:48:02.553 [Cloud] Queued cloud request. 2026-09-16T22:48:02.553 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:48:02.553 [Cloud] Dequeued cloud request. 2026-09-16T22:48:02.553 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:48:12.694 [Cloud] End of cloud request. 2026-09-16T22:48:13.194 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:52:53.805 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-16T22:55:08.117 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:55:08.149 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-16T22:55:08.149 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-16T22:55:08.149 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-16T22:55:08.149 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T22:55:08.149 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-16T22:55:08.149 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-16T22:55:08.149 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-16T22:55:08.149 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-16T22:55:08.164 MdCoreSvc is supported in this platform and OS 2026-09-16T22:55:08.617 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-16T22:55:08.617 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-16T22:55:08.617 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-16T22:58:44.557 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T22:58:44.557 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T22:58:44.557 [Cloud] Queued cloud request. 2026-09-16T22:58:44.557 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T22:58:44.557 [Cloud] Dequeued cloud request. 2026-09-16T22:58:44.557 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T22:58:44.745 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8AB4A802-1456-4E19-9998-06EB8F9501DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 22:58:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T22:58:45.245 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:01:19.448 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:01:19.448 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:01:19.448 [Cloud] Queued cloud request. 2026-09-16T23:01:19.448 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:01:19.448 [Cloud] Dequeued cloud request. 2026-09-16T23:01:19.448 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:01:19.635 [Cloud] End of cloud request. 2026-09-16T23:01:20.151 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:02:43.760 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:02:43.760 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:02:43.760 [Cloud] Queued cloud request. 2026-09-16T23:02:43.760 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:02:43.760 [Cloud] Dequeued cloud request. 2026-09-16T23:02:43.760 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:02:43.932 [Cloud] End of cloud request. 2026-09-16T23:02:44.432 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:06:45.170 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:06:45.170 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:06:45.170 [Cloud] Queued cloud request. 2026-09-16T23:06:45.170 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:06:45.170 [Cloud] Dequeued cloud request. 2026-09-16T23:06:45.170 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:06:45.357 [Cloud] End of cloud request. 2026-09-16T23:06:45.857 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:07:58.812 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T23:13:51.079 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:13:51.079 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:13:51.079 [Cloud] Queued cloud request. 2026-09-16T23:13:51.079 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:13:51.079 [Cloud] Dequeued cloud request. 2026-09-16T23:13:51.079 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:13:51.297 [Cloud] End of cloud request. 2026-09-16T23:13:51.797 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:15:48.938 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:15:48.938 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:15:48.938 [Cloud] Queued cloud request. 2026-09-16T23:15:48.938 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:15:48.938 [Cloud] Dequeued cloud request. 2026-09-16T23:15:48.938 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:15:49.126 [Cloud] End of cloud request. 2026-09-16T23:15:49.641 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:15:57.485 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:15:57.485 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:15:57.485 [Cloud] Queued cloud request. 2026-09-16T23:15:57.485 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:15:57.485 [Cloud] Dequeued cloud request. 2026-09-16T23:15:57.485 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:15:57.563 [Cloud] End of cloud request. 2026-09-16T23:15:58.079 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:22:13.677 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:22:13.677 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:22:13.677 [Cloud] Queued cloud request. 2026-09-16T23:22:13.677 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:22:13.677 [Cloud] Dequeued cloud request. 2026-09-16T23:22:13.677 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:22:13.880 [Cloud] End of cloud request. 2026-09-16T23:22:14.396 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:23:03.818 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T23:23:19.693 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:23:19.693 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:23:19.693 [Cloud] Queued cloud request. 2026-09-16T23:23:19.693 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:23:19.693 [Cloud] Dequeued cloud request. 2026-09-16T23:23:19.693 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:23:19.865 [Cloud] End of cloud request. 2026-09-16T23:23:20.365 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:24:00.787 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:24:00.787 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:24:00.787 [Cloud] Queued cloud request. 2026-09-16T23:24:00.787 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:24:00.787 [Cloud] Dequeued cloud request. 2026-09-16T23:24:00.787 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:24:00.865 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3057EA2E-3993-D33B-C901-C24CFA17DD2D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 23:24:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T23:24:01.365 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:28:30.539 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:28:30.539 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:28:30.539 [Cloud] Queued cloud request. 2026-09-16T23:28:30.539 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:28:30.539 [Cloud] Dequeued cloud request. 2026-09-16T23:28:30.539 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:28:30.977 [Cloud] End of cloud request. 2026-09-16T23:28:31.477 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:28:50.398 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 7690, Count: 475, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-16T23:28:50.398 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 4378, Count: 386, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-16T23:28:50.398 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-16T23:28:50.398 ProcessImageName: WmiPrvSE.exe, Pid: 160, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-16T23:28:50.398 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-16T23:28:50.398 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 121, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-16T23:28:50.398 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-16T23:28:50.398 ProcessImageName: powershell.exe, Pid: 1824, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpAF7.tmp, EstimatedImpact: 0% 2026-09-16T23:28:50.398 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-16T23:28:50.398 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-16T23:28:50.398 ProcessImageName: taskhostw.exe, Pid: 1228, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-16T23:29:44.742 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:29:44.742 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:29:44.742 [Cloud] Queued cloud request. 2026-09-16T23:29:44.742 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:29:44.742 [Cloud] Dequeued cloud request. 2026-09-16T23:29:44.742 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:29:44.930 [Cloud] End of cloud request. 2026-09-16T23:29:45.445 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:31:20.368 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:31:20.368 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:31:20.368 [Cloud] Queued cloud request. 2026-09-16T23:31:20.368 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:31:20.368 [Cloud] Dequeued cloud request. 2026-09-16T23:31:20.368 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:31:20.540 [Cloud] End of cloud request. 2026-09-16T23:31:21.040 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:31:51.853 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:31:51.853 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:31:51.853 [Cloud] Queued cloud request. 2026-09-16T23:31:51.853 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:31:51.853 [Cloud] Dequeued cloud request. 2026-09-16T23:31:51.853 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:31:51.931 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CF0FA2F9-699D-C90B-E3EC-158E431F5856} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 23:31:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T23:31:52.431 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:33:56.182 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:33:56.182 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:33:56.182 [Cloud] Queued cloud request. 2026-09-16T23:33:56.182 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:33:56.182 [Cloud] Dequeued cloud request. 2026-09-16T23:33:56.182 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:33:56.385 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3494ADAF-BAEF-698A-D8DD-EF4D8120ECC3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 23:33:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T23:33:56.885 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:37:45.324 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:37:45.324 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:37:45.324 [Cloud] Queued cloud request. 2026-09-16T23:37:45.324 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:37:45.324 [Cloud] Dequeued cloud request. 2026-09-16T23:37:45.324 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:37:45.496 [Cloud] End of cloud request. 2026-09-16T23:37:46.012 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:38:04.903 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:38:04.903 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:38:04.903 [Cloud] Queued cloud request. 2026-09-16T23:38:04.903 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:38:04.903 [Cloud] Dequeued cloud request. 2026-09-16T23:38:04.903 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:38:04.981 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0686ECCF-7849-6F3C-A619-ECD907587F3B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 23:38:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T23:38:05.481 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:38:08.825 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T23:39:31.340 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:39:31.340 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:39:31.340 [Cloud] Queued cloud request. 2026-09-16T23:39:31.340 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:39:31.340 [Cloud] Dequeued cloud request. 2026-09-16T23:39:31.340 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:39:31.575 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E27D3AE1-BA14-736F-D234-EEA22A89CA22} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 23:39:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T23:39:32.075 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:40:42.981 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:40:42.981 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:40:42.981 [Cloud] Queued cloud request. 2026-09-16T23:40:42.981 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:40:42.981 [Cloud] Dequeued cloud request. 2026-09-16T23:40:42.981 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:40:43.137 [Cloud] End of cloud request. 2026-09-16T23:40:43.637 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:44:23.483 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:44:23.483 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:44:23.483 [Cloud] Queued cloud request. 2026-09-16T23:44:23.483 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:44:23.483 [Cloud] Dequeued cloud request. 2026-09-16T23:44:23.483 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:44:23.639 [Cloud] End of cloud request. 2026-09-16T23:44:24.155 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:45:52.405 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:45:52.405 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:45:52.405 [Cloud] Queued cloud request. 2026-09-16T23:45:52.405 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:45:52.405 [Cloud] Dequeued cloud request. 2026-09-16T23:45:52.405 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{067C8C91-FE47-62BF-054C-2DD34D0B56A7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-16-2026 23:45:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-16T23:45:52.561 [Cloud] End of cloud request. 2026-09-16T23:45:53.061 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:46:02.123 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:46:02.123 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:46:02.123 [Cloud] Queued cloud request. 2026-09-16T23:46:02.123 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:46:02.123 [Cloud] Dequeued cloud request. 2026-09-16T23:46:02.123 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:46:02.201 [Cloud] End of cloud request. 2026-09-16T23:46:02.701 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:46:29.186 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:46:29.186 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:46:29.186 [Cloud] Queued cloud request. 2026-09-16T23:46:29.186 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:46:29.186 [Cloud] Dequeued cloud request. 2026-09-16T23:46:29.186 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:46:29.264 [Cloud] End of cloud request. 2026-09-16T23:46:29.764 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:48:09.360 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:48:09.360 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:48:09.360 [Cloud] Queued cloud request. 2026-09-16T23:48:09.360 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:48:09.360 [Cloud] Dequeued cloud request. 2026-09-16T23:48:09.360 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:48:09.501 [Cloud] End of cloud request. 2026-09-16T23:48:10.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:49:14.267 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:49:14.267 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:49:14.267 [Cloud] Queued cloud request. 2026-09-16T23:49:14.267 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:49:14.267 [Cloud] Dequeued cloud request. 2026-09-16T23:49:14.267 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:49:14.408 [Cloud] End of cloud request. 2026-09-16T23:49:14.908 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-16T23:53:13.831 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-16T23:54:59.863 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-16T23:54:59.863 [Cloud] Start of cloud request. Passive mode: 0 2026-09-16T23:54:59.863 [Cloud] Queued cloud request. 2026-09-16T23:54:59.863 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-16T23:54:59.863 [Cloud] Dequeued cloud request. 2026-09-16T23:55:00.035 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-16T23:55:00.222 [Cloud] End of cloud request. 2026-09-16T23:55:00.738 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:01:21.193 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:01:21.193 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:01:21.193 [Cloud] Queued cloud request. 2026-09-17T00:01:21.193 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:01:21.193 [Cloud] Dequeued cloud request. 2026-09-17T00:01:21.193 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:01:21.380 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{01CC7CE4-7008-0C5D-2A2E-4C73341E4907} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 00:01:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T00:01:21.896 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:05:13.054 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:05:13.054 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:05:13.054 [Cloud] Queued cloud request. 2026-09-17T00:05:13.054 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:05:13.054 [Cloud] Dequeued cloud request. 2026-09-17T00:05:13.257 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:05:13.445 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9C7E8691-9A96-7683-B696-908C39C1EBD9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 00:05:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T00:05:13.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:08:18.838 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T00:11:59.933 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:11:59.933 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:11:59.933 [Cloud] Queued cloud request. 2026-09-17T00:11:59.933 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:12:00.058 [Cloud] Dequeued cloud request. 2026-09-17T00:12:00.058 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:12:00.245 [Cloud] End of cloud request. 2026-09-17T00:12:00.761 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:12:02.089 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:12:02.089 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:12:02.089 [Cloud] Queued cloud request. 2026-09-17T00:12:02.089 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:12:02.089 [Cloud] Dequeued cloud request. 2026-09-17T00:12:02.089 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:12:02.167 [Cloud] End of cloud request. 2026-09-17T00:12:02.667 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:12:56.105 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:12:56.105 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:12:56.105 [Cloud] Queued cloud request. 2026-09-17T00:12:56.105 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:12:56.105 [Cloud] Dequeued cloud request. 2026-09-17T00:12:56.105 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:12:56.183 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5D9FCD1A-B981-F5BB-E794-4139339D0D7B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 00:12:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T00:12:56.699 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:13:36.168 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:13:36.168 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:13:36.168 [Cloud] Queued cloud request. 2026-09-17T00:13:36.168 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:13:36.168 [Cloud] Dequeued cloud request. 2026-09-17T00:13:36.168 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:13:36.246 [Cloud] End of cloud request. 2026-09-17T00:13:36.746 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:14:14.090 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:F141943C-E256-4EE1-9007-F53DB447427E, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-17T00:14:14.090 Scheduled scan with Id F141943C-E256-4EE1-9007-F53DB447427E configured CPU priority: normal (LowCpuPriority: 0) 2026-09-17T00:14:14.090 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-17T00:14:14.090 [SFC] System file cache build is not needed (already completed) 2026-09-17T00:14:36.403 Engine:Triggered AR EMS scan 2026-09-17T00:14:36.403 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.434 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.434 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.449 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.449 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.465 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.465 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.481 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.496 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.496 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.496 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.496 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.512 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.512 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.512 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.528 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.528 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.543 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.543 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.559 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.559 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.574 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.574 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.574 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.574 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.590 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.606 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.606 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.606 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.606 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.621 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.621 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.637 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.637 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.653 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.653 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.653 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.668 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.668 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.684 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.684 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.684 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.684 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.699 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.699 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.715 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.715 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.731 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.731 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.746 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.746 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.762 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.778 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.793 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.793 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.824 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.840 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.856 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.871 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.871 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:14:36.887 Engine:EMS scan for process: svchost pid: 7044, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-17T00:15:03.246 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:15:03.246 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:15:03.246 [Cloud] Queued cloud request. 2026-09-17T00:15:03.246 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:15:03.246 [Cloud] Dequeued cloud request. 2026-09-17T00:15:03.246 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:15:03.403 [Cloud] End of cloud request. 2026-09-17T00:15:03.903 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:15:15.871 QuickScan:ScanID:F141943C-E256-4EE1-9007-F53DB447427E: Quick scan finished with error 0 2026-09-17T00:15:16.387 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-17T00:15:16.387 [RTP] Duplicating the current plugin configuration object... 2026-09-17T00:15:16.387 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-17T00:15:16.387 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-17T00:15:16.387 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-17T00:15:16.387 [RTP] No config change detected. Not updating plugin configuration. 2026-09-17T00:15:16.387 [RTP] No config changes found. No configuration switch. 2026-09-17T00:15:16.387 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-17T00:15:24.871 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:15:24.871 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:15:24.871 [Cloud] Queued cloud request. 2026-09-17T00:15:24.871 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:15:24.871 [Cloud] Dequeued cloud request. 2026-09-17T00:15:24.871 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:15:24.996 [Cloud] End of cloud request. 2026-09-17T00:15:25.496 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:15:34.512 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:15:34.512 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:15:34.512 [Cloud] Queued cloud request. 2026-09-17T00:15:34.512 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:15:34.512 [Cloud] Dequeued cloud request. 2026-09-17T00:15:34.512 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:15:34.590 [Cloud] End of cloud request. 2026-09-17T00:15:35.090 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:20:03.670 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:20:03.670 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:20:03.670 [Cloud] Queued cloud request. 2026-09-17T00:20:03.670 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:20:03.670 [Cloud] Dequeued cloud request. 2026-09-17T00:20:03.670 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:20:03.811 [Cloud] End of cloud request. 2026-09-17T00:20:04.311 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:20:09.186 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:20:09.186 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:20:09.186 [Cloud] Queued cloud request. 2026-09-17T00:20:09.186 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:20:09.186 [Cloud] Dequeued cloud request. 2026-09-17T00:20:09.186 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:20:09.295 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{26267DBB-85D4-7924-09EF-A97BD8721191} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 00:20:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T00:20:09.795 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:21:04.280 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:21:04.280 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:21:04.280 [Cloud] Queued cloud request. 2026-09-17T00:21:04.280 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:21:04.280 [Cloud] Dequeued cloud request. 2026-09-17T00:21:04.280 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:21:04.374 [Cloud] End of cloud request. 2026-09-17T00:21:04.874 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:22:14.765 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:22:14.765 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:22:14.765 [Cloud] Queued cloud request. 2026-09-17T00:22:14.765 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:22:14.765 [Cloud] Dequeued cloud request. 2026-09-17T00:22:14.765 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:22:24.843 [Cloud] End of cloud request. 2026-09-17T00:22:25.359 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:22:56.547 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:22:56.547 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:22:56.547 [Cloud] Queued cloud request. 2026-09-17T00:22:56.547 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:22:56.547 [Cloud] Dequeued cloud request. 2026-09-17T00:22:56.547 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:22:56.625 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FDD3110C-167C-851E-46A5-A6852ED89EFB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 00:22:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T00:22:57.125 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:23:23.844 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T00:24:01.094 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:24:01.094 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:24:01.094 [Cloud] Queued cloud request. 2026-09-17T00:24:01.094 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:24:01.094 [Cloud] Dequeued cloud request. 2026-09-17T00:24:01.094 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:24:06.485 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:24:06.485 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:24:06.485 [Cloud] Queued cloud request. 2026-09-17T00:24:06.485 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:24:06.485 [Cloud] Dequeued cloud request. 2026-09-17T00:24:06.485 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:24:06.657 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8D129DF8-0C0E-554D-AEDB-398399851289} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 00:24:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T00:24:07.172 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:24:08.938 [Cloud] End of cloud request. 2026-09-17T00:24:09.438 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:26:36.094 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:26:36.094 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:26:36.094 [Cloud] Queued cloud request. 2026-09-17T00:26:36.094 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:26:36.094 [Cloud] Dequeued cloud request. 2026-09-17T00:26:36.094 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:26:36.282 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{414ABEC9-B659-2EF2-9F0F-2DC95EDAA141} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 00:26:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T00:26:36.798 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:27:18.673 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:27:18.673 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:27:18.673 [Cloud] Queued cloud request. 2026-09-17T00:27:18.673 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:27:18.673 [Cloud] Dequeued cloud request. 2026-09-17T00:27:18.673 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:27:18.766 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BBD8AA82-156A-6230-5725-48E76FD7A38C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 00:27:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T00:27:19.282 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:29:23.846 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:29:23.846 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:29:23.846 [Cloud] Queued cloud request. 2026-09-17T00:29:23.846 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:29:23.846 [Cloud] Dequeued cloud request. 2026-09-17T00:29:23.846 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:29:24.034 [Cloud] End of cloud request. 2026-09-17T00:29:24.534 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:30:03.721 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:30:03.721 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:30:03.721 [Cloud] Queued cloud request. 2026-09-17T00:30:03.721 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:30:03.721 [Cloud] Dequeued cloud request. 2026-09-17T00:30:03.721 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:30:03.800 [Cloud] End of cloud request. 2026-09-17T00:30:04.300 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:31:56.003 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:31:56.003 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:31:56.003 [Cloud] Queued cloud request. 2026-09-17T00:31:56.003 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:31:56.003 [Cloud] Dequeued cloud request. 2026-09-17T00:31:56.003 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:31:56.206 [Cloud] End of cloud request. 2026-09-17T00:31:56.706 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:33:26.596 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:33:26.596 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:33:26.596 [Cloud] Queued cloud request. 2026-09-17T00:33:26.596 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:33:26.596 [Cloud] Dequeued cloud request. 2026-09-17T00:33:26.596 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:33:26.784 [Cloud] End of cloud request. 2026-09-17T00:33:27.284 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:33:59.050 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:33:59.050 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:33:59.050 [Cloud] Queued cloud request. 2026-09-17T00:33:59.050 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:33:59.050 [Cloud] Dequeued cloud request. 2026-09-17T00:33:59.050 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:34:09.082 [Cloud] End of cloud request. 2026-09-17T00:34:09.582 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:38:28.851 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T00:39:36.945 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:39:36.945 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:39:36.945 [Cloud] Queued cloud request. 2026-09-17T00:39:36.945 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:39:37.116 [Cloud] Dequeued cloud request. 2026-09-17T00:39:37.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:39:37.491 [Cloud] End of cloud request. 2026-09-17T00:39:37.991 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:39:43.460 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:39:43.460 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:39:43.460 [Cloud] Queued cloud request. 2026-09-17T00:39:43.460 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:39:43.460 [Cloud] Dequeued cloud request. 2026-09-17T00:39:43.460 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:39:53.491 [Cloud] End of cloud request. 2026-09-17T00:39:54.007 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:40:53.726 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:40:53.726 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:40:53.726 [Cloud] Queued cloud request. 2026-09-17T00:40:53.726 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:40:53.726 [Cloud] Dequeued cloud request. 2026-09-17T00:40:53.726 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:40:56.538 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B38208BE-D9E9-3D47-21FB-D104B1D30F67} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 00:40:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T00:40:57.054 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:43:21.493 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:43:21.493 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:43:21.493 [Cloud] Queued cloud request. 2026-09-17T00:43:21.493 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:43:21.493 [Cloud] Dequeued cloud request. 2026-09-17T00:43:21.493 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:43:21.696 [Cloud] End of cloud request. 2026-09-17T00:43:22.196 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:45:33.369 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:45:33.369 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:45:33.369 [Cloud] Queued cloud request. 2026-09-17T00:45:33.369 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:45:33.369 [Cloud] Dequeued cloud request. 2026-09-17T00:45:33.369 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:45:33.556 [Cloud] End of cloud request. 2026-09-17T00:45:34.072 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:47:26.432 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:47:26.432 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:47:26.432 [Cloud] Queued cloud request. 2026-09-17T00:47:26.432 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:47:26.432 [Cloud] Dequeued cloud request. 2026-09-17T00:47:26.432 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:47:26.620 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{02FC8F77-660F-6538-34C1-8C8515DFA2B3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 00:47:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T00:47:27.120 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:50:22.449 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:50:22.449 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:50:22.449 [Cloud] Queued cloud request. 2026-09-17T00:50:22.449 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:50:22.449 [Cloud] Dequeued cloud request. 2026-09-17T00:50:22.605 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:50:26.402 [Cloud] End of cloud request. 2026-09-17T00:50:26.918 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:53:33.857 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T00:57:27.984 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:57:27.984 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:57:27.984 [Cloud] Queued cloud request. 2026-09-17T00:57:27.984 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:57:28.140 [Cloud] Dequeued cloud request. 2026-09-17T00:57:28.140 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:57:28.343 [Cloud] End of cloud request. 2026-09-17T00:57:28.859 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:57:43.062 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:57:43.062 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:57:43.062 [Cloud] Queued cloud request. 2026-09-17T00:57:43.062 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:57:43.062 [Cloud] Dequeued cloud request. 2026-09-17T00:57:43.062 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:57:43.140 [Cloud] End of cloud request. 2026-09-17T00:57:43.640 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T00:58:44.516 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T00:58:44.516 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T00:58:44.516 [Cloud] Queued cloud request. 2026-09-17T00:58:44.516 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T00:58:44.516 [Cloud] Dequeued cloud request. 2026-09-17T00:58:44.516 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T00:58:46.938 [Cloud] End of cloud request. 2026-09-17T00:58:47.453 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:00:02.281 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927893, FileId: 0x1a00000003dc07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.281 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927894, FileId: 0x2500000003cd5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.297 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927900, FileId: 0x1c00000003dc07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.297 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927901, FileId: 0x2700000003cd5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.313 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927906, FileId: 0x1e00000003dc07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.313 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927907, FileId: 0x2900000003cd5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.328 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927913, FileId: 0x2000000003dc07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.328 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927912, FileId: 0x2b00000003cd5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.344 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927918, FileId: 0x2200000003dc07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.344 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927919, FileId: 0x2d00000003cd5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.359 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927924, FileId: 0x2400000003dc07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.359 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927925, FileId: 0x2f00000003cd5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.359 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927930, FileId: 0x2600000003dc07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.359 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927931, FileId: 0x3100000003cd5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.375 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927936, FileId: 0x2800000003dc07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.375 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927937, FileId: 0x3300000003cd5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.391 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927942, FileId: 0x2a00000003dc07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.391 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927943, FileId: 0x3500000003cd5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.406 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927948, FileId: 0x2c00000003dc07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.406 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927949, FileId: 0x3700000003cd5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.406 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927954, FileId: 0x2e00000003dc07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.406 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927955, FileId: 0x3900000003cd5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.425 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927961, FileId: 0x3b00000003cd5b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:00:02.425 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6927960, FileId: 0x3000000003dc07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T01:01:35.109 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:01:35.109 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:01:35.109 [Cloud] Queued cloud request. 2026-09-17T01:01:35.109 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:01:35.109 [Cloud] Dequeued cloud request. 2026-09-17T01:01:35.109 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:01:35.313 [Cloud] End of cloud request. 2026-09-17T01:01:35.813 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:04:11.719 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:04:11.719 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:04:11.719 [Cloud] Queued cloud request. 2026-09-17T01:04:11.719 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:04:11.719 [Cloud] Dequeued cloud request. 2026-09-17T01:04:11.719 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:04:11.907 [Cloud] End of cloud request. 2026-09-17T01:04:12.423 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:05:20.735 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:05:20.735 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:05:20.735 [Cloud] Queued cloud request. 2026-09-17T01:05:20.735 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:05:20.735 [Cloud] Dequeued cloud request. 2026-09-17T01:05:20.735 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:05:20.923 [Cloud] End of cloud request. 2026-09-17T01:05:21.423 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:08:38.864 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T01:13:52.241 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:13:52.241 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:13:52.241 [Cloud] Queued cloud request. 2026-09-17T01:13:52.241 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:13:52.241 [Cloud] Dequeued cloud request. 2026-09-17T01:13:52.241 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:13:52.397 [Cloud] End of cloud request. 2026-09-17T01:13:52.913 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:15:23.929 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:15:23.929 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:15:23.929 [Cloud] Queued cloud request. 2026-09-17T01:15:23.929 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:15:23.929 [Cloud] Dequeued cloud request. 2026-09-17T01:15:23.929 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:15:24.086 [Cloud] End of cloud request. 2026-09-17T01:15:24.586 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:18:24.196 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:18:24.196 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:18:24.196 [Cloud] Queued cloud request. 2026-09-17T01:18:24.196 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:18:24.196 [Cloud] Dequeued cloud request. 2026-09-17T01:18:24.368 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:18:24.509 [Cloud] End of cloud request. 2026-09-17T01:18:25.009 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:23:06.947 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:23:06.947 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:23:06.947 [Cloud] Queued cloud request. 2026-09-17T01:23:06.947 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:23:06.947 [Cloud] Dequeued cloud request. 2026-09-17T01:23:06.947 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:23:07.088 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E322299D-BD83-CB5B-E3CA-A7B476233DF1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 01:23:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T01:23:07.604 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:23:20.932 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:23:20.932 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:23:20.932 [Cloud] Queued cloud request. 2026-09-17T01:23:20.932 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:23:20.932 [Cloud] Dequeued cloud request. 2026-09-17T01:23:20.932 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:23:21.010 [Cloud] End of cloud request. 2026-09-17T01:23:21.510 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:23:43.869 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T01:26:36.293 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:26:36.293 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:26:36.293 [Cloud] Queued cloud request. 2026-09-17T01:26:36.293 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:26:36.293 [Cloud] Dequeued cloud request. 2026-09-17T01:26:36.293 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:26:36.449 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{066CEE82-5F98-A226-B941-E66E94F5284A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 01:26:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T01:26:36.949 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:27:56.138 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:27:56.138 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:27:56.138 [Cloud] Queued cloud request. 2026-09-17T01:27:56.138 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:27:56.138 [Cloud] Dequeued cloud request. 2026-09-17T01:27:56.138 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:27:56.295 [Cloud] End of cloud request. 2026-09-17T01:27:56.795 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:28:50.467 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 9708, Count: 654, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-17T01:28:50.467 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 5192, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T01:28:50.467 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 2126, Count: 147, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-17T01:28:50.467 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-17T01:28:50.467 ProcessImageName: AgentShellService.exe, Pid: 2592, TotalTime: 731, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 51% 2026-09-17T01:28:50.467 ProcessImageName: WmiPrvSE.exe, Pid: 160, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-17T01:28:50.467 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 272, Count: 21, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-17T01:28:50.467 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-17T01:28:50.467 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-17T01:28:50.467 ProcessImageName: powershell.exe, Pid: 1824, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpAF7.tmp, EstimatedImpact: 0% 2026-09-17T01:28:50.467 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T01:28:50.467 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 30, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2.MAD, EstimatedImpact: 14% 2026-09-17T01:28:50.467 ProcessImageName: powershell.exe, Pid: 4116, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_np205jrl.r2i.ps1, EstimatedImpact: 0% 2026-09-17T01:28:50.467 ProcessImageName: mysqldump.exe, Pid: 1868, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-17T01:28:50.467 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-17T01:28:50.467 ProcessImageName: taskhostw.exe, Pid: 1228, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-17T01:32:40.952 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:32:40.952 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:32:40.952 [Cloud] Queued cloud request. 2026-09-17T01:32:40.952 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:32:40.952 [Cloud] Dequeued cloud request. 2026-09-17T01:32:40.952 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:32:41.093 [Cloud] End of cloud request. 2026-09-17T01:32:41.608 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:36:52.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:36:52.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:36:52.297 [Cloud] Queued cloud request. 2026-09-17T01:36:52.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:36:52.297 [Cloud] Dequeued cloud request. 2026-09-17T01:36:52.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:36:52.453 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CCDE1ED4-03E9-FC42-819B-0F123B2BBC5B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 01:36:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T01:36:52.969 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:37:29.079 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:37:29.079 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:37:29.079 [Cloud] Queued cloud request. 2026-09-17T01:37:29.079 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:37:29.079 [Cloud] Dequeued cloud request. 2026-09-17T01:37:29.079 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:37:33.423 [Cloud] End of cloud request. 2026-09-17T01:37:33.939 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:38:37.018 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:38:37.018 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:38:37.018 [Cloud] Queued cloud request. 2026-09-17T01:38:37.018 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:38:37.018 [Cloud] Dequeued cloud request. 2026-09-17T01:38:37.018 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:38:37.174 [Cloud] End of cloud request. 2026-09-17T01:38:37.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:38:48.877 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T01:41:32.893 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:41:32.893 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:41:32.893 [Cloud] Queued cloud request. 2026-09-17T01:41:32.893 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:41:32.893 [Cloud] Dequeued cloud request. 2026-09-17T01:41:32.893 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:41:33.049 [Cloud] End of cloud request. 2026-09-17T01:41:33.549 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:43:54.254 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:43:54.254 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:43:54.254 [Cloud] Queued cloud request. 2026-09-17T01:43:54.254 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:43:54.254 [Cloud] Dequeued cloud request. 2026-09-17T01:43:54.254 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:43:55.238 [Cloud] End of cloud request. 2026-09-17T01:43:55.754 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:45:53.801 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:45:53.801 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:45:53.801 [Cloud] Queued cloud request. 2026-09-17T01:45:53.801 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:45:53.801 [Cloud] Dequeued cloud request. 2026-09-17T01:45:53.816 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:45:58.520 [Cloud] End of cloud request. 2026-09-17T01:45:59.020 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:50:06.632 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:50:06.632 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:50:06.632 [Cloud] Queued cloud request. 2026-09-17T01:50:06.632 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:50:06.632 [Cloud] Dequeued cloud request. 2026-09-17T01:50:06.788 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:50:06.975 [Cloud] End of cloud request. 2026-09-17T01:50:07.475 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:51:40.601 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:51:40.601 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:51:40.601 [Cloud] Queued cloud request. 2026-09-17T01:51:40.601 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:51:40.601 [Cloud] Dequeued cloud request. 2026-09-17T01:51:40.601 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:51:40.773 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E028A66-8AB7-6451-2CF5-28FD2CEEA677} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 01:51:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T01:51:41.289 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:53:53.884 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T01:56:36.353 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:56:36.353 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:56:36.353 [Cloud] Queued cloud request. 2026-09-17T01:56:36.353 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:56:36.603 [Cloud] Dequeued cloud request. 2026-09-17T01:56:36.790 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:56:36.993 [Cloud] End of cloud request. 2026-09-17T01:56:37.509 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T01:58:52.261 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T01:58:52.261 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T01:58:52.261 [Cloud] Queued cloud request. 2026-09-17T01:58:52.261 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T01:58:52.261 [Cloud] Dequeued cloud request. 2026-09-17T01:58:52.261 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T01:58:52.464 [Cloud] End of cloud request. 2026-09-17T01:58:52.964 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:00:19.699 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:00:19.699 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:00:19.699 [Cloud] Queued cloud request. 2026-09-17T02:00:19.699 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:00:19.699 [Cloud] Dequeued cloud request. 2026-09-17T02:00:19.699 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:00:19.887 [Cloud] End of cloud request. 2026-09-17T02:00:20.402 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:06:50.247 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:06:50.247 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:06:50.247 [Cloud] Queued cloud request. 2026-09-17T02:06:50.247 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:06:50.247 [Cloud] Dequeued cloud request. 2026-09-17T02:06:50.247 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:07:00.388 [Cloud] End of cloud request. 2026-09-17T02:07:00.888 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:08:58.890 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T02:10:20.593 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:10:20.593 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:10:20.593 [Cloud] Queued cloud request. 2026-09-17T02:10:20.593 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:10:20.593 [Cloud] Dequeued cloud request. 2026-09-17T02:10:20.750 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:10:30.875 [Cloud] End of cloud request. 2026-09-17T02:10:31.390 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:17:40.785 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:17:40.785 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:17:40.785 [Cloud] Queued cloud request. 2026-09-17T02:17:40.785 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:17:40.785 [Cloud] Dequeued cloud request. 2026-09-17T02:17:40.785 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:17:40.925 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{05B5EEC9-BF37-418B-C1C1-352B13CE8982} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 02:17:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T02:17:41.441 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:20:58.348 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:20:58.348 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:20:58.348 [Cloud] Queued cloud request. 2026-09-17T02:20:58.348 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:20:58.348 [Cloud] Dequeued cloud request. 2026-09-17T02:20:58.348 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:20:58.504 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CCFB8AFD-8BF6-BE04-FCB5-A0940C47637D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 02:20:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T02:20:59.004 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:21:04.817 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:21:04.817 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:21:04.817 [Cloud] Queued cloud request. 2026-09-17T02:21:04.817 [Cloud] Dequeued cloud request. 2026-09-17T02:21:04.817 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:21:04.817 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:21:04.926 [Cloud] End of cloud request. 2026-09-17T02:21:05.442 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:24:03.897 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T02:26:37.162 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:26:37.162 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:26:37.162 [Cloud] Queued cloud request. 2026-09-17T02:26:37.162 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:26:37.162 [Cloud] Dequeued cloud request. 2026-09-17T02:26:37.162 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:26:37.319 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FBBE9771-EC02-D1E4-4BCD-8D89C4BF48C0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 02:26:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T02:26:37.834 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:28:08.883 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:28:08.883 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:28:08.883 [Cloud] Queued cloud request. 2026-09-17T02:28:08.883 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:28:08.883 [Cloud] Dequeued cloud request. 2026-09-17T02:28:08.883 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:28:09.055 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{94ADD36E-FAD4-D400-FB64-C84848A370ED} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 02:28:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T02:28:09.555 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:38:33.981 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:38:33.981 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:38:33.981 [Cloud] Queued cloud request. 2026-09-17T02:38:33.981 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:38:33.981 [Cloud] Dequeued cloud request. 2026-09-17T02:38:33.981 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:38:34.153 [Cloud] End of cloud request. 2026-09-17T02:38:34.653 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:39:08.903 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T02:40:09.059 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:40:09.059 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:40:09.059 [Cloud] Queued cloud request. 2026-09-17T02:40:09.059 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:40:09.059 [Cloud] Dequeued cloud request. 2026-09-17T02:40:09.059 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:40:09.247 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{064C14FC-CF75-22B1-A396-6AE45446F4CE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 02:40:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T02:40:09.747 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:40:41.450 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:40:41.450 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:40:41.450 [Cloud] Queued cloud request. 2026-09-17T02:40:41.450 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:40:41.450 [Cloud] Dequeued cloud request. 2026-09-17T02:40:41.450 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:40:41.528 [Cloud] End of cloud request. 2026-09-17T02:40:42.028 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:41:51.623 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:41:51.623 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:41:51.623 [Cloud] Queued cloud request. 2026-09-17T02:41:51.623 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:41:51.623 [Cloud] Dequeued cloud request. 2026-09-17T02:41:51.623 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:41:51.810 [Cloud] End of cloud request. 2026-09-17T02:41:52.326 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:46:23.655 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:46:23.655 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:46:23.655 [Cloud] Queued cloud request. 2026-09-17T02:46:23.655 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:46:23.655 [Cloud] Dequeued cloud request. 2026-09-17T02:46:23.655 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:46:23.858 [Cloud] End of cloud request. 2026-09-17T02:46:24.374 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:47:16.608 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:47:16.608 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:47:16.608 [Cloud] Queued cloud request. 2026-09-17T02:47:16.608 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:47:16.608 [Cloud] Dequeued cloud request. 2026-09-17T02:47:16.608 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:47:16.687 [Cloud] End of cloud request. 2026-09-17T02:47:17.187 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:53:30.175 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:53:30.175 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:53:30.175 [Cloud] Queued cloud request. 2026-09-17T02:53:30.175 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:53:30.175 [Cloud] Dequeued cloud request. 2026-09-17T02:53:30.175 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:53:30.331 [Cloud] End of cloud request. 2026-09-17T02:53:30.831 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:53:34.487 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:53:34.487 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:53:34.487 [Cloud] Queued cloud request. 2026-09-17T02:53:34.487 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:53:34.487 [Cloud] Dequeued cloud request. 2026-09-17T02:53:34.487 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:53:34.565 [Cloud] End of cloud request. 2026-09-17T02:53:35.081 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:54:13.909 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T02:55:37.363 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:55:37.363 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:55:37.363 [Cloud] Queued cloud request. 2026-09-17T02:55:37.363 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:55:37.363 [Cloud] Dequeued cloud request. 2026-09-17T02:55:37.363 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:55:37.535 [Cloud] End of cloud request. 2026-09-17T02:55:38.050 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T02:56:27.191 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T02:56:27.191 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T02:56:27.191 [Cloud] Queued cloud request. 2026-09-17T02:56:27.191 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T02:56:27.191 [Cloud] Dequeued cloud request. 2026-09-17T02:56:27.191 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T02:56:27.331 [Cloud] End of cloud request. 2026-09-17T02:56:27.847 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:00:39.787 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:00:39.787 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:00:39.787 [Cloud] Queued cloud request. 2026-09-17T03:00:39.787 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:00:39.787 [Cloud] Dequeued cloud request. 2026-09-17T03:00:39.944 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:00:40.084 [Cloud] End of cloud request. 2026-09-17T03:00:40.600 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:07:07.054 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-17T03:07:07.054 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-17T03:07:07.054 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-17T03:07:07.054 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-17T03:07:07.054 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-17T03:07:07.085 [AutoPurge] Cleanup Routine tasks have started. 2026-09-17T03:07:07.085 [AutoPurge] Verification Routine tasks have started. 2026-09-17T03:07:07.101 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-17T03:07:07.101 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-17T03:07:07.101 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-17-2026 03:07:07 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-17-2026 03:07:07 2026-09-17T03:07:07.101 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-17T03:07:07.101 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-17T03:07:07.101 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-17T03:07:07.101 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ...ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-17T03:07:07.125 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-17T03:07:07.179 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-17T03:07:07.273 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-17T03:07:07.289 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-17T03:07:07.304 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-17T03:07:07.325 [AutoPurge] Removing expired default signature package ... 2026-09-17T03:07:07.539 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-17T03:07:07.632 Job Notification: New process added to job (2148) 2026-09-17T03:07:07.679 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-17T03:07:07.867 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-17T03:07:07.898 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-17T03:07:07.898 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-17T03:07:07.898 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-17T03:07:07.898 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-17T03:07:07.898 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-17T03:07:07.898 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-17T03:07:07.898 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-17T03:07:07.898 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-17T03:07:07.898 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-17T03:07:07.898 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-17T03:07:07.898 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-17T03:07:07.898 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-17T03:07:07.898 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-17T03:07:07.898 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-17T03:07:07.898 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-17T03:07:07.898 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-17T03:07:07.898 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-17T03:07:07.898 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-17T03:07:07.898 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-17T03:07:07.898 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-17T03:07:07.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:07:07.914 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:07:07.914 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:07:07.929 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:07:07.929 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:07:08.164 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:07:08.679 Job Notification: Process exited from job (2148) 2026-09-17T03:07:08.742 [AutoPurge] Verification Routine tasks have ended. 2026-09-17T03:07:08.836 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-17T03:07:08.945 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-17T03:07:09.414 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-17T03:07:09.507 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-17T03:07:09.679 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-17T03:07:10.492 [RTP] Duplicating the current plugin configuration object... 2026-09-17T03:07:10.492 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-17T03:07:10.492 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-17T03:07:10.492 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-17T03:07:10.492 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-17T03:07:10.492 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-17T03:07:11.336 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:11.710 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-17T03:07:11.976 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-17T03:07:11.992 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:12.195 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-17T03:07:12.851 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-17T03:07:13.445 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-17T03:07:13.539 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-17T03:07:13.695 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-17T03:07:13.976 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:07:14.132 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-17T03:07:14.507 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-17T03:07:14.632 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-17T03:07:14.820 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:14.960 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:15.039 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:15.070 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-17T03:07:15.273 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:07:15.335 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-17T03:07:15.382 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-17T03:07:15.429 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-17T03:07:15.570 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-17T03:07:15.945 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:15.976 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-17T03:07:16.429 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:07:16.554 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-17T03:07:17.179 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-17T03:07:17.664 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:17.820 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:07:18.117 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-17T03:07:18.539 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-17T03:07:18.632 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-17T03:07:19.070 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-17T03:07:19.211 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:19.695 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:07:19.804 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-17T03:07:19.820 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-17T03:07:19.883 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-17T03:07:20.039 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-17T03:07:20.101 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-17T03:07:20.148 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:20.226 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-17T03:07:20.445 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-17T03:07:20.883 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-17T03:07:21.148 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-17T03:07:21.695 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-17T03:07:22.992 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-17T03:07:23.445 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-17T03:07:23.477 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-17T03:07:23.508 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-17T03:07:23.508 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-17T03:07:23.524 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-17T03:07:23.664 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-17T03:07:23.914 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-17T03:07:23.930 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:24.008 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-17T03:07:24.414 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-17T03:07:24.461 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-17T03:07:24.477 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-17T03:07:24.524 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-17T03:07:25.024 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:25.211 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:25.227 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-17T03:07:25.274 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-17T03:07:25.289 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:25.727 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-17T03:07:26.055 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-17T03:07:26.071 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:26.758 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-17T03:07:26.774 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-17T03:07:27.399 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:07:27.743 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-17T03:07:28.133 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-17T03:07:28.321 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:28.508 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:28.665 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-17T03:07:28.852 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-17T03:07:28.899 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-17T03:07:28.946 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:29.462 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-17T03:07:29.743 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-17T03:07:29.790 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-17T03:07:29.837 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:07:30.180 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:07:30.290 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.269.9\psmachine_64.dll", hr=0x0 2026-09-17T03:07:30.383 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-17T03:07:30.508 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-17T03:07:30.633 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-17T03:07:30.665 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-17T03:07:30.727 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-17T03:07:31.274 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-17T03:07:31.743 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-17T03:07:31.868 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-17T03:07:31.977 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-17T03:07:32.571 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-17T03:07:32.618 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:32.930 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-17T03:07:33.040 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-17T03:07:33.040 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-17T03:07:33.071 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-17T03:07:33.181 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-17T03:07:33.212 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-17T03:07:33.259 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-17T03:07:33.509 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.269.9\microsoftedgeupdatesetup_x86_1.3.269.9.exe", hr=0x0 2026-09-17T03:07:33.618 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-17T03:07:33.634 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-17T03:07:33.977 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-17T03:07:34.134 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:34.259 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-17T03:07:34.259 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-17T03:07:34.493 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:07:34.727 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-17T03:07:35.118 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:07:35.431 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-17T03:07:35.571 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-17T03:07:35.915 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-17T03:07:35.931 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:36.087 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-17T03:07:36.228 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-17T03:07:36.759 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-17T03:07:36.821 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-17T03:07:37.024 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:37.040 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-17T03:07:37.228 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-17T03:07:37.290 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-17T03:07:37.509 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:07:37.868 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:07:38.024 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-17T03:07:38.071 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-17T03:07:38.759 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-17T03:07:38.759 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-17T03:07:39.056 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-17T03:07:39.243 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-17T03:07:39.587 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-17T03:07:40.290 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:07:40.478 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-17T03:07:40.946 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-17T03:07:41.228 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-17T03:07:41.400 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-17T03:07:41.431 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:41.446 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-17T03:07:41.571 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-17T03:07:41.790 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-17T03:07:42.181 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-17T03:07:42.259 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-17T03:07:42.493 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-17T03:07:42.759 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-17T03:07:42.806 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-17T03:07:43.134 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:07:43.337 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-17T03:07:43.540 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-17T03:07:44.306 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:07:44.384 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-17T03:07:44.462 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-17T03:07:44.509 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-17T03:07:45.462 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-17T03:07:45.540 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-17T03:07:45.634 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-17T03:07:45.775 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-17T03:07:45.993 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-17T03:07:46.181 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-17T03:07:46.915 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-17T03:07:46.962 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-17T03:07:46.978 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-17T03:07:47.072 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-17T03:07:47.197 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-17T03:07:47.525 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-17T03:07:47.681 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-17T03:07:47.712 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-17T03:07:47.744 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-17T03:07:47.853 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:47.900 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-17T03:07:47.931 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-17T03:07:48.290 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-17T03:07:48.415 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-17T03:07:48.728 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-17T03:07:48.837 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:49.087 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-17T03:07:49.525 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-17T03:07:49.572 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-17T03:07:49.744 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-17T03:07:50.197 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-17T03:07:50.244 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-17T03:07:50.337 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:07:50.494 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:07:50.712 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-17T03:07:50.775 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-17T03:07:50.962 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:07:51.134 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-17T03:07:51.212 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:07:51.494 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:07:51.556 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-17T03:07:51.603 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-17T03:07:51.806 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-17T03:07:51.837 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-17T03:07:51.853 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-17T03:07:52.322 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-17T03:07:52.400 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:52.431 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-17T03:07:52.525 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:07:52.712 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:07:52.837 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-17T03:07:53.416 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-17T03:07:53.540 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-17T03:07:53.603 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-17T03:07:53.915 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-17T03:07:53.947 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-17T03:07:53.994 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-17T03:07:54.353 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-17T03:07:54.415 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-17T03:07:54.759 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-17T03:07:54.837 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-17T03:07:54.884 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-17T03:07:54.884 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:54.900 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:54.947 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:07:54.947 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-17T03:07:54.978 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:55.619 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-17T03:07:55.947 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-17T03:07:56.244 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:07:56.291 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-17T03:07:56.541 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:56.556 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:07:56.712 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-17T03:07:57.025 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:57.056 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-17T03:07:57.228 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-17T03:07:57.244 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-17T03:07:57.369 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-17T03:07:57.431 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-17T03:07:57.447 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-17T03:07:57.697 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-17T03:07:57.728 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-17T03:07:57.744 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-17T03:07:57.931 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-17T03:07:58.150 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:58.337 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-17T03:07:58.681 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\winsxs\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.20348.3692_none_ea9c313aecda491b\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-17T03:07:58.791 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-17T03:07:58.916 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-17T03:07:59.119 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-17T03:07:59.291 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-17T03:07:59.291 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-17T03:07:59.306 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:07:59.541 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-17T03:07:59.556 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-17T03:07:59.775 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-17T03:07:59.916 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-17T03:07:59.931 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-17T03:08:00.775 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:08:00.791 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-17T03:08:00.916 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-17T03:08:01.025 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:08:01.056 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:08:01.931 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:02.384 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-17T03:08:02.572 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:02.572 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-17T03:08:02.791 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:02.822 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-17T03:08:02.916 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-17T03:08:03.041 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-17T03:08:03.103 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-17T03:08:03.416 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-17T03:08:03.462 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:03.744 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:08:03.759 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:03.806 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-17T03:08:04.400 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-17T03:08:04.962 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-17T03:08:05.009 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:05.056 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-17T03:08:05.166 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:05.353 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:05.416 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-17T03:08:05.697 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-17T03:08:06.228 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:06.244 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-17T03:08:06.478 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:08:06.619 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-17T03:08:06.853 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-17T03:08:06.884 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:07.150 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-17T03:08:07.541 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-17T03:08:07.572 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:07.697 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:07.822 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-17T03:08:07.853 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-17T03:08:08.228 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-17T03:08:08.337 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:08.509 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-17T03:08:08.541 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-17T03:08:08.556 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:08.588 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:08.744 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-17T03:08:08.806 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:09.134 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-17T03:08:09.228 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-17T03:08:09.697 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-17T03:08:09.759 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-17T03:08:09.822 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-17T03:08:09.931 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-17T03:08:09.978 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:10.009 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-17T03:08:10.056 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-17T03:08:10.509 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-17T03:08:10.681 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-17T03:08:10.947 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-17T03:08:10.947 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-17T03:08:11.275 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-17T03:08:11.275 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:11.572 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-17T03:08:11.900 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-17T03:08:12.150 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-17T03:08:12.213 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-17T03:08:12.291 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-17T03:08:12.337 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:12.478 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-17T03:08:12.525 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-17T03:08:12.556 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-17T03:08:12.650 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-17T03:08:13.056 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-17T03:08:13.103 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:08:13.150 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:08:13.619 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-17T03:08:13.697 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:08:13.900 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-17T03:08:14.119 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-17T03:08:14.400 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-17T03:08:14.400 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:14.791 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-17T03:08:14.791 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-17T03:08:14.853 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-17T03:08:15.088 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-17T03:08:15.338 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-17T03:08:15.353 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-17T03:08:15.681 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-17T03:08:15.759 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-17T03:08:15.869 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-17T03:08:15.963 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:15.994 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-17T03:08:16.150 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-17T03:08:16.369 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-17T03:08:16.541 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-17T03:08:16.634 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-17T03:08:16.822 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-17T03:08:18.259 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-17T03:08:18.697 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-17T03:08:18.853 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-17T03:08:19.119 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:19.416 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-17T03:08:19.588 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-17T03:08:19.869 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-17T03:08:20.150 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-17T03:08:20.244 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-17T03:08:20.275 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-17T03:08:20.291 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-17T03:08:20.447 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-17T03:08:20.759 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-17T03:08:20.775 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:20.791 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-17T03:08:20.853 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-17T03:08:20.884 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-17T03:08:20.994 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-17T03:08:21.400 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-17T03:08:21.509 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-17T03:08:21.728 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-17T03:08:21.744 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:21.853 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-17T03:08:21.853 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-17T03:08:22.072 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-17T03:08:22.135 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:08:22.416 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-17T03:08:22.759 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-17T03:08:23.244 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:23.791 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-17T03:08:23.884 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-17T03:08:24.369 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-17T03:08:24.759 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:08:24.869 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:25.166 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-17T03:08:25.431 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-17T03:08:25.509 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-17T03:08:25.666 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-17T03:08:25.838 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-17T03:08:26.291 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-17T03:08:27.056 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-17T03:08:27.166 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-17T03:08:27.259 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-17T03:08:27.900 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-17T03:08:28.025 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-17T03:08:28.291 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-17T03:08:28.384 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-17T03:08:28.494 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-17T03:08:28.494 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-17T03:08:28.978 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-17T03:08:29.088 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-17T03:08:29.103 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:29.134 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-17T03:08:29.416 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-17T03:08:29.447 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:08:29.634 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-17T03:08:29.775 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-17T03:08:30.103 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-17T03:08:30.603 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-17T03:08:30.713 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:08:30.916 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:31.103 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-17T03:08:31.431 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:31.509 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-17T03:08:31.728 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-17T03:08:31.900 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-17T03:08:32.041 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:32.166 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-17T03:08:32.431 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-17T03:08:32.791 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-17T03:08:32.838 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-17T03:08:32.869 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-17T03:08:33.041 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:33.072 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-17T03:08:33.431 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-17T03:08:33.588 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-17T03:08:33.697 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:34.634 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-17T03:08:35.213 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-17T03:08:35.275 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-17T03:08:35.322 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-17T03:08:35.353 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-17T03:08:35.697 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:35.759 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-17T03:08:35.978 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-17T03:08:36.072 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-17T03:08:36.150 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-17T03:08:36.228 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:36.306 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-17T03:08:36.494 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-17T03:08:36.556 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-17T03:08:36.947 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-17T03:08:37.009 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-17T03:08:37.088 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:37.088 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-17T03:08:37.103 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-17T03:08:37.119 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-17T03:08:37.228 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-17T03:08:37.244 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:08:37.259 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-17T03:08:37.322 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-17T03:08:37.728 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-17T03:08:37.744 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-17T03:08:38.119 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:08:38.181 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-17T03:08:38.197 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-17T03:08:38.228 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-17T03:08:39.119 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-17T03:08:39.244 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:08:39.447 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:08:39.447 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-17T03:08:39.619 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-17T03:08:39.822 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-17T03:08:39.947 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-17T03:08:40.025 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:40.759 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-17T03:08:40.791 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-17T03:08:40.931 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-17T03:08:40.947 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-17T03:08:40.947 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:08:41.431 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:08:41.447 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-17T03:08:41.588 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-17T03:08:41.603 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-17T03:08:41.791 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-17T03:08:42.259 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-17T03:08:42.666 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-17T03:08:42.916 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:43.306 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-17T03:08:43.556 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-17T03:08:43.619 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-17T03:08:43.791 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-17T03:08:43.806 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-17T03:08:43.900 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-17T03:08:43.978 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-17T03:08:44.072 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-17T03:08:44.072 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:08:44.572 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-17T03:08:44.634 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-17T03:08:44.931 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-17T03:08:45.041 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:08:45.213 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-17T03:08:45.228 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:08:45.384 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\de-de\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:45.556 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-console-l1-1-0.dll", hr=0x0 2026-09-17T03:08:45.744 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0 2026-09-17T03:08:45.744 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-registry-l2-1-0.dll", hr=0x0 2026-09-17T03:08:46.103 Engine:Setting original file name "MrmCore.dll" for "c:\windows\winsxs\wow64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.20348.5020_none_9e6a80bbc86408d7\mrmcorer.dll", hr=0x0 2026-09-17T03:08:46.103 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:46.244 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_en-gb_56416fd74780e848\vsswmi.dll.mui", hr=0x0 2026-09-17T03:08:46.244 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\es-es\aerolite.msstyles.mui", hr=0x0 2026-09-17T03:08:46.416 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_7573f1c6d4639f87\penimc.dll", hr=0x0 2026-09-17T03:08:46.431 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.data.winmd", hr=0x0 2026-09-17T03:08:46.619 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\de-de\ndisimplatcim.dll.mui", hr=0x0 2026-09-17T03:08:46.697 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_4e347e352039867c\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:46.838 Engine:Setting original file name "winsqlite3" for "c:\windows\winsxs\wow64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.20348.4647_none_c9096b99901f19cd\winsqlite3.dll", hr=0x0 2026-09-17T03:08:46.869 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0 2026-09-17T03:08:46.869 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000c.dll", hr=0x0 2026-09-17T03:08:47.213 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-1-0.dll", hr=0x0 2026-09-17T03:08:47.213 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata000a.dll", hr=0x0 2026-09-17T03:08:47.525 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-2-0.dll", hr=0x0 2026-09-17T03:08:47.603 Engine:Setting original file name "wmic.exe" for "c:\windows\winsxs\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.20348.2849_none_54405a5933961199\wmic.exe", hr=0x0 2026-09-17T03:08:47.775 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.storage.winmd", hr=0x0 2026-09-17T03:08:48.119 Engine:Setting original file name "CRYPT32.DLL" for "c:\windows\systemresources\crypt32.dll.mun", hr=0x0 2026-09-17T03:08:48.369 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_7d8ffbc5cb37c8e0\bootmgr.exe.mui", hr=0x0 2026-09-17T03:08:48.431 Engine:Setting original file name "mstsc.exe" for "c:\windows\systemresources\mstsc.exe.mun", hr=0x0 2026-09-17T03:08:48.634 Engine:Setting original file name "SYSTEMCPL.DLL" for "c:\windows\systemresources\systemcpl.dll.mun", hr=0x0 2026-09-17T03:08:48.666 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0 2026-09-17T03:08:48.791 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1e6e07718388e886\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:48.853 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0 2026-09-17T03:08:49.494 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0 2026-09-17T03:08:49.509 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mpg4decd_31bf3856ad364e35_10.0.20348.2849_none_08e768f194682e23\mpg4decd.dll", hr=0x0 2026-09-17T03:08:49.509 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0 2026-09-17T03:08:49.541 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0 2026-09-17T03:08:49.759 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-1.dll", hr=0x0 2026-09-17T03:08:49.759 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\naturallanguage6.dll", hr=0x0 2026-09-17T03:08:50.244 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0 2026-09-17T03:08:50.478 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0 2026-09-17T03:08:50.744 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ja-jp_5634cc97d85965d9\bootmgr_ex.efi.mui", hr=0x0 2026-09-17T03:08:50.759 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0 2026-09-17T03:08:50.978 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_d7c56d20c9fb1c22\diagpackage.dll.mui", hr=0x0 2026-09-17T03:08:51.259 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:51.369 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mpg4decd.dll", hr=0x0 2026-09-17T03:08:51.572 Engine:Setting original file name "SYSMON.OCX" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\sysmon.ocx.mun", hr=0x0 2026-09-17T03:08:51.619 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgfw_ex.efi.mui", hr=0x0 2026-09-17T03:08:51.634 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\uk-ua\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:08:51.853 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgfw.efi.mui", hr=0x0 2026-09-17T03:08:51.900 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-profile-l1-1-0.dll", hr=0x0 2026-09-17T03:08:51.963 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-convert-l1-1-0.dll", hr=0x0 2026-09-17T03:08:52.088 OriginalFileName Maintenance::28313 files in Moac, 0 skipped (cached), 545 filename set 2026-09-17T03:08:52.088 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-17T03:09:18.916 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T03:10:59.431 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:10:59.431 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:10:59.431 [Cloud] Queued cloud request. 2026-09-17T03:10:59.431 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:10:59.431 [Cloud] Dequeued cloud request. 2026-09-17T03:10:59.447 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:10:59.619 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0DD6D667-EE3A-8A84-B854-8E47869C5281} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 03:10:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T03:11:00.119 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:20:00.108 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:20:00.108 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:20:00.108 [Cloud] Queued cloud request. 2026-09-17T03:20:00.108 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:20:00.108 [Cloud] Dequeued cloud request. 2026-09-17T03:20:00.311 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:20:00.451 [Cloud] End of cloud request. 2026-09-17T03:20:00.967 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:22:22.531 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:22:22.531 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:22:22.531 [Cloud] Queued cloud request. 2026-09-17T03:22:22.531 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:22:22.531 [Cloud] Dequeued cloud request. 2026-09-17T03:22:22.531 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:22:22.687 [Cloud] End of cloud request. 2026-09-17T03:22:23.203 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:24:23.922 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T03:26:38.329 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:26:38.329 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:26:38.329 [Cloud] Queued cloud request. 2026-09-17T03:26:38.329 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:26:38.329 [Cloud] Dequeued cloud request. 2026-09-17T03:26:38.329 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:26:38.469 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1628A4AA-347D-4284-6E42-7CFEBFF530B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 03:26:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T03:26:38.985 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:28:50.534 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 10980, Count: 723, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-17T03:28:50.534 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 5192, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T03:28:50.534 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 4392, Count: 328, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-17T03:28:50.534 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-17T03:28:50.534 ProcessImageName: AgentShellService.exe, Pid: 2592, TotalTime: 731, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 51% 2026-09-17T03:28:50.534 ProcessImageName: WmiPrvSE.exe, Pid: 160, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-17T03:28:50.534 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 347, Count: 29, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-17T03:28:50.534 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-17T03:28:50.534 ProcessImageName: DeviceCensus.exe, Pid: 6268, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 9% 2026-09-17T03:28:50.534 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T03:28:50.534 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-17T03:28:50.534 ProcessImageName: powershell.exe, Pid: 1824, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpAF7.tmp, EstimatedImpact: 0% 2026-09-17T03:28:50.534 ProcessImageName: cmd.exe, Pid: 1048, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-17T03:28:50.534 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 30, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2.MAD, EstimatedImpact: 14% 2026-09-17T03:28:50.534 ProcessImageName: powershell.exe, Pid: 4116, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_np205jrl.r2i.ps1, EstimatedImpact: 0% 2026-09-17T03:28:50.534 ProcessImageName: mysqldump.exe, Pid: 1868, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-17T03:28:50.534 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-17T03:28:50.534 ProcessImageName: taskhostw.exe, Pid: 1228, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-17T03:28:50.534 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-17T03:37:53.085 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:37:53.085 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:37:53.085 [Cloud] Queued cloud request. 2026-09-17T03:37:53.085 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:37:53.085 [Cloud] Dequeued cloud request. 2026-09-17T03:37:53.085 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:37:53.225 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{77514CC8-FE3F-1719-5AFD-A3231E63E325} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 03:37:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T03:37:53.741 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:39:28.929 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T03:39:57.273 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:39:57.273 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:39:57.273 [Cloud] Queued cloud request. 2026-09-17T03:39:57.273 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:39:57.273 [Cloud] Dequeued cloud request. 2026-09-17T03:39:57.273 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:39:57.429 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{52934FD9-1BBA-0828-E0E0-F24857010FD4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 03:39:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T03:39:57.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:44:23.820 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:44:23.820 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:44:23.820 [Cloud] Queued cloud request. 2026-09-17T03:44:23.820 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:44:23.820 [Cloud] Dequeued cloud request. 2026-09-17T03:44:23.820 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:44:23.961 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{23E78639-CE55-6B49-3079-8702D7E17201} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 03:44:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T03:44:24.461 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:47:31.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:47:31.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:47:31.604 [Cloud] Queued cloud request. 2026-09-17T03:47:31.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:47:31.604 [Cloud] Dequeued cloud request. 2026-09-17T03:47:31.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:47:31.745 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A72741E0-DEDD-533E-C60C-27B0BD74A038} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 03:47:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T03:47:32.245 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:48:00.792 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:48:00.792 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:48:00.792 [Cloud] Queued cloud request. 2026-09-17T03:48:00.792 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:48:00.792 [Cloud] Dequeued cloud request. 2026-09-17T03:48:00.792 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:48:00.870 [Cloud] End of cloud request. 2026-09-17T03:48:01.370 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:50:40.371 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:50:40.371 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:50:40.371 [Cloud] Queued cloud request. 2026-09-17T03:50:40.371 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:50:40.371 [Cloud] Dequeued cloud request. 2026-09-17T03:50:40.371 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:50:40.559 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{74B01F7C-E35E-C65F-B19F-3C8C3F0CC8DC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 03:50:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T03:50:41.059 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:54:33.934 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T03:57:22.935 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:57:22.935 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:57:22.935 [Cloud] Queued cloud request. 2026-09-17T03:57:22.935 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:57:22.935 [Cloud] Dequeued cloud request. 2026-09-17T03:57:23.107 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:57:23.295 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F67198F0-9E24-EFA1-547A-A8C069D0FAA8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 03:57:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T03:57:23.810 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T03:58:36.344 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T03:58:36.344 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T03:58:36.344 [Cloud] Queued cloud request. 2026-09-17T03:58:36.344 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T03:58:36.344 [Cloud] Dequeued cloud request. 2026-09-17T03:58:36.500 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T03:58:36.672 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8041E1AA-365B-7801-9363-95AA3E93BD35} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 03:58:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T03:58:37.172 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:00:46.938 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:00:46.938 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:00:46.938 [Cloud] Queued cloud request. 2026-09-17T04:00:46.938 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:00:46.938 [Cloud] Dequeued cloud request. 2026-09-17T04:00:46.938 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:00:47.188 [Cloud] End of cloud request. 2026-09-17T04:00:47.688 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:04:54.094 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:04:54.094 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:04:54.094 [Cloud] Queued cloud request. 2026-09-17T04:04:54.094 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:04:54.094 [Cloud] Dequeued cloud request. 2026-09-17T04:04:54.282 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:04:54.548 [Cloud] End of cloud request. 2026-09-17T04:04:55.063 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:08:27.832 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:08:27.832 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:08:27.832 [Cloud] Queued cloud request. 2026-09-17T04:08:27.832 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:08:27.832 [Cloud] Dequeued cloud request. 2026-09-17T04:08:28.066 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:08:28.301 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{197E9FDD-9392-D61F-82FA-09DF8D75AE59} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 04:08:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T04:08:28.816 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:09:38.941 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T04:10:23.380 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:10:23.380 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:10:23.380 [Cloud] Queued cloud request. 2026-09-17T04:10:23.380 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:10:23.380 [Cloud] Dequeued cloud request. 2026-09-17T04:10:23.380 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:10:23.677 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C75D46AA-35D1-F0F7-9AB1-3983D18B3029} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 04:10:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T04:10:24.177 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:17:30.664 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:17:30.664 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:17:30.664 [Cloud] Queued cloud request. 2026-09-17T04:17:30.664 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:17:30.664 [Cloud] Dequeued cloud request. 2026-09-17T04:17:30.664 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:17:30.820 [Cloud] End of cloud request. 2026-09-17T04:17:31.336 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:20:42.790 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:20:42.790 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:20:42.790 [Cloud] Queued cloud request. 2026-09-17T04:20:42.790 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:20:42.790 [Cloud] Dequeued cloud request. 2026-09-17T04:20:42.790 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:20:42.961 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C64F8A39-BECD-7C14-2E40-DB745D768252} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 04:20:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T04:20:43.461 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:21:38.243 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:21:38.243 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:21:38.243 [Cloud] Queued cloud request. 2026-09-17T04:21:38.243 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:21:38.243 [Cloud] Dequeued cloud request. 2026-09-17T04:21:38.243 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:21:38.336 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C4A3F928-3D29-047D-5CC4-4CCA632AD1EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 04:21:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T04:21:38.836 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:22:26.024 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:22:26.024 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:22:26.024 [Cloud] Queued cloud request. 2026-09-17T04:22:26.024 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:22:26.024 [Cloud] Dequeued cloud request. 2026-09-17T04:22:26.024 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:22:26.102 [Cloud] End of cloud request. 2026-09-17T04:22:26.602 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:24:43.948 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T04:24:54.230 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:24:54.230 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:24:54.230 [Cloud] Queued cloud request. 2026-09-17T04:24:54.230 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:24:54.230 [Cloud] Dequeued cloud request. 2026-09-17T04:24:54.230 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:24:54.386 [Cloud] End of cloud request. 2026-09-17T04:24:54.901 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:26:36.886 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:26:36.886 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:26:36.886 [Cloud] Queued cloud request. 2026-09-17T04:26:36.886 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:26:36.886 [Cloud] Dequeued cloud request. 2026-09-17T04:26:36.886 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:26:46.980 [Cloud] End of cloud request. 2026-09-17T04:26:47.480 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:29:11.341 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:29:11.341 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:29:11.341 [Cloud] Queued cloud request. 2026-09-17T04:29:11.341 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:29:11.341 [Cloud] Dequeued cloud request. 2026-09-17T04:29:11.341 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:29:11.529 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B274C513-CECB-72C2-4DF4-DAF2BDCE0C49} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 04:29:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T04:29:12.029 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:29:54.497 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:29:54.497 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:29:54.497 [Cloud] Queued cloud request. 2026-09-17T04:29:54.497 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:29:54.497 [Cloud] Dequeued cloud request. 2026-09-17T04:29:54.497 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:29:54.575 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5D252A02-8B48-ADAE-05ED-7EA9760416EA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 04:29:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T04:29:55.076 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:36:04.562 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:36:04.562 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:36:04.562 [Cloud] Queued cloud request. 2026-09-17T04:36:04.562 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:36:04.562 [Cloud] Dequeued cloud request. 2026-09-17T04:36:04.562 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:36:04.749 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C3C7C029-F672-1837-8BF2-2C11C3BB1CA2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 04:36:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T04:36:05.265 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:36:55.312 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:36:55.312 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:36:55.312 [Cloud] Queued cloud request. 2026-09-17T04:36:55.312 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:36:55.312 [Cloud] Dequeued cloud request. 2026-09-17T04:36:55.312 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:36:55.390 [Cloud] End of cloud request. 2026-09-17T04:36:55.906 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:39:48.955 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T04:41:02.502 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:41:02.502 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:41:02.502 [Cloud] Queued cloud request. 2026-09-17T04:41:02.502 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:41:02.502 [Cloud] Dequeued cloud request. 2026-09-17T04:41:02.502 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:41:02.689 [Cloud] End of cloud request. 2026-09-17T04:41:03.205 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:42:49.502 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:42:49.502 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:42:49.502 [Cloud] Queued cloud request. 2026-09-17T04:42:49.502 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:42:49.502 [Cloud] Dequeued cloud request. 2026-09-17T04:42:49.502 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:42:49.689 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BB676BE9-F9AB-9A11-B46F-42550AB3CFE7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 04:42:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T04:42:50.205 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:42:54.892 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:42:54.892 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:42:54.892 [Cloud] Queued cloud request. 2026-09-17T04:42:54.892 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:42:54.892 [Cloud] Dequeued cloud request. 2026-09-17T04:42:54.892 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:42:54.970 [Cloud] End of cloud request. 2026-09-17T04:42:55.470 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:44:59.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:44:59.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:44:59.049 [Cloud] Queued cloud request. 2026-09-17T04:44:59.049 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:44:59.049 [Cloud] Dequeued cloud request. 2026-09-17T04:44:59.049 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:44:59.236 [Cloud] End of cloud request. 2026-09-17T04:44:59.736 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:50:00.224 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:50:00.224 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:50:00.224 [Cloud] Queued cloud request. 2026-09-17T04:50:00.224 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:50:00.224 [Cloud] Dequeued cloud request. 2026-09-17T04:50:00.240 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:50:00.427 [Cloud] End of cloud request. 2026-09-17T04:50:00.943 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T04:54:53.961 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T04:58:39.432 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T04:58:39.432 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T04:58:39.432 [Cloud] Queued cloud request. 2026-09-17T04:58:39.432 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T04:58:39.432 [Cloud] Dequeued cloud request. 2026-09-17T04:58:39.432 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T04:58:39.682 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{61DA8DD7-4A6F-7425-669F-9E60172A883D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 04:58:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T04:58:40.182 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:00:45.869 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:00:45.869 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:00:45.869 [Cloud] Queued cloud request. 2026-09-17T05:00:45.869 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:00:45.869 [Cloud] Dequeued cloud request. 2026-09-17T05:00:45.869 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:00:46.182 [Cloud] End of cloud request. 2026-09-17T05:00:46.697 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:09:58.967 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T05:10:27.514 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:10:27.514 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:10:27.514 [Cloud] Queued cloud request. 2026-09-17T05:10:27.514 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:10:27.514 [Cloud] Dequeued cloud request. 2026-09-17T05:10:27.701 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:10:27.842 [Cloud] End of cloud request. 2026-09-17T05:10:28.358 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:16:14.063 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:16:14.063 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:16:14.063 [Cloud] Queued cloud request. 2026-09-17T05:16:14.063 [Cloud] Dequeued cloud request. 2026-09-17T05:16:14.063 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:16:14.220 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:16:14.360 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{989AA225-12A5-1C25-EBFD-9D7E7EA015DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 05:16:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T05:16:14.876 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:21:37.238 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:21:37.238 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:21:37.238 [Cloud] Queued cloud request. 2026-09-17T05:21:37.238 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:21:37.238 [Cloud] Dequeued cloud request. 2026-09-17T05:21:37.238 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:21:37.676 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{11F6B72A-949C-A7DC-F408-58D288B95CF5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 05:21:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T05:21:38.192 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:25:03.974 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T05:26:58.943 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:26:58.943 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:26:58.943 [Cloud] Queued cloud request. 2026-09-17T05:26:58.943 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:26:58.943 [Cloud] Dequeued cloud request. 2026-09-17T05:26:58.943 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:26:59.146 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{04E40875-A493-5B29-7A36-F49990EF5442} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 05:26:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T05:26:59.662 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:28:50.601 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 14195, Count: 1031, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-17T05:28:50.601 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 6577, Count: 514, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-17T05:28:50.601 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 5192, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T05:28:50.601 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-17T05:28:50.601 ProcessImageName: php.exe, Pid: 4672, TotalTime: 786, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-17T05:28:50.601 ProcessImageName: AgentShellService.exe, Pid: 2592, TotalTime: 731, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 51% 2026-09-17T05:28:50.601 ProcessImageName: WmiPrvSE.exe, Pid: 160, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-17T05:28:50.601 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 377, Count: 33, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-17T05:28:50.601 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-17T05:28:50.601 ProcessImageName: cmd.exe, Pid: 6036, TotalTime: 155, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 66% 2026-09-17T05:28:50.601 ProcessImageName: DeviceCensus.exe, Pid: 6268, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 9% 2026-09-17T05:28:50.601 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T05:28:50.601 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-17T05:28:50.601 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-17T05:28:50.601 ProcessImageName: powershell.exe, Pid: 1824, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpAF7.tmp, EstimatedImpact: 0% 2026-09-17T05:28:50.601 ProcessImageName: cmd.exe, Pid: 1048, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-17T05:28:50.601 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 30, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2.MAD, EstimatedImpact: 14% 2026-09-17T05:28:50.601 ProcessImageName: powershell.exe, Pid: 4116, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_np205jrl.r2i.ps1, EstimatedImpact: 0% 2026-09-17T05:28:50.601 ProcessImageName: mysqldump.exe, Pid: 1868, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-17T05:28:50.601 ProcessImageName: taskhostw.exe, Pid: 1228, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-17T05:28:50.601 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-17T05:34:11.650 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:34:11.650 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:34:11.650 [Cloud] Queued cloud request. 2026-09-17T05:34:11.650 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:34:11.650 [Cloud] Dequeued cloud request. 2026-09-17T05:34:11.650 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:34:11.853 [Cloud] End of cloud request. 2026-09-17T05:34:12.369 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:36:37.385 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:36:37.385 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:36:37.385 [Cloud] Queued cloud request. 2026-09-17T05:36:37.385 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:36:37.385 [Cloud] Dequeued cloud request. 2026-09-17T05:36:37.385 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:36:46.744 [Cloud] End of cloud request. 2026-09-17T05:36:47.244 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:37:15.182 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:37:15.182 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:37:15.182 [Cloud] Queued cloud request. 2026-09-17T05:37:15.182 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:37:15.182 [Cloud] Dequeued cloud request. 2026-09-17T05:37:15.182 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:37:15.275 [Cloud] End of cloud request. 2026-09-17T05:37:15.775 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:38:52.496 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:38:52.496 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:38:52.496 [Cloud] Queued cloud request. 2026-09-17T05:38:52.496 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:38:52.496 [Cloud] Dequeued cloud request. 2026-09-17T05:38:52.496 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:38:52.699 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{55F148D3-7DF4-B911-D59A-9274C9CB0D11} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 05:38:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T05:38:53.199 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:39:50.714 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:39:50.714 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:39:50.714 [Cloud] Queued cloud request. 2026-09-17T05:39:50.714 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:39:50.714 [Cloud] Dequeued cloud request. 2026-09-17T05:39:50.714 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:39:50.793 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{37BE1B00-0CB3-E2C6-E011-949A3B65A5AE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 05:39:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T05:39:51.293 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:40:08.980 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T05:41:45.183 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:41:45.183 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:41:45.183 [Cloud] Queued cloud request. 2026-09-17T05:41:45.183 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:41:45.183 [Cloud] Dequeued cloud request. 2026-09-17T05:41:45.183 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:41:45.371 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C78E008B-2C39-8F96-198F-AEFC81DD40B4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 05:41:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T05:41:45.871 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:43:19.105 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:43:19.105 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:43:19.105 [Cloud] Queued cloud request. 2026-09-17T05:43:19.105 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:43:19.105 [Cloud] Dequeued cloud request. 2026-09-17T05:43:19.105 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:43:19.308 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6CDE9191-8883-C913-F7E4-E93D47806F6E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 05:43:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T05:43:19.824 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:50:34.922 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:50:34.922 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:50:34.922 [Cloud] Queued cloud request. 2026-09-17T05:50:34.922 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:50:34.922 [Cloud] Dequeued cloud request. 2026-09-17T05:50:34.938 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:50:35.094 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{08FEBAC1-2A3C-92D0-052A-1E016D08F177} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 05:50:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T05:50:35.610 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:52:20.830 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:52:20.830 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:52:20.830 [Cloud] Queued cloud request. 2026-09-17T05:52:20.830 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:52:20.830 [Cloud] Dequeued cloud request. 2026-09-17T05:52:20.830 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:52:20.970 [Cloud] End of cloud request. 2026-09-17T05:52:21.486 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T05:55:13.986 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T05:58:11.489 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T05:58:11.489 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T05:58:11.489 [Cloud] Queued cloud request. 2026-09-17T05:58:11.489 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T05:58:11.489 [Cloud] Dequeued cloud request. 2026-09-17T05:58:11.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T05:58:11.707 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F5A8BD9-F656-78A3-F8E2-4E60C04694A2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 05:58:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T05:58:12.223 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T06:10:18.993 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T06:24:10.935 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T06:24:10.935 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T06:24:10.935 [Cloud] Queued cloud request. 2026-09-17T06:24:10.935 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T06:24:10.935 [Cloud] Dequeued cloud request. 2026-09-17T06:24:10.935 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T06:24:11.373 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0C8B5D3A-64CE-7FB6-717C-DA48A3879ABD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 06:24:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T06:24:11.873 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T06:25:23.999 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T06:29:13.158 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T06:29:13.158 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T06:29:13.158 [Cloud] Queued cloud request. 2026-09-17T06:29:13.158 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T06:29:13.158 [Cloud] Dequeued cloud request. 2026-09-17T06:29:13.158 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T06:29:13.330 [Cloud] End of cloud request. 2026-09-17T06:29:13.830 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T06:32:14.253 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T06:32:14.253 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T06:32:14.253 [Cloud] Queued cloud request. 2026-09-17T06:32:14.253 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T06:32:14.253 [Cloud] Dequeued cloud request. 2026-09-17T06:32:14.253 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T06:32:14.456 [Cloud] End of cloud request. 2026-09-17T06:32:14.956 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T06:33:31.972 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T06:33:31.972 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T06:33:31.972 [Cloud] Queued cloud request. 2026-09-17T06:33:31.972 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T06:33:31.972 [Cloud] Dequeued cloud request. 2026-09-17T06:33:31.972 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T06:33:32.159 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BBEAAA2B-B0A1-8199-8361-895EA3C84626} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 06:33:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T06:33:32.675 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T06:40:29.006 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T06:42:33.756 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T06:42:33.756 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T06:42:33.756 [Cloud] Queued cloud request. 2026-09-17T06:42:33.756 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T06:42:33.756 [Cloud] Dequeued cloud request. 2026-09-17T06:42:33.756 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T06:42:33.944 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F5B5EB7D-ACF8-8345-1688-F91423366464} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 06:42:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T06:42:34.444 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T06:52:27.293 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T06:52:27.293 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T06:52:27.293 [Cloud] Queued cloud request. 2026-09-17T06:52:27.293 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T06:52:27.293 [Cloud] Dequeued cloud request. 2026-09-17T06:52:27.293 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T06:52:27.559 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AAA23AD4-D27D-78E3-0321-BEDB3174D811} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 06:52:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T06:52:28.059 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T06:55:34.012 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T07:10:39.019 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T07:24:31.261 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T07:24:31.261 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T07:24:31.261 [Cloud] Queued cloud request. 2026-09-17T07:24:31.261 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T07:24:31.417 [Cloud] Dequeued cloud request. 2026-09-17T07:24:31.573 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T07:24:39.620 [Cloud] End of cloud request. 2026-09-17T07:24:40.136 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T07:25:44.026 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T07:28:27.434 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T07:28:27.434 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T07:28:27.434 [Cloud] Queued cloud request. 2026-09-17T07:28:27.434 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T07:28:27.434 [Cloud] Dequeued cloud request. 2026-09-17T07:28:27.434 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T07:28:27.669 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D30BD7E0-931D-F91E-4B4A-25F49945F607} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 07:28:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T07:28:28.169 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T07:28:50.653 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 15479, Count: 1100, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-17T07:28:50.653 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 8796, Count: 699, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-17T07:28:50.653 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 5192, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T07:28:50.653 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-17T07:28:50.653 ProcessImageName: php.exe, Pid: 4672, TotalTime: 786, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-17T07:28:50.653 ProcessImageName: AgentShellService.exe, Pid: 2592, TotalTime: 731, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 51% 2026-09-17T07:28:50.653 ProcessImageName: WmiPrvSE.exe, Pid: 160, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-17T07:28:50.653 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 437, Count: 37, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-17T07:28:50.653 ProcessImageName: powershell.exe, Pid: 3428, TotalTime: 232, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 27% 2026-09-17T07:28:50.653 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-17T07:28:50.653 ProcessImageName: cmd.exe, Pid: 6036, TotalTime: 155, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 66% 2026-09-17T07:28:50.653 ProcessImageName: python.exe, Pid: 1960, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-17T07:28:50.653 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T07:28:50.653 ProcessImageName: DeviceCensus.exe, Pid: 6268, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 9% 2026-09-17T07:28:50.653 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-17T07:28:50.653 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-17T07:28:50.653 ProcessImageName: powershell.exe, Pid: 1824, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpAF7.tmp, EstimatedImpact: 0% 2026-09-17T07:28:50.653 ProcessImageName: cmd.exe, Pid: 1048, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-17T07:28:50.653 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 30, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2.MAD, EstimatedImpact: 14% 2026-09-17T07:28:50.653 ProcessImageName: powershell.exe, Pid: 4116, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_np205jrl.r2i.ps1, EstimatedImpact: 0% 2026-09-17T07:28:50.653 ProcessImageName: mysqldump.exe, Pid: 1868, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-17T07:28:50.653 ProcessImageName: taskhostw.exe, Pid: 1228, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-17T07:28:50.653 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-17T07:29:38.731 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T07:29:38.731 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T07:29:38.731 [Cloud] Queued cloud request. 2026-09-17T07:29:38.731 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T07:29:38.731 [Cloud] Dequeued cloud request. 2026-09-17T07:29:38.731 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T07:29:38.934 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8E01C86E-DC6D-76EA-AB1D-5470D8BDD3F1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 07:29:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T07:29:39.434 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T07:40:49.032 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T07:42:30.579 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T07:42:30.579 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T07:42:30.579 [Cloud] Queued cloud request. 2026-09-17T07:42:30.579 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T07:42:30.579 [Cloud] Dequeued cloud request. 2026-09-17T07:42:30.579 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T07:42:30.845 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D6750BA6-43AD-42D1-DC2F-4B0A8BB55E9F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 07:42:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T07:42:31.360 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T07:46:26.066 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T07:46:26.066 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T07:46:26.066 [Cloud] Queued cloud request. 2026-09-17T07:46:26.066 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T07:46:26.066 [Cloud] Dequeued cloud request. 2026-09-17T07:46:26.066 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T07:46:26.379 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{49FF65CE-6841-176E-E223-7F384E119EF4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 07:46:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T07:46:26.894 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T07:55:54.039 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T07:59:55.917 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T07:59:55.917 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T07:59:55.917 [Cloud] Queued cloud request. 2026-09-17T07:59:55.917 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T07:59:55.917 [Cloud] Dequeued cloud request. 2026-09-17T07:59:55.917 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T07:59:56.245 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F9EAD361-CEF3-8EE8-AB7C-8F89D15AE66E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 07:59:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T07:59:56.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T08:10:59.046 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T08:13:23.094 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T08:13:23.094 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T08:13:23.094 [Cloud] Queued cloud request. 2026-09-17T08:13:23.094 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T08:13:23.251 [Cloud] Dequeued cloud request. 2026-09-17T08:13:23.251 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T08:13:23.438 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3327FA96-0DC7-5B3F-7007-62D28E5DA5BF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 08:13:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T08:13:23.954 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T08:13:34.923 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T08:13:34.923 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T08:13:34.923 [Cloud] Queued cloud request. 2026-09-17T08:13:34.923 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T08:13:34.923 [Cloud] Dequeued cloud request. 2026-09-17T08:13:34.923 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T08:13:35.016 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3F019E97-864F-A2E7-CAF7-49ECAA0EDD33} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 08:13:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T08:13:35.516 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T08:16:51.517 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T08:16:51.517 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T08:16:51.517 [Cloud] Queued cloud request. 2026-09-17T08:16:51.517 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T08:16:51.517 [Cloud] Dequeued cloud request. 2026-09-17T08:16:51.517 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T08:16:51.689 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9E2364D2-FC60-D1C5-FDEC-C2DF97CD415C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 08:16:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T08:16:52.189 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T08:22:48.270 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T08:22:48.270 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T08:22:48.270 [Cloud] Queued cloud request. 2026-09-17T08:22:48.270 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T08:22:48.270 [Cloud] Dequeued cloud request. 2026-09-17T08:22:48.270 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T08:22:48.551 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{888E2EC5-0472-92FF-BC28-1A06B593B00A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 08:22:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T08:22:49.067 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T08:26:04.051 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T08:34:41.774 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T08:34:41.774 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T08:34:41.774 [Cloud] Queued cloud request. 2026-09-17T08:34:41.774 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T08:34:41.774 [Cloud] Dequeued cloud request. 2026-09-17T08:34:41.774 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T08:34:41.993 [Cloud] End of cloud request. 2026-09-17T08:34:42.508 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T08:41:09.059 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T08:47:39.001 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T08:47:39.001 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T08:47:39.001 [Cloud] Queued cloud request. 2026-09-17T08:47:39.001 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T08:47:39.001 [Cloud] Dequeued cloud request. 2026-09-17T08:47:39.001 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T08:47:39.188 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{90667A34-558F-5ED3-B98A-2FA5CFADB613} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 08:47:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T08:47:39.688 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T08:56:14.066 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T09:02:50.850 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T09:02:50.850 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T09:02:50.850 [Cloud] Queued cloud request. 2026-09-17T09:02:50.850 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T09:02:50.850 [Cloud] Dequeued cloud request. 2026-09-17T09:02:50.850 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T09:02:51.053 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AB5ADC82-1DEB-D221-4A44-53F02F2492AD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 09:02:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T09:02:51.569 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T09:11:19.074 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T09:12:01.277 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T09:12:01.277 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T09:12:01.277 [Cloud] Queued cloud request. 2026-09-17T09:12:01.277 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T09:12:01.433 [Cloud] Dequeued cloud request. 2026-09-17T09:12:01.433 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T09:12:01.777 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D8ADCE9B-A36D-745F-489D-A1DFB4A4E25B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 09:12:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T09:12:02.293 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T09:13:31.137 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T09:13:31.137 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T09:13:31.137 [Cloud] Queued cloud request. 2026-09-17T09:13:31.137 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T09:13:31.137 [Cloud] Dequeued cloud request. 2026-09-17T09:13:31.137 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T09:13:31.887 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9F13D690-2883-7C80-3EB8-2BC49C3B1E86} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 09:13:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T09:13:32.387 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T09:26:24.080 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T09:26:38.877 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T09:26:38.877 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T09:26:38.877 [Cloud] Queued cloud request. 2026-09-17T09:26:38.877 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T09:26:38.877 [Cloud] Dequeued cloud request. 2026-09-17T09:26:38.877 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T09:26:40.205 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2BE20735-D8B8-1848-5988-6EE53595DE76} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 09:26:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T09:26:40.721 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T09:28:50.723 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 17191, Count: 1200, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-17T09:28:50.723 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 11043, Count: 877, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-17T09:28:50.723 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 5192, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T09:28:50.723 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-17T09:28:50.723 ProcessImageName: php.exe, Pid: 4672, TotalTime: 786, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-17T09:28:50.723 ProcessImageName: AgentShellService.exe, Pid: 2592, TotalTime: 731, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 51% 2026-09-17T09:28:50.723 ProcessImageName: WmiPrvSE.exe, Pid: 160, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-17T09:28:50.723 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 437, Count: 37, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-17T09:28:50.723 ProcessImageName: powershell.exe, Pid: 3428, TotalTime: 232, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 27% 2026-09-17T09:28:50.723 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-17T09:28:50.723 ProcessImageName: cmd.exe, Pid: 6036, TotalTime: 155, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 66% 2026-09-17T09:28:50.723 ProcessImageName: python.exe, Pid: 1960, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-17T09:28:50.723 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T09:28:50.723 ProcessImageName: DeviceCensus.exe, Pid: 6268, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 9% 2026-09-17T09:28:50.723 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-17T09:28:50.723 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-17T09:28:50.723 ProcessImageName: powershell.exe, Pid: 1824, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpAF7.tmp, EstimatedImpact: 0% 2026-09-17T09:28:50.723 ProcessImageName: cmd.exe, Pid: 1048, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-17T09:28:50.723 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-17T09:28:50.723 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 30, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2.MAD, EstimatedImpact: 14% 2026-09-17T09:28:50.723 ProcessImageName: powershell.exe, Pid: 4116, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_np205jrl.r2i.ps1, EstimatedImpact: 0% 2026-09-17T09:28:50.723 ProcessImageName: mysqldump.exe, Pid: 1868, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-17T09:28:50.723 ProcessImageName: taskhostw.exe, Pid: 1228, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-17T09:28:50.723 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-17T09:41:29.087 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T09:44:23.728 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T09:44:23.728 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T09:44:23.728 [Cloud] Queued cloud request. 2026-09-17T09:44:23.728 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T09:44:23.728 [Cloud] Dequeued cloud request. 2026-09-17T09:44:23.728 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T09:44:23.931 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4FB352B5-FAF0-DB7E-A203-B73E1E6C44B6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 09:44:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T09:44:24.431 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T09:47:58.872 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T09:47:58.872 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T09:47:58.872 [Cloud] Queued cloud request. 2026-09-17T09:47:58.872 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T09:47:58.872 [Cloud] Dequeued cloud request. 2026-09-17T09:47:58.872 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T09:47:59.076 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9CC8CE5C-72AC-B2DE-C8FE-7FE314BB325C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 09:47:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T09:47:59.591 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T09:53:10.546 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T09:53:10.546 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T09:53:10.546 [Cloud] Queued cloud request. 2026-09-17T09:53:10.546 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T09:53:10.546 [Cloud] Dequeued cloud request. 2026-09-17T09:53:10.546 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T09:53:10.718 [Cloud] End of cloud request. 2026-09-17T09:53:11.218 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T09:56:11.594 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T09:56:11.594 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T09:56:11.594 [Cloud] Queued cloud request. 2026-09-17T09:56:11.594 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T09:56:11.594 [Cloud] Dequeued cloud request. 2026-09-17T09:56:11.751 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T09:56:11.938 [Cloud] End of cloud request. 2026-09-17T09:56:12.438 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T09:56:34.094 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T10:03:36.847 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T10:03:36.847 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T10:03:36.847 [Cloud] Queued cloud request. 2026-09-17T10:03:36.847 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T10:03:36.847 [Cloud] Dequeued cloud request. 2026-09-17T10:03:36.847 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T10:03:37.050 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DF353492-D772-6D72-BE03-FCB9CBAA0ACD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 10:03:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T10:03:37.550 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T10:11:11.960 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T10:11:11.960 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T10:11:11.960 [Cloud] Queued cloud request. 2026-09-17T10:11:11.960 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T10:11:11.960 [Cloud] Dequeued cloud request. 2026-09-17T10:11:11.960 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T10:11:12.179 [Cloud] End of cloud request. 2026-09-17T10:11:12.695 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T10:11:39.101 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T10:14:46.619 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-179e6-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7111761, FileId: 0x1900000003d2e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T10:14:46.619 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-179e6-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7111760, FileId: 0x1700000003e72c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T10:14:52.619 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-179ec-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7111806, FileId: 0x1a00000003d2e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T10:14:52.619 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-179ec-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7111805, FileId: 0x1800000003e72c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T10:23:23.607 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T10:23:23.607 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T10:23:23.607 [Cloud] Queued cloud request. 2026-09-17T10:23:23.607 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T10:23:23.607 [Cloud] Dequeued cloud request. 2026-09-17T10:23:23.607 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T10:23:23.795 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DB61F307-E35E-B80A-D078-A0027B7730BE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 10:23:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T10:23:24.295 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T10:23:48.389 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T10:23:48.389 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T10:23:48.389 [Cloud] Queued cloud request. 2026-09-17T10:23:48.389 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T10:23:48.389 [Cloud] Dequeued cloud request. 2026-09-17T10:23:48.389 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T10:23:48.498 [Cloud] End of cloud request. 2026-09-17T10:23:48.998 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T10:26:44.109 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T10:31:03.298 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T10:31:03.298 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T10:31:03.298 [Cloud] Queued cloud request. 2026-09-17T10:31:03.298 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T10:31:03.298 [Cloud] Dequeued cloud request. 2026-09-17T10:31:03.314 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T10:31:03.517 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F57A43BC-0FC1-6D3C-8A7A-398A8E77D486} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 10:31:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T10:31:04.017 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T10:35:08.441 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T10:35:08.441 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T10:35:08.441 [Cloud] Queued cloud request. 2026-09-17T10:35:08.441 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T10:35:08.441 [Cloud] Dequeued cloud request. 2026-09-17T10:35:08.441 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T10:35:08.613 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{51A83553-1C5D-3E2D-ABB5-B402538963F6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 10:35:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T10:35:09.113 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T10:41:49.115 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T10:46:31.525 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T10:46:31.525 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T10:46:31.525 [Cloud] Queued cloud request. 2026-09-17T10:46:31.525 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T10:46:31.525 [Cloud] Dequeued cloud request. 2026-09-17T10:46:31.525 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T10:46:31.712 [Cloud] End of cloud request. 2026-09-17T10:46:32.228 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T10:47:35.510 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T10:47:35.510 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T10:47:35.510 [Cloud] Queued cloud request. 2026-09-17T10:47:35.510 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T10:47:35.510 [Cloud] Dequeued cloud request. 2026-09-17T10:47:35.510 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T10:47:36.276 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0563CFC3-BEC1-033D-B419-A0451FBFE1E2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 10:47:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T10:47:36.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T10:56:54.122 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T11:01:52.469 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:01:52.469 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:01:52.469 [Cloud] Queued cloud request. 2026-09-17T11:01:52.469 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:01:52.469 [Cloud] Dequeued cloud request. 2026-09-17T11:01:52.469 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:01:52.641 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DF3BD330-F72F-06C1-C03B-9EB5F221C3AA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 11:01:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T11:01:53.141 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:08:48.504 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:08:48.504 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:08:48.504 [Cloud] Queued cloud request. 2026-09-17T11:08:48.504 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:08:48.504 [Cloud] Dequeued cloud request. 2026-09-17T11:08:48.504 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:08:48.817 [Cloud] End of cloud request. 2026-09-17T11:08:49.333 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:11:59.131 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T11:19:49.056 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:19:49.056 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:19:49.056 [Cloud] Queued cloud request. 2026-09-17T11:19:49.056 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:19:49.056 [Cloud] Dequeued cloud request. 2026-09-17T11:19:49.056 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:19:51.181 [Cloud] End of cloud request. 2026-09-17T11:19:51.181 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:19:51.181 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:19:51.181 [Cloud] Queued cloud request. 2026-09-17T11:19:51.181 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:19:51.181 [Cloud] Dequeued cloud request. 2026-09-17T11:19:51.181 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:19:51.291 [Cloud] End of cloud request. 2026-09-17T11:19:51.681 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:19:52.025 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:19:52.025 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:19:52.025 [Cloud] Queued cloud request. 2026-09-17T11:19:52.025 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:19:52.025 [Cloud] Dequeued cloud request. 2026-09-17T11:19:52.025 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:19:52.103 [Cloud] End of cloud request. 2026-09-17T11:19:52.603 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:19:57.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:19:57.088 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:19:57.088 [Cloud] Queued cloud request. 2026-09-17T11:19:57.088 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:19:57.088 [Cloud] Dequeued cloud request. 2026-09-17T11:19:57.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:19:57.181 [Cloud] End of cloud request. 2026-09-17T11:19:57.697 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:19:58.603 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:19:58.603 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:19:58.603 [Cloud] Queued cloud request. 2026-09-17T11:19:58.603 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:19:58.603 [Cloud] Dequeued cloud request. 2026-09-17T11:19:58.603 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:19:58.681 [Cloud] End of cloud request. 2026-09-17T11:19:58.681 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:19:58.681 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:19:58.681 [Cloud] Queued cloud request. 2026-09-17T11:19:58.681 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:19:58.681 [Cloud] Dequeued cloud request. 2026-09-17T11:19:58.681 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:19:58.775 [Cloud] End of cloud request. 2026-09-17T11:19:59.181 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:01.431 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:01.431 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:01.431 [Cloud] Queued cloud request. 2026-09-17T11:20:01.431 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:01.431 [Cloud] Dequeued cloud request. 2026-09-17T11:20:01.431 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:01.541 [Cloud] End of cloud request. 2026-09-17T11:20:02.056 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:12.728 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:12.728 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:12.728 [Cloud] Queued cloud request. 2026-09-17T11:20:12.728 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:12.728 [Cloud] Dequeued cloud request. 2026-09-17T11:20:12.728 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:13.884 [Cloud] End of cloud request. 2026-09-17T11:20:13.900 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:13.900 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:13.900 [Cloud] Queued cloud request. 2026-09-17T11:20:13.900 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:13.900 [Cloud] Dequeued cloud request. 2026-09-17T11:20:13.900 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:14.400 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:15.041 [Cloud] End of cloud request. 2026-09-17T11:20:15.056 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:15.056 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:15.056 [Cloud] Queued cloud request. 2026-09-17T11:20:15.056 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:15.056 [Cloud] Dequeued cloud request. 2026-09-17T11:20:15.056 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:15.541 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:19.056 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:19.056 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:19.056 [Cloud] Queued cloud request. 2026-09-17T11:20:19.056 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:19.056 [Cloud] Dequeued cloud request. 2026-09-17T11:20:19.056 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:19.197 [Cloud] End of cloud request. 2026-09-17T11:20:19.697 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:21.759 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:21.759 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:21.759 [Cloud] Queued cloud request. 2026-09-17T11:20:21.759 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:21.759 [Cloud] Dequeued cloud request. 2026-09-17T11:20:21.759 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:21.853 [Cloud] End of cloud request. 2026-09-17T11:20:22.353 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:25.056 [Cloud] End of cloud request. 2026-09-17T11:20:25.572 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:27.931 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:27.931 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:27.931 [Cloud] Queued cloud request. 2026-09-17T11:20:27.931 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:27.931 [Cloud] Dequeued cloud request. 2026-09-17T11:20:27.931 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:28.025 [Cloud] End of cloud request. 2026-09-17T11:20:28.541 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:31.119 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:31.119 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:31.119 [Cloud] Queued cloud request. 2026-09-17T11:20:31.119 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:31.119 [Cloud] Dequeued cloud request. 2026-09-17T11:20:31.119 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:31.197 [Cloud] End of cloud request. 2026-09-17T11:20:31.697 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:38.119 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:38.119 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:38.119 [Cloud] Queued cloud request. 2026-09-17T11:20:38.119 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:38.119 [Cloud] Dequeued cloud request. 2026-09-17T11:20:38.119 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:38.197 [Cloud] End of cloud request. 2026-09-17T11:20:38.713 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:43.931 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:43.931 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:43.931 [Cloud] Queued cloud request. 2026-09-17T11:20:43.931 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:43.931 [Cloud] Dequeued cloud request. 2026-09-17T11:20:43.931 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:44.025 [Cloud] End of cloud request. 2026-09-17T11:20:44.525 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:47.572 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:47.572 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:47.572 [Cloud] Queued cloud request. 2026-09-17T11:20:47.572 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:47.572 [Cloud] Dequeued cloud request. 2026-09-17T11:20:47.572 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:47.666 [Cloud] End of cloud request. 2026-09-17T11:20:48.181 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:49.244 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:49.244 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:49.244 [Cloud] Queued cloud request. 2026-09-17T11:20:49.244 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:49.244 [Cloud] Dequeued cloud request. 2026-09-17T11:20:49.244 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:49.322 [Cloud] End of cloud request. 2026-09-17T11:20:49.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:49.337 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:49.337 [Cloud] Queued cloud request. 2026-09-17T11:20:49.337 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:49.337 [Cloud] Dequeued cloud request. 2026-09-17T11:20:49.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:49.838 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:53.338 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:20:53.338 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:20:53.338 [Cloud] Queued cloud request. 2026-09-17T11:20:53.338 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:20:53.338 [Cloud] Dequeued cloud request. 2026-09-17T11:20:53.338 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:20:53.416 [Cloud] End of cloud request. 2026-09-17T11:20:53.931 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:20:59.353 [Cloud] End of cloud request. 2026-09-17T11:20:59.869 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:21:19.869 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:21:19.869 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:21:19.869 [Cloud] Queued cloud request. 2026-09-17T11:21:19.869 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:21:19.869 [Cloud] Dequeued cloud request. 2026-09-17T11:21:19.869 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:21:23.869 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:21:23.869 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:21:23.869 [Cloud] Queued cloud request. 2026-09-17T11:21:23.869 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:21:23.869 [Cloud] Dequeued cloud request. 2026-09-17T11:21:23.869 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:21:23.947 [Cloud] End of cloud request. 2026-09-17T11:21:24.463 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:21:26.275 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:21:26.275 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:21:26.275 [Cloud] Queued cloud request. 2026-09-17T11:21:26.275 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:21:26.275 [Cloud] Dequeued cloud request. 2026-09-17T11:21:26.275 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:21:27.431 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{69FD6416-70CD-4728-BC58-4FCDE54FBC9E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 11:21:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T11:21:27.588 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:21:27.588 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:21:27.588 [Cloud] Queued cloud request. 2026-09-17T11:21:27.588 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:21:27.588 [Cloud] Dequeued cloud request. 2026-09-17T11:21:27.588 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:21:27.947 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:21:28.759 [Cloud] End of cloud request. 2026-09-17T11:21:29.259 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:21:29.791 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:21:29.791 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:21:29.791 [Cloud] Queued cloud request. 2026-09-17T11:21:29.791 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:21:29.791 [Cloud] Dequeued cloud request. 2026-09-17T11:21:29.791 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:21:29.900 [Cloud] End of cloud request. 2026-09-17T11:21:29.963 [Cloud] End of cloud request. 2026-09-17T11:21:30.400 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:21:45.666 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:21:45.666 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:21:45.666 [Cloud] Queued cloud request. 2026-09-17T11:21:45.666 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:21:45.666 [Cloud] Dequeued cloud request. 2026-09-17T11:21:45.666 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:21:45.744 [Cloud] End of cloud request. 2026-09-17T11:21:46.244 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:21:46.791 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:21:46.791 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:21:46.791 [Cloud] Queued cloud request. 2026-09-17T11:21:46.791 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:21:46.791 [Cloud] Dequeued cloud request. 2026-09-17T11:21:46.791 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:21:50.806 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:21:50.806 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:21:50.806 [Cloud] Queued cloud request. 2026-09-17T11:21:50.806 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:21:50.806 [Cloud] Dequeued cloud request. 2026-09-17T11:21:50.806 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:21:50.884 [Cloud] End of cloud request. 2026-09-17T11:21:51.400 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:21:54.400 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:21:54.400 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:21:54.400 [Cloud] Queued cloud request. 2026-09-17T11:21:54.400 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:21:54.400 [Cloud] Dequeued cloud request. 2026-09-17T11:21:54.400 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:21:54.478 [Cloud] End of cloud request. 2026-09-17T11:21:54.994 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:21:55.853 [Cloud] End of cloud request. 2026-09-17T11:21:56.353 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:21:57.213 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:21:57.213 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:21:57.213 [Cloud] Queued cloud request. 2026-09-17T11:21:57.213 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:21:57.213 [Cloud] Dequeued cloud request. 2026-09-17T11:21:57.213 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:21:57.291 [Cloud] End of cloud request. 2026-09-17T11:21:57.806 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:21:58.572 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:21:58.572 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:21:58.572 [Cloud] Queued cloud request. 2026-09-17T11:21:58.572 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:21:58.572 [Cloud] Dequeued cloud request. 2026-09-17T11:21:58.572 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:21:58.650 [Cloud] End of cloud request. 2026-09-17T11:21:59.150 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:22:02.728 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:22:02.728 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:22:02.728 [Cloud] Queued cloud request. 2026-09-17T11:22:02.728 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:22:02.728 [Cloud] Dequeued cloud request. 2026-09-17T11:22:02.728 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:22:02.806 [Cloud] End of cloud request. 2026-09-17T11:22:03.306 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:22:11.572 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:22:11.572 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:22:11.572 [Cloud] Queued cloud request. 2026-09-17T11:22:11.572 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:22:11.572 [Cloud] Dequeued cloud request. 2026-09-17T11:22:11.572 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:22:11.666 [Cloud] End of cloud request. 2026-09-17T11:22:12.166 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:22:14.259 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:22:14.259 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:22:14.259 [Cloud] Queued cloud request. 2026-09-17T11:22:14.259 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:22:14.259 [Cloud] Dequeued cloud request. 2026-09-17T11:22:14.259 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:22:14.369 [Cloud] End of cloud request. 2026-09-17T11:22:14.869 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:22:16.713 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:22:16.713 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:22:16.713 [Cloud] Queued cloud request. 2026-09-17T11:22:16.713 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:22:16.713 [Cloud] Dequeued cloud request. 2026-09-17T11:22:16.713 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:22:16.791 [Cloud] End of cloud request. 2026-09-17T11:22:17.291 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:22:24.244 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:22:24.244 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:22:24.244 [Cloud] Queued cloud request. 2026-09-17T11:22:24.244 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:22:24.244 [Cloud] Dequeued cloud request. 2026-09-17T11:22:24.244 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:22:31.884 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:22:31.884 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:22:31.884 [Cloud] Queued cloud request. 2026-09-17T11:22:31.884 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:22:31.884 [Cloud] Dequeued cloud request. 2026-09-17T11:22:31.884 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:22:31.978 [Cloud] End of cloud request. 2026-09-17T11:22:32.478 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:22:33.103 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:22:33.103 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:22:33.103 [Cloud] Queued cloud request. 2026-09-17T11:22:33.103 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:22:33.103 [Cloud] Dequeued cloud request. 2026-09-17T11:22:33.103 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:22:33.181 [Cloud] End of cloud request. 2026-09-17T11:22:33.681 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:22:34.259 [Cloud] End of cloud request. 2026-09-17T11:22:34.759 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:22:35.650 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:22:35.650 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:22:35.650 [Cloud] Queued cloud request. 2026-09-17T11:22:35.650 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:22:35.650 [Cloud] Dequeued cloud request. 2026-09-17T11:22:35.650 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:22:35.744 [Cloud] End of cloud request. 2026-09-17T11:22:36.259 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:22:39.478 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:22:39.478 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:22:39.478 [Cloud] Queued cloud request. 2026-09-17T11:22:39.478 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:22:39.478 [Cloud] Dequeued cloud request. 2026-09-17T11:22:39.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:22:40.634 [Cloud] End of cloud request. 2026-09-17T11:22:40.634 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:22:40.634 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:22:40.634 [Cloud] Queued cloud request. 2026-09-17T11:22:40.634 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:22:40.634 [Cloud] Dequeued cloud request. 2026-09-17T11:22:40.634 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:22:41.134 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:22:41.791 [Cloud] End of cloud request. 2026-09-17T11:22:42.150 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:22:42.150 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:22:42.150 [Cloud] Queued cloud request. 2026-09-17T11:22:42.150 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:22:42.150 [Cloud] Dequeued cloud request. 2026-09-17T11:22:42.150 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:22:42.291 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:22:43.291 [Cloud] End of cloud request. 2026-09-17T11:22:43.806 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:22:57.603 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:22:57.603 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:22:57.603 [Cloud] Queued cloud request. 2026-09-17T11:22:57.603 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:22:57.603 [Cloud] Dequeued cloud request. 2026-09-17T11:22:57.603 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:22:57.682 [Cloud] End of cloud request. 2026-09-17T11:22:58.182 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:23:07.745 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:23:07.745 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:23:07.745 [Cloud] Queued cloud request. 2026-09-17T11:23:07.745 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:23:07.745 [Cloud] Dequeued cloud request. 2026-09-17T11:23:07.745 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:23:07.854 [Cloud] End of cloud request. 2026-09-17T11:23:08.370 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:23:23.433 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:23:23.433 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:23:23.433 [Cloud] Queued cloud request. 2026-09-17T11:23:23.433 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:23:23.433 [Cloud] Dequeued cloud request. 2026-09-17T11:23:23.433 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:23:23.511 [Cloud] End of cloud request. 2026-09-17T11:23:24.011 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:23:32.449 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:23:32.449 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:23:32.449 [Cloud] Queued cloud request. 2026-09-17T11:23:32.449 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:23:32.449 [Cloud] Dequeued cloud request. 2026-09-17T11:23:32.449 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:23:32.558 [Cloud] End of cloud request. 2026-09-17T11:23:33.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:23:45.433 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:23:45.433 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:23:45.433 [Cloud] Queued cloud request. 2026-09-17T11:23:45.433 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:23:45.433 [Cloud] Dequeued cloud request. 2026-09-17T11:23:45.433 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:23:45.527 [Cloud] End of cloud request. 2026-09-17T11:23:46.043 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:24:01.590 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:24:01.590 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:24:01.590 [Cloud] Queued cloud request. 2026-09-17T11:24:01.590 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:24:01.590 [Cloud] Dequeued cloud request. 2026-09-17T11:24:01.590 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:24:01.668 [Cloud] End of cloud request. 2026-09-17T11:24:02.168 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:24:05.043 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:24:05.043 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:24:05.043 [Cloud] Queued cloud request. 2026-09-17T11:24:05.043 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:24:05.043 [Cloud] Dequeued cloud request. 2026-09-17T11:24:05.043 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:24:05.137 [Cloud] End of cloud request. 2026-09-17T11:24:05.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:24:23.106 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:24:23.106 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:24:23.106 [Cloud] Queued cloud request. 2026-09-17T11:24:23.106 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:24:23.106 [Cloud] Dequeued cloud request. 2026-09-17T11:24:23.106 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:24:23.199 [Cloud] End of cloud request. 2026-09-17T11:24:23.715 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:24:33.168 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T11:24:33.168 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T11:24:33.168 [Cloud] Queued cloud request. 2026-09-17T11:24:33.168 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T11:24:33.168 [Cloud] Dequeued cloud request. 2026-09-17T11:24:33.168 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T11:24:33.246 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6EEE0B55-B3E6-C3E7-EDC0-5F57012CA1E7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 11:24:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T11:24:33.762 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T11:27:04.138 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T11:28:50.795 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 20592, Count: 1490, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-17T11:28:50.795 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 13276, Count: 1047, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-17T11:28:50.795 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 5192, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T11:28:50.795 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-17T11:28:50.795 ProcessImageName: php.exe, Pid: 4672, TotalTime: 786, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-17T11:28:50.795 ProcessImageName: AgentShellService.exe, Pid: 2592, TotalTime: 731, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 51% 2026-09-17T11:28:50.795 ProcessImageName: WmiPrvSE.exe, Pid: 160, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-17T11:28:50.795 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 468, Count: 39, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-17T11:28:50.795 ProcessImageName: powershell.exe, Pid: 3428, TotalTime: 232, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 27% 2026-09-17T11:28:50.795 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-17T11:28:50.795 ProcessImageName: cmd.exe, Pid: 6036, TotalTime: 155, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 66% 2026-09-17T11:28:50.795 ProcessImageName: python.exe, Pid: 1960, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-17T11:28:50.795 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T11:28:50.795 ProcessImageName: DeviceCensus.exe, Pid: 6268, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 9% 2026-09-17T11:28:50.795 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-17T11:28:50.795 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-17T11:28:50.795 ProcessImageName: powershell.exe, Pid: 1824, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpAF7.tmp, EstimatedImpact: 0% 2026-09-17T11:28:50.795 ProcessImageName: cmd.exe, Pid: 1048, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-17T11:28:50.795 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2.MAD, EstimatedImpact: 0% 2026-09-17T11:28:50.795 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-17T11:28:50.795 ProcessImageName: powershell.exe, Pid: 4116, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_np205jrl.r2i.ps1, EstimatedImpact: 0% 2026-09-17T11:28:50.795 ProcessImageName: mysqldump.exe, Pid: 1868, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-17T11:28:50.795 ProcessImageName: taskhostw.exe, Pid: 1228, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-17T11:28:50.795 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-17T11:42:09.145 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T11:57:14.152 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T12:12:19.159 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T12:15:15.740 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T12:15:15.740 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T12:15:15.740 [Cloud] Queued cloud request. 2026-09-17T12:15:15.740 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T12:15:15.740 [Cloud] Dequeued cloud request. 2026-09-17T12:15:15.740 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T12:15:15.911 [Cloud] End of cloud request. 2026-09-17T12:15:16.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T12:27:24.168 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T12:28:16.591 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T12:28:16.591 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T12:28:16.591 [Cloud] Queued cloud request. 2026-09-17T12:28:16.591 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T12:28:16.591 [Cloud] Dequeued cloud request. 2026-09-17T12:28:16.591 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T12:28:16.747 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8BA6066-D658-6179-92E9-F703909DEC6D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 12:28:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T12:28:17.247 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T12:29:21.388 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T12:29:21.388 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T12:29:21.388 [Cloud] Queued cloud request. 2026-09-17T12:29:21.388 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T12:29:21.388 [Cloud] Dequeued cloud request. 2026-09-17T12:29:21.388 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T12:29:21.575 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C8A7E9A9-E572-8B8E-0445-4650D70D4EE0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 12:29:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T12:29:22.091 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T12:39:24.393 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T12:39:24.393 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T12:39:24.393 [Cloud] Queued cloud request. 2026-09-17T12:39:24.393 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T12:39:24.393 [Cloud] Dequeued cloud request. 2026-09-17T12:39:24.393 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T12:39:24.580 [Cloud] End of cloud request. 2026-09-17T12:39:25.096 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T12:42:29.175 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T12:57:34.183 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T13:12:39.190 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T13:27:44.198 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T13:28:50.870 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 24277, Count: 1739, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\turbodbadmin\turbo\turbo.js, EstimatedImpact: 0% 2026-09-17T13:28:50.870 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 15573, Count: 1221, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-17T13:28:50.870 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 5192, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T13:28:50.870 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-17T13:28:50.870 ProcessImageName: php.exe, Pid: 4672, TotalTime: 786, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-17T13:28:50.870 ProcessImageName: AgentShellService.exe, Pid: 2592, TotalTime: 731, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 51% 2026-09-17T13:28:50.870 ProcessImageName: WmiPrvSE.exe, Pid: 160, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-17T13:28:50.870 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 498, Count: 43, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-17T13:28:50.870 ProcessImageName: powershell.exe, Pid: 3428, TotalTime: 232, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 27% 2026-09-17T13:28:50.870 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-17T13:28:50.870 ProcessImageName: cmd.exe, Pid: 6036, TotalTime: 155, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 66% 2026-09-17T13:28:50.870 ProcessImageName: python.exe, Pid: 1960, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-17T13:28:50.870 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T13:28:50.870 ProcessImageName: DeviceCensus.exe, Pid: 6268, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 9% 2026-09-17T13:28:50.870 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-17T13:28:50.870 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-17T13:28:50.870 ProcessImageName: powershell.exe, Pid: 1824, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpAF7.tmp, EstimatedImpact: 0% 2026-09-17T13:28:50.870 ProcessImageName: cmd.exe, Pid: 1048, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-17T13:28:50.870 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2.MAD, EstimatedImpact: 0% 2026-09-17T13:28:50.870 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-17T13:28:50.870 ProcessImageName: powershell.exe, Pid: 4116, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_np205jrl.r2i.ps1, EstimatedImpact: 0% 2026-09-17T13:28:50.870 ProcessImageName: mysqldump.exe, Pid: 1868, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-17T13:28:50.870 ProcessImageName: taskhostw.exe, Pid: 1228, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-17T13:28:50.870 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-17T13:42:49.205 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T13:48:01.833 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17a57-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7182334, FileId: 0x1700000003e7c3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T13:48:01.833 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17a57-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7182333, FileId: 0x1600000003e8aa, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-17T13:57:54.213 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T14:09:34.843 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T14:09:34.843 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T14:09:34.843 [Cloud] Queued cloud request. 2026-09-17T14:09:34.843 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T14:09:34.843 [Cloud] Dequeued cloud request. 2026-09-17T14:09:34.843 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T14:09:34.999 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1EB250EE-940E-D7E3-20F7-ACA2A6C2206C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 14:09:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T14:09:35.515 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T14:12:59.220 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T14:28:04.228 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T14:43:09.233 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T14:58:14.243 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T15:13:19.250 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T15:28:24.258 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T15:28:50.930 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 25366, Count: 1894, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\turbodbadmin\turbo\turbo.js, EstimatedImpact: 0% 2026-09-17T15:28:50.930 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 17708, Count: 1392, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-17T15:28:50.930 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 5192, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T15:28:50.930 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-17T15:28:50.930 ProcessImageName: php.exe, Pid: 4672, TotalTime: 786, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-17T15:28:50.930 ProcessImageName: AgentShellService.exe, Pid: 2592, TotalTime: 731, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 51% 2026-09-17T15:28:50.930 ProcessImageName: WmiPrvSE.exe, Pid: 160, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-17T15:28:50.930 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 588, Count: 49, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-17T15:28:50.930 ProcessImageName: powershell.exe, Pid: 3428, TotalTime: 232, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 27% 2026-09-17T15:28:50.930 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-17T15:28:50.930 ProcessImageName: cmd.exe, Pid: 6036, TotalTime: 155, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 66% 2026-09-17T15:28:50.930 ProcessImageName: python.exe, Pid: 1960, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-17T15:28:50.930 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T15:28:50.930 ProcessImageName: DeviceCensus.exe, Pid: 6268, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 9% 2026-09-17T15:28:50.930 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-17T15:28:50.930 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-17T15:28:50.930 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-17T15:28:50.930 ProcessImageName: powershell.exe, Pid: 1824, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpAF7.tmp, EstimatedImpact: 0% 2026-09-17T15:28:50.930 ProcessImageName: cmd.exe, Pid: 1048, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-17T15:28:50.930 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2.MAD, EstimatedImpact: 0% 2026-09-17T15:28:50.930 ProcessImageName: powershell.exe, Pid: 4116, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_np205jrl.r2i.ps1, EstimatedImpact: 0% 2026-09-17T15:28:50.930 ProcessImageName: mysqldump.exe, Pid: 1868, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-17T15:28:50.930 ProcessImageName: taskhostw.exe, Pid: 1228, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-17T15:28:50.930 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-17T15:41:18.138 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T15:41:18.138 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T15:41:18.138 [Cloud] Queued cloud request. 2026-09-17T15:41:18.138 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T15:41:18.138 [Cloud] Dequeued cloud request. 2026-09-17T15:41:18.138 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T15:41:21.591 [Cloud] End of cloud request. 2026-09-17T15:41:22.091 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T15:43:29.265 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T15:44:50.391 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T15:44:50.391 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T15:44:50.391 [Cloud] Queued cloud request. 2026-09-17T15:44:50.391 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T15:44:50.391 [Cloud] Dequeued cloud request. 2026-09-17T15:44:50.391 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T15:44:53.172 [Cloud] End of cloud request. 2026-09-17T15:44:53.688 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T15:45:12.141 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T15:45:12.141 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T15:45:12.141 [Cloud] Queued cloud request. 2026-09-17T15:45:12.141 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T15:45:12.141 [Cloud] Dequeued cloud request. 2026-09-17T15:45:12.141 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T15:45:12.235 [Cloud] End of cloud request. 2026-09-17T15:45:12.735 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T15:49:23.237 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T15:49:23.237 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T15:49:23.237 [Cloud] Queued cloud request. 2026-09-17T15:49:23.237 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T15:49:23.237 [Cloud] Dequeued cloud request. 2026-09-17T15:49:23.237 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T15:49:23.393 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{60B65E78-66DA-A75F-042E-F7377EBC7C97} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 15:49:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T15:49:23.893 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T15:56:42.254 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T15:56:42.254 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T15:56:42.254 [Cloud] Queued cloud request. 2026-09-17T15:56:42.254 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T15:56:42.254 [Cloud] Dequeued cloud request. 2026-09-17T15:56:42.254 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T15:56:42.410 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F149FACA-AC88-B980-D324-C6DD11A600BA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 15:56:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T15:56:42.910 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T15:58:34.273 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T16:00:49.257 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T16:00:49.257 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T16:00:49.257 [Cloud] Queued cloud request. 2026-09-17T16:00:49.257 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T16:00:49.257 [Cloud] Dequeued cloud request. 2026-09-17T16:00:49.257 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T16:00:59.335 [Cloud] End of cloud request. 2026-09-17T16:00:59.851 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T16:13:04.403 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T16:13:04.403 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T16:13:04.403 [Cloud] Queued cloud request. 2026-09-17T16:13:04.403 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T16:13:04.403 [Cloud] Dequeued cloud request. 2026-09-17T16:13:04.403 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T16:13:04.607 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1A338089-D78D-BAAD-121D-52583DE38DF4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 16:13:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T16:13:05.107 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T16:13:39.280 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T16:26:18.753 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T16:26:18.753 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T16:26:18.753 [Cloud] Queued cloud request. 2026-09-17T16:26:18.753 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T16:26:18.753 [Cloud] Dequeued cloud request. 2026-09-17T16:26:18.753 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T16:26:18.910 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7D145BD5-54F1-1E04-79D4-61A5AFAFA9E2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 16:26:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T16:26:19.425 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T16:28:28.975 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T16:28:28.975 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T16:28:28.975 [Cloud] Queued cloud request. 2026-09-17T16:28:28.975 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T16:28:28.975 [Cloud] Dequeued cloud request. 2026-09-17T16:28:28.975 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T16:28:29.115 [Cloud] End of cloud request. 2026-09-17T16:28:29.631 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T16:28:44.287 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T16:32:35.803 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T16:32:35.803 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T16:32:35.803 [Cloud] Queued cloud request. 2026-09-17T16:32:35.803 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T16:32:35.803 [Cloud] Dequeued cloud request. 2026-09-17T16:32:35.803 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T16:32:45.881 [Cloud] End of cloud request. 2026-09-17T16:32:46.381 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T16:42:29.730 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T16:42:29.730 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T16:42:29.730 [Cloud] Queued cloud request. 2026-09-17T16:42:29.730 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T16:42:29.730 [Cloud] Dequeued cloud request. 2026-09-17T16:42:29.730 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T16:42:29.933 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DE86471D-41FC-8988-2B40-D4BB75E508BC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 16:42:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T16:42:30.448 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T16:43:49.295 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T16:47:41.594 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T16:47:41.594 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T16:47:41.594 [Cloud] Queued cloud request. 2026-09-17T16:47:41.594 [Cloud] Dequeued cloud request. 2026-09-17T16:47:41.594 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T16:47:41.594 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T16:47:41.781 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F2882A17-07CF-BACA-1519-C5FB83AEF4CA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 16:47:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T16:47:42.297 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T16:58:54.302 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T16:58:56.302 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T16:58:56.302 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T16:58:56.302 [Cloud] Queued cloud request. 2026-09-17T16:58:56.302 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T16:58:56.302 [Cloud] Dequeued cloud request. 2026-09-17T16:58:56.302 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T16:58:56.490 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{51C5D7E7-ABB4-E999-1B57-E2A5A3FAA282} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 16:58:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T16:58:56.990 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T17:00:37.615 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T17:00:37.615 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T17:00:37.615 [Cloud] Queued cloud request. 2026-09-17T17:00:37.615 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T17:00:37.615 [Cloud] Dequeued cloud request. 2026-09-17T17:00:37.615 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T17:00:37.818 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E45A2FAD-823F-1FE3-D031-7AED446E4BCF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 17:00:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T17:00:38.318 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T17:05:46.992 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T17:05:46.992 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T17:05:46.992 [Cloud] Queued cloud request. 2026-09-17T17:05:46.992 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T17:05:46.992 [Cloud] Dequeued cloud request. 2026-09-17T17:05:46.992 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T17:05:47.195 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B987672F-A7A4-1A64-E418-19D288C1361E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 17:05:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T17:05:47.695 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T17:13:59.309 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T17:23:47.595 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T17:23:47.595 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T17:23:47.595 [Cloud] Queued cloud request. 2026-09-17T17:23:47.595 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T17:23:47.595 [Cloud] Dequeued cloud request. 2026-09-17T17:23:47.595 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T17:23:47.751 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CC3B8F7A-7316-23A4-FD64-571AA0975191} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 17:23:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T17:23:48.251 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T17:27:02.689 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T17:27:02.689 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T17:27:02.689 [Cloud] Queued cloud request. 2026-09-17T17:27:02.689 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T17:27:02.689 [Cloud] Dequeued cloud request. 2026-09-17T17:27:02.689 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T17:27:02.845 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{806798C8-9FCD-C06A-2F2F-872B98DA5807} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 17:27:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T17:27:03.361 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T17:28:51.004 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27004, Count: 1976, MaxTime: 296, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\turbodbadmin\turbo\turbo.js, EstimatedImpact: 0% 2026-09-17T17:28:51.004 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 19795, Count: 1565, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-17T17:28:51.004 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 5192, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T17:28:51.004 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-17T17:28:51.004 ProcessImageName: php.exe, Pid: 4672, TotalTime: 786, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-17T17:28:51.004 ProcessImageName: AgentShellService.exe, Pid: 2592, TotalTime: 731, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 51% 2026-09-17T17:28:51.004 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 649, Count: 53, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-17T17:28:51.004 ProcessImageName: WmiPrvSE.exe, Pid: 160, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-17T17:28:51.004 ProcessImageName: powershell.exe, Pid: 3428, TotalTime: 232, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 27% 2026-09-17T17:28:51.004 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-17T17:28:51.004 ProcessImageName: cmd.exe, Pid: 6036, TotalTime: 155, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 66% 2026-09-17T17:28:51.004 ProcessImageName: python.exe, Pid: 1960, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-17T17:28:51.004 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T17:28:51.004 ProcessImageName: DeviceCensus.exe, Pid: 6268, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 9% 2026-09-17T17:28:51.004 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-17T17:28:51.004 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-17T17:28:51.004 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-17T17:28:51.004 ProcessImageName: powershell.exe, Pid: 1824, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpAF7.tmp, EstimatedImpact: 0% 2026-09-17T17:28:51.004 ProcessImageName: cmd.exe, Pid: 1048, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-17T17:28:51.004 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2.MAD, EstimatedImpact: 0% 2026-09-17T17:28:51.004 ProcessImageName: powershell.exe, Pid: 4116, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_np205jrl.r2i.ps1, EstimatedImpact: 0% 2026-09-17T17:28:51.004 ProcessImageName: mysqldump.exe, Pid: 1868, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-17T17:28:51.004 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0% 2026-09-17T17:28:51.004 ProcessImageName: taskhostw.exe, Pid: 1228, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-17T17:28:51.004 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-17T17:29:04.317 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T17:29:50.442 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T17:29:50.442 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T17:29:50.442 [Cloud] Queued cloud request. 2026-09-17T17:29:50.442 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T17:29:50.442 [Cloud] Dequeued cloud request. 2026-09-17T17:29:50.442 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T17:29:50.582 [Cloud] End of cloud request. 2026-09-17T17:29:51.082 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T17:44:09.324 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T17:44:24.621 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T17:44:24.621 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T17:44:24.621 [Cloud] Queued cloud request. 2026-09-17T17:44:24.621 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T17:44:24.621 [Cloud] Dequeued cloud request. 2026-09-17T17:44:24.621 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T17:44:24.855 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8CAEA845-BC1C-F62D-6EE2-FA3BEC939A7E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 17:44:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T17:44:25.355 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T17:50:50.733 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T17:50:50.733 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T17:50:50.733 [Cloud] Queued cloud request. 2026-09-17T17:50:50.733 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T17:50:50.733 [Cloud] Dequeued cloud request. 2026-09-17T17:50:50.733 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T17:50:50.967 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7B454360-5C13-8AF4-D092-E1EFAEEC8E5B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 17:50:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T17:50:51.467 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T17:52:49.608 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T17:52:49.608 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T17:52:49.608 [Cloud] Queued cloud request. 2026-09-17T17:52:49.608 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T17:52:49.608 [Cloud] Dequeued cloud request. 2026-09-17T17:52:49.608 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T17:52:49.795 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FF4F8BE8-1EB9-A7F2-4C72-DC4EC9752C76} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 17:52:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T17:52:50.295 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T17:59:14.331 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T18:01:35.300 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T18:01:35.300 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T18:01:35.300 [Cloud] Queued cloud request. 2026-09-17T18:01:35.300 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T18:01:35.503 [Cloud] Dequeued cloud request. 2026-09-17T18:01:35.503 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T18:01:35.691 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{471FD0B5-113A-6EE5-89D5-2922ADFFEB0F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 18:01:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T18:01:36.207 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T18:07:56.055 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T18:07:56.055 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T18:07:56.055 [Cloud] Queued cloud request. 2026-09-17T18:07:56.055 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T18:07:56.055 [Cloud] Dequeued cloud request. 2026-09-17T18:07:56.055 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T18:08:00.742 [Cloud] End of cloud request. 2026-09-17T18:08:01.242 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T18:14:19.338 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T18:27:48.236 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T18:27:48.236 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T18:27:48.236 [Cloud] Queued cloud request. 2026-09-17T18:27:48.236 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T18:27:48.236 [Cloud] Dequeued cloud request. 2026-09-17T18:27:48.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T18:27:48.440 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6D81F546-6EBE-C0F1-C088-ECD2C2572213} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 18:27:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T18:27:48.955 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T18:29:24.346 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T18:39:31.335 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T18:39:31.335 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T18:39:31.335 [Cloud] Queued cloud request. 2026-09-17T18:39:31.335 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T18:39:31.335 [Cloud] Dequeued cloud request. 2026-09-17T18:39:31.335 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T18:39:34.913 [Cloud] End of cloud request. 2026-09-17T18:39:35.429 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T18:44:29.354 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T18:53:45.842 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T18:53:45.842 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T18:53:45.842 [Cloud] Queued cloud request. 2026-09-17T18:53:45.842 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T18:53:45.905 [Cloud] Dequeued cloud request. 2026-09-17T18:53:45.905 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T18:53:55.983 [Cloud] End of cloud request. 2026-09-17T18:53:56.499 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T18:57:05.124 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T18:57:05.124 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T18:57:05.124 [Cloud] Queued cloud request. 2026-09-17T18:57:05.124 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T18:57:05.124 [Cloud] Dequeued cloud request. 2026-09-17T18:57:05.124 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T18:57:05.264 [Cloud] End of cloud request. 2026-09-17T18:57:05.780 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T18:59:30.017 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T18:59:30.017 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T18:59:30.017 [Cloud] Queued cloud request. 2026-09-17T18:59:30.017 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T18:59:30.017 [Cloud] Dequeued cloud request. 2026-09-17T18:59:30.017 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T18:59:30.173 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AD4DB4CB-38ED-B65A-E5BB-BCC5546B6D59} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 18:59:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T18:59:30.673 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T18:59:34.360 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T19:14:39.368 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T19:24:49.169 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T19:24:49.169 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T19:24:49.169 [Cloud] Queued cloud request. 2026-09-17T19:24:49.169 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T19:24:49.326 [Cloud] Dequeued cloud request. 2026-09-17T19:24:49.482 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T19:24:49.638 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{910A99EB-9177-E920-2718-EF5F8DF8261E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 19:24:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T19:24:50.138 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T19:28:19.375 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-17T19:28:19.406 Job Notification: New process added to job (5988) 2026-09-17T19:28:19.406 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-17T19:28:19.421 Aggressive catchup quick scan threshold: 692453310911 / 25920000000000 2026-09-17T19:28:19.421 Job Notification: New process added to job (2376) 2026-09-17T19:28:19.421 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:5988] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:2376]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-17T19:28:19.562 Job Notification: New process added to job (828) 2026-09-17T19:28:19.562 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-17T19:28:19.578 Job Notification: New process added to job (6956) 2026-09-17T19:28:19.609 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:828] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:6956]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-17T19:28:19.781 Job Notification: New process added to job (6536) 2026-09-17T19:28:19.859 Task(GetDeviceTicket -AccessKey 4A46C536-14AC-7F18-B973-28CA687593D9 ) launched as network service 2026-09-17T19:28:19.937 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-17T19:28:19.937 [RTP] Duplicating the current plugin configuration object... 2026-09-17T19:28:19.937 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-17T19:28:19.937 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-17T19:28:19.937 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-17T19:28:19.937 [RTP] No config change detected. Not updating plugin configuration. 2026-09-17T19:28:19.937 [RTP] No config changes found. No configuration switch. 2026-09-17T19:28:19.937 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-17T19:28:20.421 Job Notification: Process exited from job (6536) 2026-09-17T19:28:20.593 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-17T19:28:20.593 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T19:28:20.593 [Cloud] Queued cloud request. 2026-09-17T19:28:20.593 [Cloud] Dequeued cloud request. 2026-09-17T19:28:20.593 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T19:28:20.734 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-17T19:28:20.734 [Cloud] End of cloud request. 2026-09-17T19:28:21.093 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T19:28:45.156 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\34431EB2-033F-4A9F-B4EA-19E7995784CB344.1dd46dabfe36f04 2026-09-17T19:28:45.218 Verifying engine and signature files (source: 0) ... 2026-09-17T19:28:45.218 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpengine.dll] due to PPL. 2026-09-17T19:28:45.218 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpasbase.vdm]. File not in cache (0x1) 2026-09-17T19:28:46.187 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpasbase.vdm] 2026-09-17T19:28:46.187 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-17T19:28:46.203 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpasdlta.vdm] 2026-09-17T19:28:46.203 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpavbase.vdm]. File not in cache (0x1) 2026-09-17T19:28:46.609 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpavbase.vdm] 2026-09-17T19:28:46.609 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-17T19:28:46.640 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpavdlta.vdm] 2026-09-17T19:28:46.843 [Engine] IsHybridMode: 0 2026-09-17T19:28:46.843 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-17T19:28:46.859 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-53ED96F4DB02DB302E36A4E15A99D1602B115611.bin): 0x00000002 2026-09-17T19:28:46.875 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-53ED96F4DB02DB302E36A4E15A99D1602B115611.bin) 2026-09-17T19:28:46.875 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-17T19:28:46.875 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-17T19:28:46.875 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-17T19:28:46.875 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff 2026-09-17T19:28:51.062 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 28920, Count: 2063, MaxTime: 375, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\js\jquery.js, EstimatedImpact: 0% 2026-09-17T19:28:51.062 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 21980, Count: 1738, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-17T19:28:51.062 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 5192, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T19:28:51.062 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-17T19:28:51.062 ProcessImageName: php.exe, Pid: 4672, TotalTime: 786, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-17T19:28:51.062 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 739, Count: 60, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-17T19:28:51.062 ProcessImageName: AgentShellService.exe, Pid: 2592, TotalTime: 731, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 51% 2026-09-17T19:28:51.062 ProcessImageName: WmiPrvSE.exe, Pid: 160, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-17T19:28:51.062 ProcessImageName: powershell.exe, Pid: 3428, TotalTime: 232, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 27% 2026-09-17T19:28:51.062 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-17T19:28:51.062 ProcessImageName: cmd.exe, Pid: 6036, TotalTime: 155, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 66% 2026-09-17T19:28:51.062 ProcessImageName: python.exe, Pid: 1960, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-17T19:28:51.062 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T19:28:51.062 ProcessImageName: DeviceCensus.exe, Pid: 6268, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 9% 2026-09-17T19:28:51.062 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-17T19:28:51.062 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-17T19:28:51.062 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-17T19:28:51.062 ProcessImageName: powershell.exe, Pid: 1824, TotalTime: 46, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpAF7.tmp, EstimatedImpact: 0% 2026-09-17T19:28:51.062 ProcessImageName: cmd.exe, Pid: 1048, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-17T19:28:51.062 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-178c9-2.MAD, EstimatedImpact: 0% 2026-09-17T19:28:51.062 ProcessImageName: powershell.exe, Pid: 4116, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_np205jrl.r2i.ps1, EstimatedImpact: 0% 2026-09-17T19:28:51.062 ProcessImageName: mysqldump.exe, Pid: 1868, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-17T19:28:51.062 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0% 2026-09-17T19:28:51.062 ProcessImageName: taskhostw.exe, Pid: 1228, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-17T19:28:51.062 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-17T19:28:58.765 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-17T19:28:58.765 [AutoExclusion] Applied roles from cache. 2026-09-17T19:28:58.765 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-17T19:28:58.921 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF4ABB020, lRefCount: 6, hr=0 2026-09-17T19:28:58.921 [Engine] New active engine 00007FFCF68AB020 replacing engine 00007FFCF4ABB020. Number of active engines: 2 2026-09-17T19:28:58.937 EngineInit:Global ASOC is enabled 2026-09-17T19:28:58.937 EngineInit:ASOO is enabled for developer volumes 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.031 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-17T19:28:59.062 MpWriteUupSignatureVersion 1.459.256.0, hr = 0 2026-09-17T19:28:59.062 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-17T19:28:59.093 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-17T19:28:59.093 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-17T19:28:59.093 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-17T19:28:59.093 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-17T19:28:59.109 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-17T19:28:59.109 [Plugin] Initializing RTP plugin state... 2026-09-17T19:28:59.109 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-17T19:28:59.109 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎16‎-‎2026 21:28:50 Last Perf:‎09‎-‎16‎-‎2026 21:28:50 First RTP Scan:‎09‎-‎16‎-‎2026 21:28:50 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1426 Misses:7784 BM Queue:0,63,0 Proc:0,54,0 File:0,63,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:7294883 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:-951666724 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:14789 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:833744 TotalHits:23814825 InstanceCacheInserts:454010 InstanceCacheUpdates:0 InstanceCacheDeletes:69271 InstanceCacheHits:17002 InstanceCacheMisses:827187 InstanceCacheOverflows:367691 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:5ms (7708/1502) Success: 1502, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-17T19:28:59.109 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA} 2026-09-17T19:28:59.109 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E}\mpasbase.vdm in use, hr=0x80070020 2026-09-17T19:28:59.109 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6B7F4A03-F817-4642-A91A-7174C53B3ACD} removed 2026-09-17T19:28:59.109 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-17T19:28:59.125 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-17T19:28:59.125 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-17T19:28:59.125 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-17T19:28:59.125 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-17T19:28:59.125 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-17-2026 19:28:59 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-17-2026 19:28:59 2026-09-17T19:28:59.125 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-17T19:28:59.125 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-17T19:28:59.125 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-17T19:28:59.125 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-17T19:28:59.125 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T19:28:59.125 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-17T19:28:59.125 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-17T19:28:59.125 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-17T19:28:59.125 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-17T19:28:59.125 MdCoreSvc is supported in this platform and OS Signature updated on 09-17-2026 19:28:59 Product Version: 4.18.26080.3 Service Version: 4.18.26080.3 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.256.0 AV Signature Version: 1.459.256.0 ************************************************************ 2026-09-17T19:28:59.140 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-17T19:28:59.140 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\34431EB2-033F-4A9F-B4EA-19E7995784CB344.1dd46dabfe36f04 2026-09-17T19:28:59.171 Process scan (postsignatureupdatescan) started. 2026-09-17T19:28:59.203 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-17T19:28:59.203 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-17-2026 19:28:59 ************************************************************ 2026-09-17T19:28:59.343 Job Notification: Process exited from job (5988) 2026-09-17T19:28:59.359 Job Notification: Process exited from job (2376) 2026-09-17T19:28:59.359 Job Notification: Process exited from job (828) 2026-09-17T19:28:59.359 Job Notification: Process exited from job (6956) 2026-09-17T19:28:59.484 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-17T19:28:59.484 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-17T19:28:59.484 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-17T19:28:59.484 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-17T19:28:59.484 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-17T19:28:59.515 [Engine] Engine 00007FFCF4ABB020 no longer in use. Number of active engines: 1 2026-09-17T19:28:59.515 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-17T19:28:59.515 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-17T19:28:59.578 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-17T19:28:59.578 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-17T19:28:59.578 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-17T19:29:00.062 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 28920, Count: 2063, MaxTime: 375, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\js\jquery.js, EstimatedImpact: 0% 2026-09-17T19:29:00.062 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 21980, Count: 1738, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-17T19:29:00.062 ProcessImageName: AgentShell.exe, Pid: 7516, TotalTime: 5192, Count: 465, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T19:29:00.062 ProcessImageName: powershell.exe, Pid: 4720, TotalTime: 1616, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-17T19:29:00.062 ProcessImageName: php.exe, Pid: 4672, TotalTime: 786, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-17T19:29:00.062 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 739, Count: 60, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-17T19:29:00.062 ProcessImageName: AgentShellService.exe, Pid: 2592, TotalTime: 731, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 51% 2026-09-17T19:29:00.062 ProcessImageName: WmiPrvSE.exe, Pid: 160, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-17T19:29:00.062 ProcessImageName: powershell.exe, Pid: 3428, TotalTime: 232, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 27% 2026-09-17T19:29:00.062 ProcessImageName: WmiPrvSE.exe, Pid: 6132, TotalTime: 170, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-17T19:29:00.062 ProcessImageName: cmd.exe, Pid: 6036, TotalTime: 155, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 66% 2026-09-17T19:29:00.062 ProcessImageName: python.exe, Pid: 1960, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 5% 2026-09-17T19:29:00.062 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T19:29:00.062 ProcessImageName: DeviceCensus.exe, Pid: 6268, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 9% 2026-09-17T19:29:00.062 ProcessImageName: taskhostw.exe, Pid: 7612, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 8% 2026-09-17T19:29:00.140 [Engine] RSIG_UNLOADENGINE, 00007FFCF4ABB020, err=0x0 2026-09-17T19:29:00.156 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{045CEA43-E125-455F-9826-96AECD60F49E} removed 2026-09-17T19:29:13.562 Process scan (postsignatureupdatescan) completed. 2026-09-17T19:29:44.375 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T19:33:59.000 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-17T19:42:00.099 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T19:42:00.099 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T19:42:00.099 [Cloud] Queued cloud request. 2026-09-17T19:42:00.099 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T19:42:00.099 [Cloud] Dequeued cloud request. 2026-09-17T19:42:00.115 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T19:42:00.256 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F906FD0-0BD0-C4C5-EEB1-8E34F5A6B313} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 19:42:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T19:42:00.771 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T19:44:49.382 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T19:57:25.403 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T19:57:25.403 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T19:57:25.403 [Cloud] Queued cloud request. 2026-09-17T19:57:25.403 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T19:57:25.403 [Cloud] Dequeued cloud request. 2026-09-17T19:57:25.403 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T19:57:25.591 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{348E9715-4396-D50F-C8D9-DAAC2AA2EBA1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 19:57:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T19:57:26.091 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T19:59:54.389 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T20:00:51.201 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T20:00:51.201 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T20:00:51.201 [Cloud] Queued cloud request. 2026-09-17T20:00:51.201 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T20:00:51.201 [Cloud] Dequeued cloud request. 2026-09-17T20:00:51.201 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T20:00:51.451 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{45A2DD35-5065-2AE7-6B16-D320F95F91A3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 20:00:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T20:00:51.951 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T20:02:04.796 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T20:02:04.796 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T20:02:04.796 [Cloud] Queued cloud request. 2026-09-17T20:02:04.796 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T20:02:04.796 [Cloud] Dequeued cloud request. 2026-09-17T20:02:04.796 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T20:02:05.234 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FD5739A6-3E35-38B9-EC55-0FB6F87603FD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 20:02:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T20:02:05.734 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T20:03:19.391 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T20:03:19.391 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T20:03:19.391 [Cloud] Queued cloud request. 2026-09-17T20:03:19.391 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T20:03:19.391 [Cloud] Dequeued cloud request. 2026-09-17T20:03:19.391 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T20:03:19.781 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{653AEDA2-9E39-9416-B939-82FFB4B309CD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 20:03:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T20:03:20.297 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T20:14:59.396 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T20:18:54.867 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T20:18:54.867 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T20:18:54.867 [Cloud] Queued cloud request. 2026-09-17T20:18:54.867 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T20:18:54.867 [Cloud] Dequeued cloud request. 2026-09-17T20:18:54.867 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T20:18:55.039 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3334615F-BAD6-7BF2-97B7-6A177527EFCC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 20:18:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T20:18:55.539 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T20:30:04.403 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T20:33:46.061 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T20:33:46.061 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T20:33:46.061 [Cloud] Queued cloud request. 2026-09-17T20:33:46.061 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T20:33:46.061 [Cloud] Dequeued cloud request. 2026-09-17T20:33:46.061 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{05976D1A-28A4-43B4-AFAB-9A7F7A775166} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 20:33:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T20:33:50.389 [Cloud] End of cloud request. 2026-09-17T20:33:50.905 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T20:37:03.342 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T20:37:03.342 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T20:37:03.342 [Cloud] Queued cloud request. 2026-09-17T20:37:03.342 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T20:37:03.342 [Cloud] Dequeued cloud request. 2026-09-17T20:37:03.342 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T20:37:13.420 [Cloud] End of cloud request. 2026-09-17T20:37:13.920 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T20:45:09.410 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T21:00:14.417 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T21:01:06.073 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T21:01:06.073 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T21:01:06.073 [Cloud] Queued cloud request. 2026-09-17T21:01:06.073 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T21:01:06.073 [Cloud] Dequeued cloud request. 2026-09-17T21:01:06.073 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T21:01:06.277 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E43535D8-E445-67BB-8ABB-EC82B19A7851} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 21:01:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T21:01:06.792 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T21:03:25.935 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T21:03:25.935 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T21:03:25.935 [Cloud] Queued cloud request. 2026-09-17T21:03:25.935 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T21:03:26.169 [Cloud] Dequeued cloud request. 2026-09-17T21:03:26.325 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T21:03:26.497 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2ECB95F6-EFE1-C2AF-B3D4-99F788903A57} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 21:03:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T21:03:27.013 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T21:15:19.423 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T21:24:24.927 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T21:24:24.927 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T21:24:24.927 [Cloud] Queued cloud request. 2026-09-17T21:24:24.927 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T21:24:24.927 [Cloud] Dequeued cloud request. 2026-09-17T21:24:24.927 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T21:24:25.115 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{91963375-1743-7EB1-B98E-B010FA111EE9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 21:24:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T21:24:25.631 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T21:28:58.978 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 4089, Count: 322, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\calendar.php, EstimatedImpact: 0% 2026-09-17T21:28:58.978 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 2075, Count: 177, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T21:28:58.978 ProcessImageName: powershell.exe, Pid: 1948, TotalTime: 1614, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-17T21:28:58.978 ProcessImageName: WmiPrvSE.exe, Pid: 7928, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\ndis.sys, EstimatedImpact: 100% 2026-09-17T21:28:58.978 ProcessImageName: taskhostw.exe, Pid: 5508, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-17T21:28:58.978 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-17T21:28:58.978 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-17T21:28:58.978 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T21:28:58.978 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 15, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17b61-0.MAI, EstimatedImpact: 0% 2026-09-17T21:28:58.978 ProcessImageName: taskhostw.exe, Pid: 5920, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-17T21:30:24.431 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T21:45:29.438 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T21:49:55.800 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T21:49:55.800 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T21:49:55.800 [Cloud] Queued cloud request. 2026-09-17T21:49:55.800 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T21:49:55.800 [Cloud] Dequeued cloud request. 2026-09-17T21:49:55.800 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T21:49:55.987 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FBC6F818-F4F6-DA79-11E8-19D3C5A9F18C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 21:49:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T21:49:56.503 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:00:34.444 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T22:01:38.632 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:01:38.632 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:01:38.632 [Cloud] Queued cloud request. 2026-09-17T22:01:38.632 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:01:38.632 [Cloud] Dequeued cloud request. 2026-09-17T22:01:38.632 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:01:38.835 [Cloud] End of cloud request. 2026-09-17T22:01:39.335 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:04:39.181 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:04:39.181 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:04:39.181 [Cloud] Queued cloud request. 2026-09-17T22:04:39.181 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:04:39.181 [Cloud] Dequeued cloud request. 2026-09-17T22:04:39.181 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:04:39.368 [Cloud] End of cloud request. 2026-09-17T22:04:39.868 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:10:32.855 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:10:32.855 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:10:32.855 [Cloud] Queued cloud request. 2026-09-17T22:10:32.855 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:10:32.855 [Cloud] Dequeued cloud request. 2026-09-17T22:10:32.855 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:10:33.043 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C27E8880-1BE3-D5F6-EFD0-55009321BF90} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 22:10:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T22:10:33.543 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:15:08.685 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:15:08.685 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:15:08.685 [Cloud] Queued cloud request. 2026-09-17T22:15:08.685 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:15:08.685 [Cloud] Dequeued cloud request. 2026-09-17T22:15:08.685 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:15:08.857 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{17998219-749F-8D95-555B-AC9A1C156FFF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 22:15:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T22:15:09.373 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:15:39.451 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T22:19:41.188 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:19:41.188 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:19:41.188 [Cloud] Queued cloud request. 2026-09-17T22:19:41.188 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:19:41.188 [Cloud] Dequeued cloud request. 2026-09-17T22:19:41.188 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:19:41.345 [Cloud] End of cloud request. 2026-09-17T22:19:41.860 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:30:44.458 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T22:31:09.817 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:31:09.817 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:31:09.817 [Cloud] Queued cloud request. 2026-09-17T22:31:09.817 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:31:09.817 [Cloud] Dequeued cloud request. 2026-09-17T22:31:09.817 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:31:10.005 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{49F6A396-1E90-FD0D-B833-C6C707E12419} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 22:31:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T22:31:10.520 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:35:53.210 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:35:53.210 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:35:53.210 [Cloud] Queued cloud request. 2026-09-17T22:35:53.210 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:35:53.210 [Cloud] Dequeued cloud request. 2026-09-17T22:35:53.210 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:35:53.398 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C65CBAFE-D03A-47C5-8298-71CAE396555C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 22:35:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T22:35:53.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:37:45.509 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:37:45.509 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:37:45.509 [Cloud] Queued cloud request. 2026-09-17T22:37:45.509 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:37:45.509 [Cloud] Dequeued cloud request. 2026-09-17T22:37:45.509 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:37:55.634 [Cloud] End of cloud request. 2026-09-17T22:37:56.134 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:40:50.587 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:40:50.587 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:40:50.587 [Cloud] Queued cloud request. 2026-09-17T22:40:50.587 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:40:50.587 [Cloud] Dequeued cloud request. 2026-09-17T22:40:50.603 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:40:50.775 [Cloud] End of cloud request. 2026-09-17T22:40:51.290 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:41:02.243 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:41:02.243 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:41:02.243 [Cloud] Queued cloud request. 2026-09-17T22:41:02.243 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:41:02.243 [Cloud] Dequeued cloud request. 2026-09-17T22:41:02.243 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:41:02.322 [Cloud] End of cloud request. 2026-09-17T22:41:02.822 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:44:18.964 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:44:18.964 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:44:18.964 [Cloud] Queued cloud request. 2026-09-17T22:44:18.964 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:44:18.964 [Cloud] Dequeued cloud request. 2026-09-17T22:44:18.964 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:44:19.152 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F6F10003-3273-C76E-6F75-4DA9EFC3FF3C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 22:44:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T22:44:19.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:45:34.340 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:45:34.340 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:45:34.340 [Cloud] Queued cloud request. 2026-09-17T22:45:34.340 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:45:34.340 [Cloud] Dequeued cloud request. 2026-09-17T22:45:34.340 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:45:35.653 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{41F0539C-1B4A-EBEF-78E0-50B61B99BF3E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 22:45:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T22:45:36.168 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T22:45:49.465 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T22:47:46.466 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T22:47:46.466 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T22:47:46.466 [Cloud] Queued cloud request. 2026-09-17T22:47:46.466 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T22:47:46.466 [Cloud] Dequeued cloud request. 2026-09-17T22:47:46.466 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T22:47:46.654 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{35A24D14-EB87-2140-7280-B9AC13032CD9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 22:47:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T22:47:47.154 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T23:00:09.830 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T23:00:09.830 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T23:00:09.830 [Cloud] Queued cloud request. 2026-09-17T23:00:09.830 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T23:00:09.830 [Cloud] Dequeued cloud request. 2026-09-17T23:00:09.830 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T23:00:10.033 [Cloud] End of cloud request. 2026-09-17T23:00:10.534 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T23:00:54.471 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T23:15:59.478 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T23:28:59.047 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 9085, Count: 707, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0% 2026-09-17T23:28:59.047 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 4419, Count: 362, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-17T23:28:59.047 ProcessImageName: powershell.exe, Pid: 1948, TotalTime: 1614, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-17T23:28:59.047 ProcessImageName: WmiPrvSE.exe, Pid: 7928, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\ndis.sys, EstimatedImpact: 100% 2026-09-17T23:28:59.047 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-17T23:28:59.047 ProcessImageName: taskhostw.exe, Pid: 5508, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-17T23:28:59.047 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-17T23:28:59.047 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-17T23:28:59.047 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 15, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17b61-0.MAI, EstimatedImpact: 0% 2026-09-17T23:28:59.047 ProcessImageName: taskhostw.exe, Pid: 5920, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-17T23:31:04.484 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T23:40:40.020 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T23:40:40.020 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T23:40:40.020 [Cloud] Queued cloud request. 2026-09-17T23:40:40.020 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T23:40:40.207 [Cloud] Dequeued cloud request. 2026-09-17T23:40:40.207 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T23:40:40.395 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B442385A-50D5-F1FD-18D6-EB5764ECB698} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 23:40:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T23:40:40.895 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-17T23:46:09.491 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-17T23:55:32.824 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-17T23:55:32.824 [Cloud] Start of cloud request. Passive mode: 0 2026-09-17T23:55:32.824 [Cloud] Queued cloud request. 2026-09-17T23:55:32.824 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-17T23:55:32.824 [Cloud] Dequeued cloud request. 2026-09-17T23:55:32.824 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-17T23:55:33.011 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D58F8E2C-11B2-BAF9-23BC-5182B6D956F5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-17-2026 23:55:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-17T23:55:33.511 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:01:14.498 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T00:01:34.513 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:01:34.513 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:01:34.513 [Cloud] Queued cloud request. 2026-09-18T00:01:34.513 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:01:34.513 [Cloud] Dequeued cloud request. 2026-09-18T00:01:34.513 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:01:41.654 [Cloud] End of cloud request. 2026-09-18T00:01:42.154 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:10:00.924 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:10:00.924 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:10:00.924 [Cloud] Queued cloud request. 2026-09-18T00:10:00.924 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:10:00.924 [Cloud] Dequeued cloud request. 2026-09-18T00:10:00.924 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:10:01.174 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CC0ABF44-7FC8-2215-AF45-E331566CF554} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 00:10:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T00:10:01.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:10:26.783 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:10:26.783 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:10:26.783 [Cloud] Queued cloud request. 2026-09-18T00:10:26.783 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:10:26.783 [Cloud] Dequeued cloud request. 2026-09-18T00:10:26.783 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:10:26.861 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A2363F6D-856A-0BD8-C06F-4CB895E032E0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 00:10:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T00:10:27.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:10:43.283 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:10:43.283 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:10:43.283 [Cloud] Queued cloud request. 2026-09-18T00:10:43.283 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:10:43.283 [Cloud] Dequeued cloud request. 2026-09-18T00:10:43.283 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:10:43.361 [Cloud] End of cloud request. 2026-09-18T00:10:43.861 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:14:14.097 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:22047DD2-7698-4C2D-8306-24A6F0EF5E0E, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-18T00:14:14.097 Scheduled scan with Id 22047DD2-7698-4C2D-8306-24A6F0EF5E0E configured CPU priority: normal (LowCpuPriority: 0) 2026-09-18T00:14:14.097 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-18T00:14:14.097 [SFC] System file cache build is not needed (already completed) 2026-09-18T00:14:36.769 Engine:Triggered AR EMS scan 2026-09-18T00:14:36.769 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.785 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.800 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.816 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.816 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.832 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.832 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.847 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.863 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.863 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.863 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.878 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.878 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.878 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.894 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.894 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.910 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.925 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.925 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.941 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.941 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.957 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.957 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.957 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.972 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.972 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:36.988 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.003 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.003 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.003 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.019 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.019 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.035 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.050 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.050 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.066 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.066 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.082 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.082 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.097 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.097 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.113 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.113 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.128 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.144 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.144 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.144 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.160 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.175 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.175 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.191 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.207 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.223 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.223 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.238 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.253 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.269 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.285 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.300 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.323 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:37.332 Engine:EMS scan for process: svchost pid: 2580, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-18T00:14:49.863 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:14:49.863 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:14:49.863 [Cloud] Queued cloud request. 2026-09-18T00:14:49.863 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:14:49.863 [Cloud] Dequeued cloud request. 2026-09-18T00:14:49.863 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:14:50.019 [Cloud] End of cloud request. 2026-09-18T00:14:50.519 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:14:57.254 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:14:57.254 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:14:57.254 [Cloud] Queued cloud request. 2026-09-18T00:14:57.254 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:14:57.254 [Cloud] Dequeued cloud request. 2026-09-18T00:14:57.254 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:14:57.363 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{42076FD8-764E-6CD9-26A9-6686EBA6132F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 00:14:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T00:14:57.879 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:15:16.379 QuickScan:ScanID:22047DD2-7698-4C2D-8306-24A6F0EF5E0E: Quick scan finished with error 0 2026-09-18T00:15:16.894 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-18T00:15:16.894 [RTP] Duplicating the current plugin configuration object... 2026-09-18T00:15:16.894 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-18T00:15:16.894 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-18T00:15:16.894 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-18T00:15:16.894 [RTP] No config change detected. Not updating plugin configuration. 2026-09-18T00:15:16.894 [RTP] No config changes found. No configuration switch. 2026-09-18T00:15:16.894 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-18T00:16:19.504 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T00:19:52.038 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:19:52.038 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:19:52.038 [Cloud] Queued cloud request. 2026-09-18T00:19:52.038 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:19:52.038 [Cloud] Dequeued cloud request. 2026-09-18T00:19:52.038 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:19:52.194 [Cloud] End of cloud request. 2026-09-18T00:19:52.710 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:21:34.539 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:21:34.539 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:21:34.539 [Cloud] Queued cloud request. 2026-09-18T00:21:34.539 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:21:34.539 [Cloud] Dequeued cloud request. 2026-09-18T00:21:34.539 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{6012E925-37B3-8BFD-0471-27A697E5B396} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 00:21:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T00:21:34.711 [Cloud] End of cloud request. 2026-09-18T00:21:35.211 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:23:39.259 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:23:39.259 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:23:39.259 [Cloud] Queued cloud request. 2026-09-18T00:23:39.259 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:23:39.259 [Cloud] Dequeued cloud request. 2026-09-18T00:23:39.259 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:23:39.399 [Cloud] End of cloud request. 2026-09-18T00:23:39.899 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:31:24.511 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T00:31:42.386 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:31:42.386 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:31:42.386 [Cloud] Queued cloud request. 2026-09-18T00:31:42.386 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:31:42.386 [Cloud] Dequeued cloud request. 2026-09-18T00:31:42.386 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:31:42.542 [Cloud] End of cloud request. 2026-09-18T00:31:43.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:38:15.734 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:38:15.734 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:38:15.734 [Cloud] Queued cloud request. 2026-09-18T00:38:15.734 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:38:15.734 [Cloud] Dequeued cloud request. 2026-09-18T00:38:15.734 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:38:15.984 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E9C31131-A72E-7B44-156D-7D2940429B7B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 00:38:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T00:38:16.484 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:46:10.798 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:46:10.798 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:46:10.798 [Cloud] Queued cloud request. 2026-09-18T00:46:10.798 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:46:10.798 [Cloud] Dequeued cloud request. 2026-09-18T00:46:10.798 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:46:10.939 [Cloud] End of cloud request. 2026-09-18T00:46:11.439 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:46:29.518 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T00:53:45.739 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:53:45.739 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:53:45.739 [Cloud] Queued cloud request. 2026-09-18T00:53:45.739 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:53:45.895 [Cloud] Dequeued cloud request. 2026-09-18T00:53:45.895 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:53:46.145 [Cloud] End of cloud request. 2026-09-18T00:53:46.661 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:55:11.647 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:55:11.647 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:55:11.647 [Cloud] Queued cloud request. 2026-09-18T00:55:11.647 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:55:11.647 [Cloud] Dequeued cloud request. 2026-09-18T00:55:11.647 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:55:21.773 [Cloud] End of cloud request. 2026-09-18T00:55:22.273 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T00:56:53.273 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T00:56:53.273 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T00:56:53.273 [Cloud] Queued cloud request. 2026-09-18T00:56:53.273 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T00:56:53.273 [Cloud] Dequeued cloud request. 2026-09-18T00:56:53.273 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T00:56:53.445 [Cloud] End of cloud request. 2026-09-18T00:56:53.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T01:00:02.321 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406818, FileId: 0x1800000003e1a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.321 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406817, FileId: 0x1a00000003e1e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.352 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406824, FileId: 0x1a00000003e1a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.352 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406823, FileId: 0x1c00000003e1e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.368 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406831, FileId: 0x1c00000003e1a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.368 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406830, FileId: 0x1e00000003e1e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.368 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406836, FileId: 0x2000000003e1e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.368 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406837, FileId: 0x1e00000003e1a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.383 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406842, FileId: 0x2000000003e1a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.383 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406843, FileId: 0x2200000003e1e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.399 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406848, FileId: 0x2400000003e1e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.399 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406849, FileId: 0x2200000003e1a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.415 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406854, FileId: 0x2600000003e1e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.415 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406855, FileId: 0x2400000003e1a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.430 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406860, FileId: 0x2800000003e1e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.430 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406861, FileId: 0x2600000003e1a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.446 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406866, FileId: 0x2a00000003e1e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.446 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406867, FileId: 0x2800000003e1a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.462 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406873, FileId: 0x2a00000003e1a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.462 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406872, FileId: 0x2c00000003e1e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.477 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406879, FileId: 0x2c00000003e1a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.477 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406878, FileId: 0x2e00000003e1e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.477 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406885, FileId: 0x2e00000003e1a9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:00:02.477 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1882f-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #7406884, FileId: 0x3000000003e1e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-18T01:01:34.524 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T01:11:55.998 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T01:11:55.998 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T01:11:55.998 [Cloud] Queued cloud request. 2026-09-18T01:11:55.998 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T01:11:55.998 [Cloud] Dequeued cloud request. 2026-09-18T01:11:55.998 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T01:11:56.154 [Cloud] End of cloud request. 2026-09-18T01:11:56.670 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T01:16:30.469 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T01:16:30.469 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T01:16:30.469 [Cloud] Queued cloud request. 2026-09-18T01:16:30.469 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T01:16:30.469 [Cloud] Dequeued cloud request. 2026-09-18T01:16:30.469 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T01:16:30.609 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C8AF4CE1-C8CD-618D-45FE-5509B381542C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 01:16:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T01:16:31.125 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T01:16:39.531 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T01:19:27.236 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T01:19:27.236 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T01:19:27.236 [Cloud] Queued cloud request. 2026-09-18T01:19:27.236 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T01:19:27.236 [Cloud] Dequeued cloud request. 2026-09-18T01:19:27.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T01:19:27.377 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{520A00E3-2559-65E6-573E-6A821BF0405F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 01:19:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T01:19:27.877 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T01:20:15.611 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T01:20:15.611 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T01:20:15.611 [Cloud] Queued cloud request. 2026-09-18T01:20:15.611 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T01:20:15.611 [Cloud] Dequeued cloud request. 2026-09-18T01:20:15.611 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T01:20:15.690 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DF64A498-B7C3-F675-5D46-5EEC49CDE779} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 01:20:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T01:20:16.205 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T01:28:59.116 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 12018, Count: 847, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-18T01:28:59.116 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 5705, Count: 470, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-09-18T01:28:59.116 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 1786, Count: 130, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-18T01:28:59.116 ProcessImageName: powershell.exe, Pid: 1948, TotalTime: 1614, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-18T01:28:59.116 ProcessImageName: WmiPrvSE.exe, Pid: 5636, TotalTime: 947, Count: 58, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 0% 2026-09-18T01:28:59.116 ProcessImageName: AgentShellService.exe, Pid: 2516, TotalTime: 744, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 55% 2026-09-18T01:28:59.116 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 301, Count: 27, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-18T01:28:59.116 ProcessImageName: WmiPrvSE.exe, Pid: 7928, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\ndis.sys, EstimatedImpact: 100% 2026-09-18T01:28:59.116 ProcessImageName: upfc.exe, Pid: 6468, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml, EstimatedImpact: 100% 2026-09-18T01:28:59.116 ProcessImageName: taskhostw.exe, Pid: 5508, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-18T01:28:59.116 ProcessImageName: mysqldump.exe, Pid: 2264, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 14% 2026-09-18T01:28:59.116 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17b61-0.MAI, EstimatedImpact: 0% 2026-09-18T01:28:59.116 ProcessImageName: powershell.exe, Pid: 2224, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-18T01:28:59.116 ProcessImageName: DeviceCensus.exe, Pid: 6356, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 3% 2026-09-18T01:28:59.116 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-18T01:28:59.116 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-18T01:28:59.116 ProcessImageName: powershell.exe, Pid: 1708, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp1C25.tmp, EstimatedImpact: 0% 2026-09-18T01:28:59.116 ProcessImageName: taskhostw.exe, Pid: 5920, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-18T01:28:59.116 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-18T01:31:44.537 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T01:32:37.522 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T01:32:37.522 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T01:32:37.522 [Cloud] Queued cloud request. 2026-09-18T01:32:37.522 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T01:32:37.522 [Cloud] Dequeued cloud request. 2026-09-18T01:32:37.522 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T01:32:37.678 [Cloud] End of cloud request. 2026-09-18T01:32:38.178 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T01:46:49.545 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T01:54:26.532 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T01:54:26.532 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T01:54:26.532 [Cloud] Queued cloud request. 2026-09-18T01:54:26.532 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T01:54:26.532 [Cloud] Dequeued cloud request. 2026-09-18T01:54:26.532 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T01:54:26.673 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{08E6B3B2-E85A-05BD-C574-9B285F98CB33} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 01:54:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T01:54:27.188 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T02:01:54.551 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T02:03:04.489 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T02:03:04.489 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T02:03:04.489 [Cloud] Queued cloud request. 2026-09-18T02:03:04.489 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T02:03:04.489 [Cloud] Dequeued cloud request. 2026-09-18T02:03:04.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T02:03:04.629 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{01D6CA07-6FFA-C4FA-0DA2-2AE8F892224B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 02:03:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T02:03:05.145 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T02:04:25.442 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T02:04:25.442 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T02:04:25.442 [Cloud] Queued cloud request. 2026-09-18T02:04:25.442 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T02:04:25.442 [Cloud] Dequeued cloud request. 2026-09-18T02:04:25.442 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T02:04:28.379 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{53D2F4F9-DDF9-A026-2D64-7B0EA927A7BC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 02:04:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T02:04:28.895 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T02:06:01.819 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T02:06:01.819 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T02:06:01.819 [Cloud] Queued cloud request. 2026-09-18T02:06:01.819 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T02:06:01.819 [Cloud] Dequeued cloud request. 2026-09-18T02:06:01.819 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T02:06:02.022 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{38575130-463B-A346-3389-5484FAE84984} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 02:06:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T02:06:02.538 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T02:11:57.648 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T02:11:57.648 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T02:11:57.648 [Cloud] Queued cloud request. 2026-09-18T02:11:57.648 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T02:11:57.648 [Cloud] Dequeued cloud request. 2026-09-18T02:11:57.648 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T02:11:57.836 [Cloud] End of cloud request. 2026-09-18T02:11:58.352 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T02:13:46.227 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T02:13:46.227 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T02:13:46.227 [Cloud] Queued cloud request. 2026-09-18T02:13:46.227 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T02:13:46.227 [Cloud] Dequeued cloud request. 2026-09-18T02:13:46.227 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T02:13:46.430 [Cloud] End of cloud request. 2026-09-18T02:13:46.946 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T02:16:59.558 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T02:22:14.232 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T02:22:14.232 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T02:22:14.232 [Cloud] Queued cloud request. 2026-09-18T02:22:14.232 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T02:22:14.232 [Cloud] Dequeued cloud request. 2026-09-18T02:22:14.232 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T02:22:14.388 [Cloud] End of cloud request. 2026-09-18T02:22:14.888 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T02:22:26.919 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T02:22:26.919 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T02:22:26.919 [Cloud] Queued cloud request. 2026-09-18T02:22:26.919 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T02:22:26.919 [Cloud] Dequeued cloud request. 2026-09-18T02:22:26.919 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T02:22:27.013 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{87A32FC9-61DA-D68C-E08D-1370431BA252} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 02:22:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T02:22:27.528 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T02:32:04.564 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T02:47:09.570 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T02:48:57.259 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T02:48:57.259 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T02:48:57.259 [Cloud] Queued cloud request. 2026-09-18T02:48:57.259 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T02:48:57.259 [Cloud] Dequeued cloud request. 2026-09-18T02:48:57.259 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T02:48:57.431 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9C954A0C-622E-7E0D-F89C-90A841E8F08B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 02:48:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T02:48:57.947 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:00:11.139 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:00:11.139 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:00:11.139 [Cloud] Queued cloud request. 2026-09-18T03:00:11.139 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:00:11.139 [Cloud] Dequeued cloud request. 2026-09-18T03:00:11.139 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:00:11.404 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E81B8D30-D6FE-A77F-6D2E-271F4CB16791} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 03:00:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T03:00:11.904 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:00:24.389 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:00:24.389 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:00:24.389 [Cloud] Queued cloud request. 2026-09-18T03:00:24.389 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:00:24.389 [Cloud] Dequeued cloud request. 2026-09-18T03:00:24.389 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:00:24.483 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1B1A47DD-1384-AF8C-9C87-011293D16C46} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 03:00:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T03:00:24.983 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:02:14.576 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T03:04:22.610 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:04:22.610 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:04:22.610 [Cloud] Queued cloud request. 2026-09-18T03:04:22.610 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:04:22.610 [Cloud] Dequeued cloud request. 2026-09-18T03:04:22.610 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:04:22.797 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B92A033C-0ECB-B90A-A063-77FF1D39B2D4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 03:04:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T03:04:23.297 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:05:39.329 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:05:39.329 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:05:39.329 [Cloud] Queued cloud request. 2026-09-18T03:05:39.329 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:05:39.329 [Cloud] Dequeued cloud request. 2026-09-18T03:05:39.329 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:05:39.470 [Cloud] End of cloud request. 2026-09-18T03:05:39.970 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:07:07.025 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-18T03:07:07.079 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-18T03:07:07.079 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-18T03:07:07.079 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-18T03:07:07.079 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-18T03:07:07.079 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-18T03:07:07.079 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.095 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.126 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.126 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.126 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.142 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.157 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.157 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-18T03:07:07.157 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.157 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.157 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.157 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.157 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.173 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.173 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.173 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.173 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.173 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.188 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.188 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.188 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.188 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-18T03:07:07.188 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.188 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.204 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.204 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.204 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.204 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.225 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.225 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.235 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-18T03:07:07.235 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.235 [AutoPurge] Removing expired default signature package ... 2026-09-18T03:07:07.235 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.235 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.235 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.235 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.251 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.251 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.267 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.267 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.267 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.267 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.267 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.267 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.282 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.282 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.282 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.282 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.298 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.325 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.329 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.329 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.329 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.345 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.360 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.360 [AutoPurge] Cleanup Routine tasks have started. 2026-09-18T03:07:07.376 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-18T03:07:07.376 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-18T03:07:07.376 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-18-2026 03:07:07 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-18-2026 03:07:07 2026-09-18T03:07:07.392 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-18T03:07:07.392 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-18T03:07:07.392 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-18T03:07:07.392 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-18T03:07:07.392 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-18T03:07:07.392 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.407 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.425 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.454 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.470 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.485 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.485 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.501 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.501 Engine:EMS scan for process: svchost pid: 1228, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.501 Engine:EMS scan for process: svchost pid: 2672, sigseq: 0x0, sendMemoryScanReport: 0, source: 18 2026-09-18T03:07:07.548 Job Notification: New process added to job (7588) 2026-09-18T03:07:08.267 Job Notification: Process exited from job (7588) 2026-09-18T03:07:08.329 [AutoPurge] Verification Routine tasks have ended. 2026-09-18T03:07:09.407 QuickScan:ScanID:D4D2FE38-E43E-38B8-EF49-9A6CE08C3D5F: Quick scan finished with error 0 2026-09-18T03:07:09.501 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-18T03:07:09.735 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-18T03:07:09.845 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-18T03:07:10.204 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:07:10.735 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-18T03:07:10.845 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-18T03:07:11.329 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-18T03:07:11.407 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-18T03:07:11.548 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-18T03:07:13.173 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:13.548 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-18T03:07:13.829 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-18T03:07:13.845 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:14.048 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-18T03:07:14.641 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-18T03:07:15.251 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-18T03:07:15.360 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-18T03:07:15.470 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-18T03:07:15.688 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:07:15.845 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-18T03:07:16.188 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-18T03:07:16.298 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-18T03:07:16.454 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:16.579 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:16.626 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:16.641 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-18T03:07:16.813 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:07:16.876 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-18T03:07:16.923 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-18T03:07:16.970 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-18T03:07:17.095 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-18T03:07:17.438 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:17.470 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-18T03:07:17.860 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:07:18.001 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-18T03:07:18.595 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-18T03:07:19.063 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:19.220 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:07:19.517 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-18T03:07:19.939 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-18T03:07:20.017 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-18T03:07:20.407 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-18T03:07:20.532 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:21.048 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:07:21.173 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-18T03:07:21.173 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-18T03:07:21.236 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-18T03:07:21.423 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-18T03:07:21.501 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-18T03:07:21.548 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:21.611 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-18T03:07:21.829 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-18T03:07:22.204 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-18T03:07:22.439 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-18T03:07:22.939 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-18T03:07:24.220 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-18T03:07:24.705 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-18T03:07:24.720 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-18T03:07:24.751 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-18T03:07:24.751 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-18T03:07:24.783 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-18T03:07:24.908 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-18T03:07:25.126 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-18T03:07:25.158 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:25.220 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-18T03:07:25.595 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-18T03:07:25.642 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-18T03:07:25.642 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-18T03:07:25.689 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-18T03:07:26.173 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:26.345 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:26.377 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-18T03:07:26.408 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-18T03:07:26.439 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:26.861 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-18T03:07:27.205 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-18T03:07:27.220 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:27.908 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-18T03:07:27.923 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-18T03:07:28.564 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:07:28.908 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-18T03:07:29.299 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-18T03:07:29.439 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:29.595 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:29.752 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-18T03:07:29.955 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-18T03:07:30.017 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-18T03:07:30.064 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:30.533 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-18T03:07:30.830 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-18T03:07:30.861 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-18T03:07:30.924 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:07:31.267 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:07:31.361 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.269.9\psmachine_64.dll", hr=0x0 2026-09-18T03:07:31.471 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-18T03:07:31.564 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-18T03:07:31.705 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-18T03:07:31.736 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-18T03:07:31.814 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-18T03:07:32.346 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-18T03:07:32.767 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-18T03:07:32.877 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-18T03:07:32.986 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-18T03:07:33.580 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-18T03:07:33.627 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:33.939 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-18T03:07:34.049 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-18T03:07:34.049 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-18T03:07:34.096 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-18T03:07:34.189 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-18T03:07:34.236 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-18T03:07:34.268 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-18T03:07:34.502 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.269.9\microsoftedgeupdatesetup_x86_1.3.269.9.exe", hr=0x0 2026-09-18T03:07:34.596 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-18T03:07:34.596 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-18T03:07:34.924 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-18T03:07:35.111 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:35.221 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-18T03:07:35.221 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-18T03:07:35.471 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:07:35.736 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-18T03:07:36.111 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:07:36.439 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-18T03:07:36.580 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-18T03:07:36.924 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-18T03:07:36.939 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:37.096 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-18T03:07:37.221 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-18T03:07:37.736 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-18T03:07:37.799 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-18T03:07:38.002 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:38.018 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-18T03:07:38.205 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-18T03:07:38.268 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-18T03:07:38.471 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:07:38.799 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:07:38.940 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-18T03:07:38.986 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-18T03:07:39.674 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-18T03:07:39.690 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-18T03:07:39.940 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-18T03:07:40.096 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-18T03:07:40.408 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-18T03:07:41.033 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:07:41.221 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-18T03:07:41.643 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-18T03:07:41.940 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-18T03:07:42.096 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-18T03:07:42.127 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:42.143 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-18T03:07:42.252 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-18T03:07:42.455 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-18T03:07:42.799 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-18T03:07:42.861 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-18T03:07:43.065 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-18T03:07:43.299 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-18T03:07:43.346 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-18T03:07:43.643 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:07:43.862 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-18T03:07:44.049 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-18T03:07:44.752 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:07:44.830 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-18T03:07:44.908 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-18T03:07:44.955 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-18T03:07:45.830 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-18T03:07:45.908 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-18T03:07:46.002 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-18T03:07:46.127 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-18T03:07:46.330 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-18T03:07:46.487 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-18T03:07:47.174 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-18T03:07:47.221 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-18T03:07:47.237 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-18T03:07:47.299 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-18T03:07:47.408 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-18T03:07:47.705 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-18T03:07:47.862 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-18T03:07:47.877 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-18T03:07:47.908 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-18T03:07:47.987 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:48.033 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-18T03:07:48.065 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-18T03:07:48.393 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-18T03:07:48.518 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-18T03:07:48.783 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-18T03:07:48.908 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:49.143 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-18T03:07:49.502 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-18T03:07:49.565 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-18T03:07:49.737 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-18T03:07:50.158 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-18T03:07:50.205 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-18T03:07:50.284 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:07:50.440 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:07:50.627 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-18T03:07:50.690 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-18T03:07:50.877 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:07:51.018 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-18T03:07:51.096 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:07:51.362 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:07:51.409 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-18T03:07:51.455 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-18T03:07:51.627 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-18T03:07:51.674 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-18T03:07:51.674 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-18T03:07:52.112 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-18T03:07:52.174 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:52.205 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-18T03:07:52.284 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:07:52.487 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:07:52.612 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-18T03:07:53.190 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-18T03:07:53.299 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-18T03:07:53.362 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-18T03:07:53.627 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-18T03:07:53.659 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-18T03:07:53.721 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-18T03:07:54.034 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-18T03:07:54.080 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-18T03:07:54.424 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-18T03:07:54.487 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-18T03:07:54.534 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-18T03:07:54.549 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:54.565 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:54.596 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:07:54.596 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-18T03:07:54.627 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:55.205 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-18T03:07:55.502 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-18T03:07:55.784 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:07:55.830 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-18T03:07:56.096 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:56.127 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:07:56.252 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-18T03:07:56.565 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:56.580 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-18T03:07:56.768 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-18T03:07:56.784 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-18T03:07:56.909 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-18T03:07:57.002 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-18T03:07:57.002 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-18T03:07:57.252 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-18T03:07:57.284 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-18T03:07:57.284 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-18T03:07:57.440 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-18T03:07:57.643 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:57.815 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-18T03:07:58.159 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\winsxs\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.20348.3692_none_ea9c313aecda491b\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-18T03:07:58.315 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-18T03:07:58.455 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-18T03:07:58.690 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-18T03:07:58.846 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-18T03:07:58.846 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-18T03:07:58.862 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:07:59.065 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-18T03:07:59.080 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-18T03:07:59.299 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-18T03:07:59.455 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-18T03:07:59.455 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-18T03:08:00.205 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:08:00.205 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-18T03:08:00.315 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-18T03:08:00.424 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:08:00.440 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:08:01.237 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:01.690 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-18T03:08:01.877 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:01.893 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-18T03:08:02.080 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:02.096 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-18T03:08:02.221 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-18T03:08:02.346 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-18T03:08:02.393 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-18T03:08:02.690 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-18T03:08:02.721 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:02.987 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:08:03.002 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:03.049 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-18T03:08:03.612 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-18T03:08:04.159 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-18T03:08:04.205 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:04.252 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-18T03:08:04.362 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:04.565 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:04.627 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-18T03:08:04.940 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-18T03:08:05.440 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:05.456 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-18T03:08:05.690 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:08:05.830 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-18T03:08:06.018 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-18T03:08:06.034 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:06.299 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-18T03:08:06.674 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-18T03:08:06.721 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:06.831 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:06.956 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-18T03:08:06.987 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-18T03:08:07.362 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-18T03:08:07.471 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:07.643 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-18T03:08:07.674 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-18T03:08:07.690 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:07.737 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:07.893 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-18T03:08:07.956 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:08.362 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-18T03:08:08.471 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-18T03:08:09.034 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-18T03:08:09.096 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-18T03:08:09.174 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-18T03:08:09.268 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-18T03:08:09.315 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:09.331 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-18T03:08:09.377 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-18T03:08:09.846 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-18T03:08:10.034 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-18T03:08:10.299 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-18T03:08:10.299 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-18T03:08:10.643 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-18T03:08:10.643 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:10.956 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-18T03:08:11.284 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-18T03:08:11.596 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-18T03:08:11.659 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-18T03:08:11.737 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-18T03:08:11.784 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:11.893 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-18T03:08:11.940 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-18T03:08:11.987 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-18T03:08:12.096 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-18T03:08:12.456 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-18T03:08:12.502 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:08:12.549 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:08:12.987 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-18T03:08:13.081 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:08:13.252 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-18T03:08:13.487 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-18T03:08:13.752 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-18T03:08:13.768 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:14.112 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-18T03:08:14.112 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-18T03:08:14.159 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-18T03:08:14.393 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-18T03:08:14.627 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-18T03:08:14.643 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-18T03:08:14.956 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-18T03:08:15.034 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-18T03:08:15.143 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-18T03:08:15.221 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:15.252 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-18T03:08:15.377 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-18T03:08:15.581 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-18T03:08:15.768 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-18T03:08:15.846 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-18T03:08:16.034 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-18T03:08:17.331 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-18T03:08:17.784 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-18T03:08:17.940 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-18T03:08:18.190 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:18.424 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-18T03:08:18.596 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-18T03:08:18.862 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-18T03:08:19.127 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-18T03:08:19.221 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-18T03:08:19.252 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-18T03:08:19.252 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-18T03:08:19.331 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:08:19.331 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:08:19.331 [Cloud] Queued cloud request. 2026-09-18T03:08:19.331 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:08:19.331 [Cloud] Dequeued cloud request. 2026-09-18T03:08:19.331 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:08:19.377 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-18T03:08:19.487 [Cloud] End of cloud request. 2026-09-18T03:08:19.659 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-18T03:08:19.674 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:19.674 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-18T03:08:19.752 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-18T03:08:19.768 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-18T03:08:19.877 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-18T03:08:19.987 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-18T03:08:20.018 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-18T03:08:20.018 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-18T03:08:20.018 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-18T03:08:20.018 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-18T03:08:20.018 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-18T03:08:20.018 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-18T03:08:20.018 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-18T03:08:20.018 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-18T03:08:20.018 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-18T03:08:20.018 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-18T03:08:20.018 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-18T03:08:20.018 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-18T03:08:20.018 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-18T03:08:20.018 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-18T03:08:20.018 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-18T03:08:20.018 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-18T03:08:20.018 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-18T03:08:20.018 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-18T03:08:20.018 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-18T03:08:20.018 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-18T03:08:20.018 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:08:20.034 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:08:20.034 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:08:20.034 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:08:20.034 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:08:20.252 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-18T03:08:20.346 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-18T03:08:20.534 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-18T03:08:20.549 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:20.659 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-18T03:08:20.659 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-18T03:08:20.862 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-18T03:08:20.924 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:08:21.190 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-18T03:08:21.487 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-18T03:08:21.940 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:22.377 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-18T03:08:22.456 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-18T03:08:22.596 [RTP] Duplicating the current plugin configuration object... 2026-09-18T03:08:22.596 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-18T03:08:22.596 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-18T03:08:22.596 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-18T03:08:22.596 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-18T03:08:22.596 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-18T03:08:22.893 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-18T03:08:23.268 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:08:23.362 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:23.627 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-18T03:08:23.877 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-18T03:08:23.956 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-18T03:08:24.112 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-18T03:08:24.268 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-18T03:08:24.690 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-18T03:08:25.424 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-18T03:08:25.487 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-18T03:08:25.581 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-18T03:08:26.174 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-18T03:08:26.284 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-18T03:08:26.549 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-18T03:08:26.627 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-18T03:08:26.721 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-18T03:08:26.737 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-18T03:08:27.190 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-18T03:08:27.284 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-18T03:08:27.299 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:27.331 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-18T03:08:27.612 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-18T03:08:27.627 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:08:27.831 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-18T03:08:27.956 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-18T03:08:28.252 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-18T03:08:28.737 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-18T03:08:28.831 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:08:29.034 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:29.206 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-18T03:08:29.534 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:29.612 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-18T03:08:29.799 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-18T03:08:29.956 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-18T03:08:30.096 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:30.221 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-18T03:08:30.440 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-18T03:08:30.799 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-18T03:08:30.846 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-18T03:08:30.877 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-18T03:08:31.018 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:31.065 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-18T03:08:31.393 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-18T03:08:31.565 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-18T03:08:31.674 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:32.643 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-18T03:08:33.221 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-18T03:08:33.252 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-18T03:08:33.315 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-18T03:08:33.362 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-18T03:08:33.674 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:33.721 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-18T03:08:33.909 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-18T03:08:34.002 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-18T03:08:34.065 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-18T03:08:34.143 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:34.221 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-18T03:08:34.409 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-18T03:08:34.471 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-18T03:08:34.799 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-18T03:08:34.862 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-18T03:08:34.940 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:34.940 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-18T03:08:34.956 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-18T03:08:34.971 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-18T03:08:35.096 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-18T03:08:35.096 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:08:35.127 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-18T03:08:35.174 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-18T03:08:35.565 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-18T03:08:35.581 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-18T03:08:35.909 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:08:35.971 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-18T03:08:35.987 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-18T03:08:36.018 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-18T03:08:36.815 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-18T03:08:36.940 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:08:37.127 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:08:37.127 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-18T03:08:37.299 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-18T03:08:37.487 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-18T03:08:37.596 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-18T03:08:37.674 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:38.393 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-18T03:08:38.424 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-18T03:08:38.565 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-18T03:08:38.581 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-18T03:08:38.581 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:08:39.034 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:08:39.034 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-18T03:08:39.174 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-18T03:08:39.190 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-18T03:08:39.346 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-18T03:08:39.737 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-18T03:08:40.143 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-18T03:08:40.362 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:40.737 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-18T03:08:40.956 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-18T03:08:41.002 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-18T03:08:41.159 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-18T03:08:41.190 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-18T03:08:41.268 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-18T03:08:41.362 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-18T03:08:41.440 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-18T03:08:41.456 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:08:41.690 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-18T03:08:41.768 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-18T03:08:42.049 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-18T03:08:42.159 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:08:42.315 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-18T03:08:42.331 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:08:42.456 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\de-de\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:42.596 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-console-l1-1-0.dll", hr=0x0 2026-09-18T03:08:42.737 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0 2026-09-18T03:08:42.737 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-registry-l2-1-0.dll", hr=0x0 2026-09-18T03:08:43.049 Engine:Setting original file name "MrmCore.dll" for "c:\windows\winsxs\wow64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.20348.5020_none_9e6a80bbc86408d7\mrmcorer.dll", hr=0x0 2026-09-18T03:08:43.049 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:43.174 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_en-gb_56416fd74780e848\vsswmi.dll.mui", hr=0x0 2026-09-18T03:08:43.174 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\es-es\aerolite.msstyles.mui", hr=0x0 2026-09-18T03:08:43.331 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_7573f1c6d4639f87\penimc.dll", hr=0x0 2026-09-18T03:08:43.346 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.data.winmd", hr=0x0 2026-09-18T03:08:43.518 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\de-de\ndisimplatcim.dll.mui", hr=0x0 2026-09-18T03:08:43.581 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_4e347e352039867c\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:43.690 Engine:Setting original file name "winsqlite3" for "c:\windows\winsxs\wow64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.20348.4647_none_c9096b99901f19cd\winsqlite3.dll", hr=0x0 2026-09-18T03:08:43.721 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0 2026-09-18T03:08:43.721 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000c.dll", hr=0x0 2026-09-18T03:08:44.049 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-1-0.dll", hr=0x0 2026-09-18T03:08:44.065 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata000a.dll", hr=0x0 2026-09-18T03:08:44.331 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-2-0.dll", hr=0x0 2026-09-18T03:08:44.424 Engine:Setting original file name "wmic.exe" for "c:\windows\winsxs\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.20348.2849_none_54405a5933961199\wmic.exe", hr=0x0 2026-09-18T03:08:44.581 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.storage.winmd", hr=0x0 2026-09-18T03:08:44.877 Engine:Setting original file name "CRYPT32.DLL" for "c:\windows\systemresources\crypt32.dll.mun", hr=0x0 2026-09-18T03:08:45.096 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_7d8ffbc5cb37c8e0\bootmgr.exe.mui", hr=0x0 2026-09-18T03:08:45.159 Engine:Setting original file name "mstsc.exe" for "c:\windows\systemresources\mstsc.exe.mun", hr=0x0 2026-09-18T03:08:45.346 Engine:Setting original file name "SYSTEMCPL.DLL" for "c:\windows\systemresources\systemcpl.dll.mun", hr=0x0 2026-09-18T03:08:45.393 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0 2026-09-18T03:08:45.534 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1e6e07718388e886\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:45.581 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0 2026-09-18T03:08:46.206 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0 2026-09-18T03:08:46.206 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mpg4decd_31bf3856ad364e35_10.0.20348.2849_none_08e768f194682e23\mpg4decd.dll", hr=0x0 2026-09-18T03:08:46.221 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0 2026-09-18T03:08:46.268 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0 2026-09-18T03:08:46.471 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-1.dll", hr=0x0 2026-09-18T03:08:46.471 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\naturallanguage6.dll", hr=0x0 2026-09-18T03:08:46.909 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0 2026-09-18T03:08:47.127 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0 2026-09-18T03:08:47.393 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ja-jp_5634cc97d85965d9\bootmgr_ex.efi.mui", hr=0x0 2026-09-18T03:08:47.393 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0 2026-09-18T03:08:47.612 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_d7c56d20c9fb1c22\diagpackage.dll.mui", hr=0x0 2026-09-18T03:08:47.862 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:47.956 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mpg4decd.dll", hr=0x0 2026-09-18T03:08:48.143 Engine:Setting original file name "SYSMON.OCX" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\sysmon.ocx.mun", hr=0x0 2026-09-18T03:08:48.190 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgfw_ex.efi.mui", hr=0x0 2026-09-18T03:08:48.206 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\uk-ua\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:08:48.456 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgfw.efi.mui", hr=0x0 2026-09-18T03:08:48.502 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-profile-l1-1-0.dll", hr=0x0 2026-09-18T03:08:48.581 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-convert-l1-1-0.dll", hr=0x0 2026-09-18T03:08:48.721 OriginalFileName Maintenance::28329 files in Moac, 0 skipped (cached), 545 filename set 2026-09-18T03:08:48.721 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-18T03:14:40.052 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:14:40.052 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:14:40.052 [Cloud] Queued cloud request. 2026-09-18T03:14:40.052 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:14:40.052 [Cloud] Dequeued cloud request. 2026-09-18T03:14:40.052 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:14:50.130 [Cloud] End of cloud request. 2026-09-18T03:14:50.646 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:17:19.584 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T03:26:32.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:26:32.088 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:26:32.088 [Cloud] Queued cloud request. 2026-09-18T03:26:32.088 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:26:32.088 [Cloud] Dequeued cloud request. 2026-09-18T03:26:32.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:26:32.244 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9C09D586-18D2-DD10-7084-0056DD6BB12F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 03:26:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T03:26:32.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:28:59.183 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 13705, Count: 931, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-18T03:28:59.183 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 5705, Count: 470, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-09-18T03:28:59.183 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 3904, Count: 311, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-18T03:28:59.183 ProcessImageName: powershell.exe, Pid: 1948, TotalTime: 1614, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-18T03:28:59.183 ProcessImageName: WmiPrvSE.exe, Pid: 5636, TotalTime: 947, Count: 58, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 0% 2026-09-18T03:28:59.183 ProcessImageName: php.exe, Pid: 7824, TotalTime: 801, Count: 21, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-18T03:28:59.183 ProcessImageName: AgentShellService.exe, Pid: 2516, TotalTime: 744, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 55% 2026-09-18T03:28:59.183 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 361, Count: 31, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-18T03:28:59.183 ProcessImageName: WmiPrvSE.exe, Pid: 7928, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\ndis.sys, EstimatedImpact: 100% 2026-09-18T03:28:59.183 ProcessImageName: upfc.exe, Pid: 6468, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml, EstimatedImpact: 100% 2026-09-18T03:28:59.183 ProcessImageName: taskhostw.exe, Pid: 5508, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-18T03:28:59.183 ProcessImageName: mysqldump.exe, Pid: 2264, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 14% 2026-09-18T03:28:59.183 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17b61-0.MAI, EstimatedImpact: 0% 2026-09-18T03:28:59.183 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-18T03:28:59.183 ProcessImageName: powershell.exe, Pid: 2224, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-18T03:28:59.183 ProcessImageName: DeviceCensus.exe, Pid: 6356, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 3% 2026-09-18T03:28:59.183 ProcessImageName: cmd.exe, Pid: 2732, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-18T03:28:59.183 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-18T03:28:59.183 ProcessImageName: powershell.exe, Pid: 1708, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp1C25.tmp, EstimatedImpact: 0% 2026-09-18T03:28:59.183 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-18T03:28:59.183 ProcessImageName: taskhostw.exe, Pid: 5920, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-18T03:30:27.058 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:30:27.058 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:30:27.058 [Cloud] Queued cloud request. 2026-09-18T03:30:27.058 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:30:27.058 [Cloud] Dequeued cloud request. 2026-09-18T03:30:27.058 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:30:37.152 [Cloud] End of cloud request. 2026-09-18T03:30:37.667 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:30:48.917 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:30:48.917 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:30:48.917 [Cloud] Queued cloud request. 2026-09-18T03:30:48.917 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:30:48.917 [Cloud] Dequeued cloud request. 2026-09-18T03:30:48.917 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:30:48.995 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A132E1C2-E497-F1FD-224A-818DBD2876DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 03:30:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T03:30:49.511 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:32:24.589 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T03:42:09.485 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:42:09.485 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:42:09.485 [Cloud] Queued cloud request. 2026-09-18T03:42:09.485 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:42:09.485 [Cloud] Dequeued cloud request. 2026-09-18T03:42:09.485 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:42:09.642 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{418FB3F5-65E0-0DC9-71EE-86FF3E0D4E9E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 03:42:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T03:42:10.142 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:46:07.361 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:46:07.361 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:46:07.361 [Cloud] Queued cloud request. 2026-09-18T03:46:07.361 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:46:07.361 [Cloud] Dequeued cloud request. 2026-09-18T03:46:07.361 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:46:07.517 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2CA2A230-E0E2-253C-EE9C-77BB9553D151} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 03:46:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T03:46:08.033 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:47:29.597 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T03:50:40.661 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:50:40.661 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:50:40.661 [Cloud] Queued cloud request. 2026-09-18T03:50:40.661 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:50:40.661 [Cloud] Dequeued cloud request. 2026-09-18T03:50:40.661 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:50:40.833 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{10B780B0-D451-EE24-618C-3C19AD01802A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 03:50:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T03:50:41.348 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:52:30.536 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:52:30.536 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:52:30.536 [Cloud] Queued cloud request. 2026-09-18T03:52:30.536 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:52:30.536 [Cloud] Dequeued cloud request. 2026-09-18T03:52:30.536 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:52:30.677 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E1DF75A6-B8BA-BEAD-9B0F-00DDD3CB4919} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 03:52:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T03:52:31.192 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T03:59:30.962 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T03:59:30.962 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T03:59:30.962 [Cloud] Queued cloud request. 2026-09-18T03:59:30.962 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T03:59:30.962 [Cloud] Dequeued cloud request. 2026-09-18T03:59:30.962 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T03:59:31.181 [Cloud] End of cloud request. 2026-09-18T03:59:31.696 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T04:02:34.603 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T04:04:32.261 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T04:04:32.261 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T04:04:32.261 [Cloud] Queued cloud request. 2026-09-18T04:04:32.261 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T04:04:32.261 [Cloud] Dequeued cloud request. 2026-09-18T04:04:32.261 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T04:04:32.495 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F9720E7-0759-DB8E-8E37-9B3EE5AA300E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 04:04:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T04:04:32.995 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T04:10:56.216 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T04:10:56.216 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T04:10:56.216 [Cloud] Queued cloud request. 2026-09-18T04:10:56.216 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T04:10:56.216 [Cloud] Dequeued cloud request. 2026-09-18T04:10:56.216 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T04:10:56.404 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7B3315E3-3E16-8B91-A688-782CEC010795} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 04:10:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T04:10:56.904 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T04:17:39.611 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T04:25:01.565 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T04:25:01.565 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T04:25:01.565 [Cloud] Queued cloud request. 2026-09-18T04:25:01.565 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T04:25:01.565 [Cloud] Dequeued cloud request. 2026-09-18T04:25:01.565 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T04:25:01.721 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{886CC730-74F1-B41B-9A58-EB35EE85D82B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 04:25:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T04:25:02.221 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T04:29:01.225 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T04:29:01.225 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T04:29:01.225 [Cloud] Queued cloud request. 2026-09-18T04:29:01.225 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T04:29:01.225 [Cloud] Dequeued cloud request. 2026-09-18T04:29:01.225 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T04:29:01.366 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B26CF686-70A8-20C9-1987-54D147954FC9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 04:29:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T04:29:01.866 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T04:32:44.616 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T04:36:48.228 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T04:36:48.228 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T04:36:48.228 [Cloud] Queued cloud request. 2026-09-18T04:36:48.228 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T04:36:48.228 [Cloud] Dequeued cloud request. 2026-09-18T04:36:48.228 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T04:36:48.385 [Cloud] End of cloud request. 2026-09-18T04:36:48.885 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T04:47:49.624 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T04:51:55.827 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T04:51:55.827 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T04:51:55.827 [Cloud] Queued cloud request. 2026-09-18T04:51:55.827 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T04:51:55.999 [Cloud] Dequeued cloud request. 2026-09-18T04:51:55.999 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T04:51:56.187 [Cloud] End of cloud request. 2026-09-18T04:51:56.702 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T04:54:56.218 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T04:54:56.218 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T04:54:56.218 [Cloud] Queued cloud request. 2026-09-18T04:54:56.218 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T04:54:56.218 [Cloud] Dequeued cloud request. 2026-09-18T04:54:56.218 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T04:54:56.484 [Cloud] End of cloud request. 2026-09-18T04:54:56.999 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T05:02:54.628 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T05:05:05.818 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T05:05:05.818 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T05:05:05.818 [Cloud] Queued cloud request. 2026-09-18T05:05:05.818 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T05:05:05.818 [Cloud] Dequeued cloud request. 2026-09-18T05:05:05.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T05:05:06.037 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{962288F1-9A06-AC1B-AB8D-45CDB88A433F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 05:05:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T05:05:06.537 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T05:06:01.006 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T05:06:01.006 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T05:06:01.006 [Cloud] Queued cloud request. 2026-09-18T05:06:01.006 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T05:06:01.006 [Cloud] Dequeued cloud request. 2026-09-18T05:06:01.006 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T05:06:01.100 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DEDD9DF5-318F-627C-8306-07D6B56EEE91} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 05:06:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T05:06:01.600 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T05:09:56.712 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T05:09:56.712 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T05:09:56.712 [Cloud] Queued cloud request. 2026-09-18T05:09:56.712 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T05:09:56.712 [Cloud] Dequeued cloud request. 2026-09-18T05:09:56.712 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T05:09:56.868 [Cloud] End of cloud request. 2026-09-18T05:09:57.368 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T05:10:33.852 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T05:10:33.852 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T05:10:33.852 [Cloud] Queued cloud request. 2026-09-18T05:10:33.852 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T05:10:33.852 [Cloud] Dequeued cloud request. 2026-09-18T05:10:33.852 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T05:10:34.962 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{636F5C29-1F73-D342-F9E3-A80A33996DA9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 05:10:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T05:10:35.462 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T05:11:04.774 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T05:11:04.774 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T05:11:04.774 [Cloud] Queued cloud request. 2026-09-18T05:11:04.774 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T05:11:04.774 [Cloud] Dequeued cloud request. 2026-09-18T05:11:04.774 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T05:11:04.852 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BB393167-8DE8-21AA-F11D-1E121188A339} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 05:11:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T05:11:05.368 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T05:11:31.915 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T05:11:31.915 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T05:11:31.915 [Cloud] Queued cloud request. 2026-09-18T05:11:31.915 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T05:11:31.915 [Cloud] Dequeued cloud request. 2026-09-18T05:11:31.915 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T05:11:31.993 [Cloud] End of cloud request. 2026-09-18T05:11:32.509 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T05:17:59.637 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T05:28:59.251 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 16894, Count: 1160, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 6025, Count: 496, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 5705, Count: 470, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: powershell.exe, Pid: 1948, TotalTime: 1614, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-18T05:28:59.251 ProcessImageName: WmiPrvSE.exe, Pid: 5636, TotalTime: 947, Count: 58, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: php.exe, Pid: 7824, TotalTime: 801, Count: 21, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-18T05:28:59.251 ProcessImageName: AgentShellService.exe, Pid: 2516, TotalTime: 744, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 55% 2026-09-18T05:28:59.251 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 421, Count: 37, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: WmiPrvSE.exe, Pid: 7928, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\ndis.sys, EstimatedImpact: 100% 2026-09-18T05:28:59.251 ProcessImageName: upfc.exe, Pid: 6468, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml, EstimatedImpact: 100% 2026-09-18T05:28:59.251 ProcessImageName: taskhostw.exe, Pid: 5508, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-18T05:28:59.251 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: mysqldump.exe, Pid: 2264, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 14% 2026-09-18T05:28:59.251 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17b61-0.MAI, EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: powershell.exe, Pid: 2224, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: DeviceCensus.exe, Pid: 6356, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 3% 2026-09-18T05:28:59.251 ProcessImageName: cmd.exe, Pid: 2732, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: powershell.exe, Pid: 1708, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp1C25.tmp, EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-18T05:28:59.251 ProcessImageName: taskhostw.exe, Pid: 5920, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-18T05:33:04.641 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T05:36:03.941 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T05:36:03.941 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T05:36:03.941 [Cloud] Queued cloud request. 2026-09-18T05:36:03.941 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T05:36:03.941 [Cloud] Dequeued cloud request. 2026-09-18T05:36:03.941 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T05:36:04.426 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{679BF75C-569B-30DA-1FF2-C290BE665DCC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 05:36:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T05:36:04.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T05:37:59.521 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T05:37:59.521 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T05:37:59.521 [Cloud] Queued cloud request. 2026-09-18T05:37:59.521 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T05:37:59.521 [Cloud] Dequeued cloud request. 2026-09-18T05:37:59.521 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T05:38:07.583 [Cloud] End of cloud request. 2026-09-18T05:38:08.083 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T05:47:30.994 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T05:47:30.994 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T05:47:30.994 [Cloud] Queued cloud request. 2026-09-18T05:47:30.994 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T05:47:30.994 [Cloud] Dequeued cloud request. 2026-09-18T05:47:30.994 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T05:47:31.228 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2531599B-937D-5334-0A94-56E015330B75} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 05:47:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T05:47:31.728 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T05:48:09.650 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T06:03:14.655 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T06:18:19.663 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T06:19:56.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T06:19:56.445 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T06:19:56.445 [Cloud] Queued cloud request. 2026-09-18T06:19:56.445 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T06:19:56.445 [Cloud] Dequeued cloud request. 2026-09-18T06:19:56.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T06:19:56.601 [Cloud] End of cloud request. 2026-09-18T06:19:57.101 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T06:21:30.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T06:21:30.445 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T06:21:30.445 [Cloud] Queued cloud request. 2026-09-18T06:21:30.445 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T06:21:30.445 [Cloud] Dequeued cloud request. 2026-09-18T06:21:30.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T06:21:40.523 [Cloud] End of cloud request. 2026-09-18T06:21:41.039 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T06:22:57.664 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T06:22:57.664 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T06:22:57.664 [Cloud] Queued cloud request. 2026-09-18T06:22:57.664 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T06:22:57.664 [Cloud] Dequeued cloud request. 2026-09-18T06:22:57.664 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T06:22:57.820 [Cloud] End of cloud request. 2026-09-18T06:22:58.336 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T06:24:34.945 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T06:24:34.945 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T06:24:34.945 [Cloud] Queued cloud request. 2026-09-18T06:24:34.945 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T06:24:34.945 [Cloud] Dequeued cloud request. 2026-09-18T06:24:34.945 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T06:24:35.117 [Cloud] End of cloud request. 2026-09-18T06:24:35.633 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T06:33:24.669 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T06:33:38.529 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T06:33:38.529 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T06:33:38.529 [Cloud] Queued cloud request. 2026-09-18T06:33:38.529 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T06:33:38.529 [Cloud] Dequeued cloud request. 2026-09-18T06:33:38.529 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T06:33:38.685 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{71C5B745-D2A5-C532-CFEE-D536E89F91A6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 06:33:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T06:33:39.201 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T06:39:35.688 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T06:39:35.688 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T06:39:35.688 [Cloud] Queued cloud request. 2026-09-18T06:39:35.688 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T06:39:35.688 [Cloud] Dequeued cloud request. 2026-09-18T06:39:35.688 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T06:39:35.844 [Cloud] End of cloud request. 2026-09-18T06:39:36.360 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T06:42:38.033 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T06:42:38.033 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T06:42:38.033 [Cloud] Queued cloud request. 2026-09-18T06:42:38.033 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T06:42:38.033 [Cloud] Dequeued cloud request. 2026-09-18T06:42:38.033 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T06:42:48.126 [Cloud] End of cloud request. 2026-09-18T06:42:48.626 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T06:48:29.677 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T07:03:34.681 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T07:14:03.016 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T07:14:03.016 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T07:14:03.016 [Cloud] Queued cloud request. 2026-09-18T07:14:03.016 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T07:14:03.016 [Cloud] Dequeued cloud request. 2026-09-18T07:14:03.016 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T07:14:03.219 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{76AC184F-10CE-6A80-EEAF-FC796A7912DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 07:14:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T07:14:03.719 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T07:17:24.674 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T07:17:24.674 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T07:17:24.674 [Cloud] Queued cloud request. 2026-09-18T07:17:24.674 [Cloud] Dequeued cloud request. 2026-09-18T07:17:24.674 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T07:17:24.674 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T07:17:24.861 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7CA0F9D8-6F0F-99A0-9977-64D49B09162E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 07:17:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T07:17:25.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T07:18:39.690 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T07:22:47.065 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T07:22:47.065 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T07:22:47.065 [Cloud] Queued cloud request. 2026-09-18T07:22:47.065 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T07:22:47.065 [Cloud] Dequeued cloud request. 2026-09-18T07:22:47.065 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T07:22:47.268 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5B668854-879B-4004-C400-D9C566E641C5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 07:22:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T07:22:47.784 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T07:28:59.304 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 18425, Count: 1316, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-18T07:28:59.304 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 8132, Count: 655, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-18T07:28:59.304 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 5705, Count: 470, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-09-18T07:28:59.304 ProcessImageName: powershell.exe, Pid: 1948, TotalTime: 1614, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-18T07:28:59.304 ProcessImageName: WmiPrvSE.exe, Pid: 5636, TotalTime: 947, Count: 58, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 0% 2026-09-18T07:28:59.304 ProcessImageName: php.exe, Pid: 7824, TotalTime: 801, Count: 21, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-18T07:28:59.304 ProcessImageName: AgentShellService.exe, Pid: 2516, TotalTime: 744, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 55% 2026-09-18T07:28:59.304 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 451, Count: 41, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-18T07:28:59.304 ProcessImageName: powershell.exe, Pid: 7104, TotalTime: 357, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-18T07:28:59.304 ProcessImageName: WmiPrvSE.exe, Pid: 7928, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\ndis.sys, EstimatedImpact: 100% 2026-09-18T07:28:59.304 ProcessImageName: python.exe, Pid: 7732, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-18T07:28:59.304 ProcessImageName: upfc.exe, Pid: 6468, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml, EstimatedImpact: 100% 2026-09-18T07:28:59.304 ProcessImageName: taskhostw.exe, Pid: 5508, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-18T07:28:59.304 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-18T07:28:59.304 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 66, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17b61-0.MAI, EstimatedImpact: 0% 2026-09-18T07:28:59.304 ProcessImageName: mysqldump.exe, Pid: 2264, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 14% 2026-09-18T07:28:59.304 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-18T07:28:59.304 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-18T07:28:59.304 ProcessImageName: powershell.exe, Pid: 2224, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-18T07:28:59.304 ProcessImageName: DeviceCensus.exe, Pid: 6356, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 3% 2026-09-18T07:28:59.304 ProcessImageName: cmd.exe, Pid: 2732, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-18T07:28:59.304 ProcessImageName: powershell.exe, Pid: 1708, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp1C25.tmp, EstimatedImpact: 0% 2026-09-18T07:28:59.304 ProcessImageName: taskhostw.exe, Pid: 5920, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-18T07:28:59.304 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-18T07:33:44.695 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T07:37:08.855 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T07:37:08.855 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T07:37:08.855 [Cloud] Queued cloud request. 2026-09-18T07:37:08.855 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T07:37:08.855 [Cloud] Dequeued cloud request. 2026-09-18T07:37:08.855 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T07:37:09.042 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AE775249-CE11-DEE0-B4D8-0CCA6F6F34E7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 07:37:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T07:37:09.558 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T07:44:01.637 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T07:44:01.637 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T07:44:01.637 [Cloud] Queued cloud request. 2026-09-18T07:44:01.637 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T07:44:01.637 [Cloud] Dequeued cloud request. 2026-09-18T07:44:01.637 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T07:44:02.621 [Cloud] End of cloud request. 2026-09-18T07:44:03.121 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T07:48:49.704 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T07:56:04.644 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T07:56:04.644 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T07:56:04.644 [Cloud] Queued cloud request. 2026-09-18T07:56:04.644 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T07:56:04.644 [Cloud] Dequeued cloud request. 2026-09-18T07:56:04.644 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T07:56:04.847 [Cloud] End of cloud request. 2026-09-18T07:56:05.347 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T07:57:52.177 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T07:57:52.177 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T07:57:52.177 [Cloud] Queued cloud request. 2026-09-18T07:57:52.177 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T07:57:52.177 [Cloud] Dequeued cloud request. 2026-09-18T07:57:52.177 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T07:58:02.318 [Cloud] End of cloud request. 2026-09-18T07:58:02.818 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T07:59:06.614 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T07:59:06.614 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T07:59:06.614 [Cloud] Queued cloud request. 2026-09-18T07:59:06.614 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T07:59:06.614 [Cloud] Dequeued cloud request. 2026-09-18T07:59:06.614 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T07:59:07.271 [Cloud] End of cloud request. 2026-09-18T07:59:07.771 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T08:03:54.709 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T08:14:08.823 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T08:14:08.823 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T08:14:08.823 [Cloud] Queued cloud request. 2026-09-18T08:14:08.823 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T08:14:08.823 [Cloud] Dequeued cloud request. 2026-09-18T08:14:08.823 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T08:14:09.041 [Cloud] End of cloud request. 2026-09-18T08:14:09.541 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T08:18:25.764 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T08:18:25.764 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T08:18:25.764 [Cloud] Queued cloud request. 2026-09-18T08:18:25.764 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T08:18:25.764 [Cloud] Dequeued cloud request. 2026-09-18T08:18:25.764 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T08:18:25.905 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0B687BBC-E2D3-A733-15CB-2BEE19CCAB0B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 08:18:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T08:18:26.420 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T08:18:59.717 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T08:32:41.035 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T08:32:41.035 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T08:32:41.035 [Cloud] Queued cloud request. 2026-09-18T08:32:41.035 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T08:32:41.035 [Cloud] Dequeued cloud request. 2026-09-18T08:32:41.035 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T08:32:51.129 [Cloud] End of cloud request. 2026-09-18T08:32:51.644 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T08:34:04.722 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T08:49:09.731 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T09:04:14.737 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T09:05:16.893 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T09:05:16.893 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T09:05:16.893 [Cloud] Queued cloud request. 2026-09-18T09:05:16.893 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T09:05:16.893 [Cloud] Dequeued cloud request. 2026-09-18T09:05:16.893 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T09:05:17.081 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B42454E0-F546-F864-4ABC-70993F80807C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 09:05:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T09:05:17.596 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T09:05:43.956 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T09:05:43.956 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T09:05:43.956 [Cloud] Queued cloud request. 2026-09-18T09:05:43.956 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T09:05:43.956 [Cloud] Dequeued cloud request. 2026-09-18T09:05:43.956 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T09:05:44.034 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A354AB00-4C51-D393-126F-D8E38685ECDD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 09:05:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T09:05:44.534 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T09:19:19.745 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T09:26:27.715 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T09:26:27.715 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T09:26:27.715 [Cloud] Queued cloud request. 2026-09-18T09:26:27.715 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T09:26:27.715 [Cloud] Dequeued cloud request. 2026-09-18T09:26:27.715 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T09:26:27.887 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FEA074B1-E795-CF62-DE70-9101B3024F4A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 09:26:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T09:26:28.403 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T09:28:59.359 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 21460, Count: 1501, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 10301, Count: 822, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 5705, Count: 470, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: powershell.exe, Pid: 1948, TotalTime: 1614, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-18T09:28:59.359 ProcessImageName: WmiPrvSE.exe, Pid: 5636, TotalTime: 947, Count: 58, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: php.exe, Pid: 7824, TotalTime: 801, Count: 21, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-18T09:28:59.359 ProcessImageName: AgentShellService.exe, Pid: 2516, TotalTime: 744, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 55% 2026-09-18T09:28:59.359 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 481, Count: 45, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: powershell.exe, Pid: 7104, TotalTime: 357, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-18T09:28:59.359 ProcessImageName: WmiPrvSE.exe, Pid: 7928, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\ndis.sys, EstimatedImpact: 100% 2026-09-18T09:28:59.359 ProcessImageName: python.exe, Pid: 7732, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-18T09:28:59.359 ProcessImageName: upfc.exe, Pid: 6468, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml, EstimatedImpact: 100% 2026-09-18T09:28:59.359 ProcessImageName: taskhostw.exe, Pid: 5508, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-18T09:28:59.359 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 66, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17b61-0.MAI, EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: mysqldump.exe, Pid: 2264, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 14% 2026-09-18T09:28:59.359 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: powershell.exe, Pid: 2224, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: DeviceCensus.exe, Pid: 6356, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 3% 2026-09-18T09:28:59.359 ProcessImageName: cmd.exe, Pid: 2732, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: powershell.exe, Pid: 1708, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp1C25.tmp, EstimatedImpact: 0% 2026-09-18T09:28:59.359 ProcessImageName: taskhostw.exe, Pid: 5920, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-18T09:30:35.375 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T09:30:35.375 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T09:30:35.375 [Cloud] Queued cloud request. 2026-09-18T09:30:35.375 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T09:30:35.375 [Cloud] Dequeued cloud request. 2026-09-18T09:30:35.375 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T09:30:35.515 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{82503FD3-2C0E-9849-1309-1B38BA235414} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 09:30:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T09:30:36.031 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T09:34:24.752 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T09:46:16.867 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T09:46:16.867 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T09:46:16.867 [Cloud] Queued cloud request. 2026-09-18T09:46:16.867 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T09:46:16.867 [Cloud] Dequeued cloud request. 2026-09-18T09:46:16.867 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T09:46:17.164 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C1006B2-AD3C-C783-1569-D1331698DF8A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 09:46:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T09:46:17.664 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T09:48:21.228 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T09:48:21.228 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T09:48:21.228 [Cloud] Queued cloud request. 2026-09-18T09:48:21.228 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T09:48:21.228 [Cloud] Dequeued cloud request. 2026-09-18T09:48:21.228 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T09:48:21.431 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4C1AF8DB-6073-90DB-8C46-31B11E8277EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 09:48:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T09:48:21.947 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T09:49:29.759 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T09:52:28.198 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T09:52:28.198 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T09:52:28.198 [Cloud] Queued cloud request. 2026-09-18T09:52:28.198 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T09:52:28.198 [Cloud] Dequeued cloud request. 2026-09-18T09:52:28.198 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T09:52:28.402 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BA62970F-F1A0-702C-AB94-8FABE11A2C3B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 09:52:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T09:52:28.917 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T09:54:39.886 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T09:54:39.886 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T09:54:39.886 [Cloud] Queued cloud request. 2026-09-18T09:54:39.886 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T09:54:39.886 [Cloud] Dequeued cloud request. 2026-09-18T09:54:39.886 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T09:54:40.089 [Cloud] End of cloud request. 2026-09-18T09:54:40.605 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T10:00:47.389 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T10:00:47.389 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T10:00:47.389 [Cloud] Queued cloud request. 2026-09-18T10:00:47.389 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T10:00:47.389 [Cloud] Dequeued cloud request. 2026-09-18T10:00:47.389 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T10:00:47.608 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{112AB056-4014-EA78-DBBA-2EDE3DC7E846} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 10:00:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T10:00:48.108 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T10:04:34.767 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T10:19:39.774 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T10:34:44.779 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T10:39:10.096 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T10:39:10.096 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T10:39:10.096 [Cloud] Queued cloud request. 2026-09-18T10:39:10.096 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T10:39:10.268 [Cloud] Dequeued cloud request. 2026-09-18T10:39:10.268 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T10:39:10.455 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{266BBC3D-6442-B16B-FE77-EDED2269B2E6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 10:39:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T10:39:10.971 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T10:49:49.788 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T11:00:40.090 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T11:00:40.090 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T11:00:40.090 [Cloud] Queued cloud request. 2026-09-18T11:00:40.090 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T11:00:40.090 [Cloud] Dequeued cloud request. 2026-09-18T11:00:40.090 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T11:00:40.637 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{19C7D912-4FB8-2EA3-66C1-87576072A562} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 11:00:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T11:00:41.137 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T11:04:54.794 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T11:07:05.310 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T11:07:05.310 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T11:07:05.310 [Cloud] Queued cloud request. 2026-09-18T11:07:05.310 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T11:07:05.310 [Cloud] Dequeued cloud request. 2026-09-18T11:07:05.310 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T11:07:05.466 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6BBBC67C-DF19-CC1F-B311-6B537B3BE552} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 11:07:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T11:07:05.982 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T11:08:56.829 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T11:08:56.829 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T11:08:56.829 [Cloud] Queued cloud request. 2026-09-18T11:08:56.829 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T11:08:56.829 [Cloud] Dequeued cloud request. 2026-09-18T11:08:56.829 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T11:08:57.001 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CA495B0E-47B2-8206-9858-E54F56DB0215} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 11:08:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T11:08:57.501 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T11:19:14.178 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T11:19:14.178 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T11:19:14.178 [Cloud] Queued cloud request. 2026-09-18T11:19:14.178 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T11:19:14.178 [Cloud] Dequeued cloud request. 2026-09-18T11:19:14.178 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T11:19:14.381 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{882EEB26-0105-4A1D-9686-7C6C9F154E08} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 11:19:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T11:19:14.897 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T11:19:59.803 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T11:28:59.417 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 22523, Count: 1580, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 12436, Count: 998, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 5705, Count: 470, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: powershell.exe, Pid: 1948, TotalTime: 1614, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-18T11:28:59.417 ProcessImageName: WmiPrvSE.exe, Pid: 5636, TotalTime: 947, Count: 58, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: php.exe, Pid: 7824, TotalTime: 801, Count: 21, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-18T11:28:59.417 ProcessImageName: AgentShellService.exe, Pid: 2516, TotalTime: 744, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 55% 2026-09-18T11:28:59.417 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 511, Count: 47, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: powershell.exe, Pid: 7104, TotalTime: 357, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-18T11:28:59.417 ProcessImageName: WmiPrvSE.exe, Pid: 7928, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\ndis.sys, EstimatedImpact: 100% 2026-09-18T11:28:59.417 ProcessImageName: python.exe, Pid: 7732, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-18T11:28:59.417 ProcessImageName: upfc.exe, Pid: 6468, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml, EstimatedImpact: 100% 2026-09-18T11:28:59.417 ProcessImageName: taskhostw.exe, Pid: 5508, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-18T11:28:59.417 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 70, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17b61-0.MAI, EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: mysqldump.exe, Pid: 2264, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 14% 2026-09-18T11:28:59.417 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: powershell.exe, Pid: 2224, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: DeviceCensus.exe, Pid: 6356, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 3% 2026-09-18T11:28:59.417 ProcessImageName: cmd.exe, Pid: 2732, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: powershell.exe, Pid: 1708, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp1C25.tmp, EstimatedImpact: 0% 2026-09-18T11:28:59.417 ProcessImageName: taskhostw.exe, Pid: 5920, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-18T11:35:04.809 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T11:38:42.953 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T11:38:42.953 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T11:38:42.953 [Cloud] Queued cloud request. 2026-09-18T11:38:42.953 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T11:38:43.172 [Cloud] Dequeued cloud request. 2026-09-18T11:38:43.172 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T11:38:43.375 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{76168CDD-07C3-533A-378D-65EA205FFE64} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 11:38:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T11:38:43.875 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T11:44:11.455 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T11:44:11.455 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T11:44:11.455 [Cloud] Queued cloud request. 2026-09-18T11:44:11.455 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T11:44:11.455 [Cloud] Dequeued cloud request. 2026-09-18T11:44:11.455 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T11:44:11.642 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5C8A3491-529A-B789-50DA-C128EA771BAD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 11:44:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T11:44:12.143 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T11:50:09.818 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T12:05:14.824 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T12:06:58.574 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:06:58.574 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:06:58.574 [Cloud] Queued cloud request. 2026-09-18T12:06:58.574 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:06:58.574 [Cloud] Dequeued cloud request. 2026-09-18T12:06:58.574 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:06:58.856 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BC0AFE1E-3B78-075F-56C2-B5D5F3F52B7F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 12:06:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T12:06:59.371 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T12:15:07.157 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:15:07.157 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:15:07.157 [Cloud] Queued cloud request. 2026-09-18T12:15:07.157 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:15:07.157 [Cloud] Dequeued cloud request. 2026-09-18T12:15:07.157 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:15:07.391 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E3C8726-2773-4358-6796-BE4407405032} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 12:15:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T12:15:07.907 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T12:16:18.111 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:16:18.111 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:16:18.111 [Cloud] Queued cloud request. 2026-09-18T12:16:18.111 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:16:18.111 [Cloud] Dequeued cloud request. 2026-09-18T12:16:18.111 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:16:18.299 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E0375EFD-01AB-AF31-7D58-101A8FF18D16} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 12:16:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T12:16:18.799 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T12:18:17.708 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:18:17.708 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:18:17.708 [Cloud] Queued cloud request. 2026-09-18T12:18:17.708 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:18:17.708 [Cloud] Dequeued cloud request. 2026-09-18T12:18:17.708 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:18:17.911 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2E2C6507-8A6F-67BC-62F7-39685C3451BB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 12:18:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T12:18:18.411 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T12:20:19.833 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T12:25:03.412 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:25:03.412 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:25:03.412 [Cloud] Queued cloud request. 2026-09-18T12:25:03.412 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:25:03.412 [Cloud] Dequeued cloud request. 2026-09-18T12:25:03.412 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:25:03.599 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AAD43A29-270A-AC09-B1F3-571523EAFCFA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 12:25:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T12:25:04.099 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T12:25:41.382 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:25:41.382 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:25:41.382 [Cloud] Queued cloud request. 2026-09-18T12:25:41.382 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:25:41.382 [Cloud] Dequeued cloud request. 2026-09-18T12:25:41.382 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:25:41.461 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{148A9405-4A72-8506-15FA-F15212A4B7C4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 12:25:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T12:25:41.961 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T12:28:36.681 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:28:36.681 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:28:36.681 [Cloud] Queued cloud request. 2026-09-18T12:28:36.681 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:28:36.838 [Cloud] Dequeued cloud request. 2026-09-18T12:28:36.838 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:28:37.009 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4638BAB6-BBC3-328D-B7AA-7FAB73E2F088} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 12:28:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T12:28:37.509 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T12:34:34.230 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:34:34.230 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:34:34.230 [Cloud] Queued cloud request. 2026-09-18T12:34:34.230 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:34:34.230 [Cloud] Dequeued cloud request. 2026-09-18T12:34:34.230 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:34:34.418 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06C65789-23ED-6A20-F0DE-7E975DA81A26} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 12:34:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T12:34:34.933 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T12:35:24.840 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{CD4BAEB0-AE78-32F9-C3B2-9A814F548BE5} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-18-2026 12:38:10 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T12:38:11.405 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:38:11.405 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:38:11.405 [Cloud] Queued cloud request. 2026-09-18T12:38:11.405 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:38:11.405 [Cloud] Dequeued cloud request. 2026-09-18T12:38:11.405 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:38:11.733 [Cloud] End of cloud request. 2026-09-18T12:38:12.233 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T12:40:11.359 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:40:11.359 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:40:11.359 [Cloud] Queued cloud request. 2026-09-18T12:40:11.359 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:40:11.359 [Cloud] Dequeued cloud request. 2026-09-18T12:40:11.359 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:40:11.578 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{300BE8ED-9F06-A3DC-DFDA-3F8528D4C524} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 12:40:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T12:40:12.094 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T12:42:55.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:42:55.657 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:42:55.657 [Cloud] Queued cloud request. 2026-09-18T12:42:55.657 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:42:55.657 [Cloud] Dequeued cloud request. 2026-09-18T12:42:55.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:42:55.844 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{95B2891D-5396-FA57-0C5E-3EE0D2CAB3AB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 12:42:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T12:42:56.360 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T12:50:29.848 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T12:53:19.363 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:53:19.363 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:53:19.363 [Cloud] Queued cloud request. 2026-09-18T12:53:19.363 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:53:19.363 [Cloud] Dequeued cloud request. 2026-09-18T12:53:19.363 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:53:29.457 [Cloud] End of cloud request. 2026-09-18T12:53:29.957 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T12:58:31.946 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T12:58:31.946 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T12:58:31.946 [Cloud] Queued cloud request. 2026-09-18T12:58:31.946 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T12:58:31.946 [Cloud] Dequeued cloud request. 2026-09-18T12:58:31.946 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T12:58:32.103 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F2CA872E-6516-E9E5-654D-5F53E02CF404} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 12:58:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T12:58:32.618 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T13:00:18.603 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T13:00:18.603 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T13:00:18.603 [Cloud] Queued cloud request. 2026-09-18T13:00:18.603 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T13:00:18.603 [Cloud] Dequeued cloud request. 2026-09-18T13:00:18.603 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T13:00:21.337 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0DAFFA75-0416-90D6-A378-141D3B9F3BBC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 13:00:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T13:00:21.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T13:01:33.057 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T13:01:33.057 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T13:01:33.057 [Cloud] Queued cloud request. 2026-09-18T13:01:33.057 [Cloud] Dequeued cloud request. 2026-09-18T13:01:33.057 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T13:01:33.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T13:01:33.276 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7C6C2CE2-E694-14A0-BB32-09EDCA165C8D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 13:01:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T13:01:33.776 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T13:05:34.854 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T13:06:02.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T13:06:02.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T13:06:02.604 [Cloud] Queued cloud request. 2026-09-18T13:06:02.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T13:06:02.604 [Cloud] Dequeued cloud request. 2026-09-18T13:06:02.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T13:06:02.823 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D4A8754A-7AC0-E0A2-E29F-50E43BA95313} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 13:06:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T13:06:03.323 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T13:15:50.220 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T13:15:50.220 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T13:15:50.220 [Cloud] Queued cloud request. 2026-09-18T13:15:50.220 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T13:15:50.220 [Cloud] Dequeued cloud request. 2026-09-18T13:15:50.220 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T13:15:50.408 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CDDB8BBE-E388-EA8E-29FF-2FB99D98A489} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 13:15:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T13:15:50.908 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T13:17:25.096 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T13:17:25.096 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T13:17:25.096 [Cloud] Queued cloud request. 2026-09-18T13:17:25.096 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T13:17:25.096 [Cloud] Dequeued cloud request. 2026-09-18T13:17:25.096 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T13:17:25.299 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{195D86CF-0DFE-D304-7D3E-99D0C54E3DA4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 13:17:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T13:17:25.815 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T13:20:15.425 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T13:20:15.425 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T13:20:15.425 [Cloud] Queued cloud request. 2026-09-18T13:20:15.425 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T13:20:15.425 [Cloud] Dequeued cloud request. 2026-09-18T13:20:15.425 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T13:20:15.660 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CF9D3275-0DDD-B476-0941-AF119351BF95} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 13:20:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T13:20:16.160 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T13:20:39.863 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T13:23:21.036 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T13:23:21.036 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T13:23:21.036 [Cloud] Queued cloud request. 2026-09-18T13:23:21.036 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T13:23:21.036 [Cloud] Dequeued cloud request. 2026-09-18T13:23:21.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T13:23:21.224 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{87545B85-75EC-4D7F-DD09-FB712229323A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 13:23:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T13:23:21.724 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T13:28:59.493 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 26565, Count: 1936, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 14458, Count: 1171, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 5705, Count: 470, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: powershell.exe, Pid: 1948, TotalTime: 1614, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-18T13:28:59.493 ProcessImageName: WmiPrvSE.exe, Pid: 5636, TotalTime: 947, Count: 58, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: php.exe, Pid: 7824, TotalTime: 801, Count: 21, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-18T13:28:59.493 ProcessImageName: AgentShellService.exe, Pid: 2516, TotalTime: 744, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 55% 2026-09-18T13:28:59.493 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 571, Count: 53, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: powershell.exe, Pid: 7104, TotalTime: 357, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-18T13:28:59.493 ProcessImageName: WmiPrvSE.exe, Pid: 7928, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\ndis.sys, EstimatedImpact: 100% 2026-09-18T13:28:59.493 ProcessImageName: python.exe, Pid: 7732, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-18T13:28:59.493 ProcessImageName: upfc.exe, Pid: 6468, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml, EstimatedImpact: 100% 2026-09-18T13:28:59.493 ProcessImageName: taskhostw.exe, Pid: 5508, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-18T13:28:59.493 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 70, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17b61-0.MAI, EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: mysqldump.exe, Pid: 2264, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 14% 2026-09-18T13:28:59.493 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: powershell.exe, Pid: 2224, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: DeviceCensus.exe, Pid: 6356, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 3% 2026-09-18T13:28:59.493 ProcessImageName: cmd.exe, Pid: 2732, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: powershell.exe, Pid: 1708, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp1C25.tmp, EstimatedImpact: 0% 2026-09-18T13:28:59.493 ProcessImageName: taskhostw.exe, Pid: 5920, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-18T13:30:20.196 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T13:30:20.196 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T13:30:20.196 [Cloud] Queued cloud request. 2026-09-18T13:30:20.196 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T13:30:20.196 [Cloud] Dequeued cloud request. 2026-09-18T13:30:20.196 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T13:30:20.352 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F96077DE-B41D-3168-D55C-56E86FFE2DE7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 13:30:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T13:30:20.868 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T13:32:01.885 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T13:32:01.885 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T13:32:01.885 [Cloud] Queued cloud request. 2026-09-18T13:32:01.885 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T13:32:01.885 [Cloud] Dequeued cloud request. 2026-09-18T13:32:01.885 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T13:32:02.041 [Cloud] End of cloud request. 2026-09-18T13:32:02.541 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T13:33:41.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T13:33:41.088 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T13:33:41.088 [Cloud] Queued cloud request. 2026-09-18T13:33:41.088 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T13:33:41.088 [Cloud] Dequeued cloud request. 2026-09-18T13:33:41.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T13:33:41.260 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{64211D04-87EA-0F2D-2EE2-3D824E9355CC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 13:33:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T13:33:41.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T13:35:44.871 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T13:40:15.749 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T13:40:15.749 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T13:40:15.749 [Cloud] Queued cloud request. 2026-09-18T13:40:15.749 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T13:40:15.968 [Cloud] Dequeued cloud request. 2026-09-18T13:40:16.155 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T13:40:18.561 [Cloud] End of cloud request. 2026-09-18T13:40:19.061 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T13:50:49.878 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T14:00:06.961 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T14:00:06.961 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T14:00:06.961 [Cloud] Queued cloud request. 2026-09-18T14:00:06.961 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T14:00:06.961 [Cloud] Dequeued cloud request. 2026-09-18T14:00:06.961 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T14:00:07.164 [Cloud] End of cloud request. 2026-09-18T14:00:07.664 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T14:05:54.885 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T14:20:59.893 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T14:36:04.901 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T14:51:09.909 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T15:06:14.917 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T15:21:19.925 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T15:28:59.553 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27238, Count: 1966, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 16594, Count: 1338, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 5705, Count: 470, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: powershell.exe, Pid: 1948, TotalTime: 1614, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-18T15:28:59.553 ProcessImageName: WmiPrvSE.exe, Pid: 5636, TotalTime: 947, Count: 58, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: php.exe, Pid: 7824, TotalTime: 801, Count: 21, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-18T15:28:59.553 ProcessImageName: AgentShellService.exe, Pid: 2516, TotalTime: 744, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 55% 2026-09-18T15:28:59.553 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 632, Count: 59, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: powershell.exe, Pid: 7104, TotalTime: 357, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-18T15:28:59.553 ProcessImageName: WmiPrvSE.exe, Pid: 7928, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\ndis.sys, EstimatedImpact: 100% 2026-09-18T15:28:59.553 ProcessImageName: python.exe, Pid: 7732, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-18T15:28:59.553 ProcessImageName: upfc.exe, Pid: 6468, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml, EstimatedImpact: 100% 2026-09-18T15:28:59.553 ProcessImageName: taskhostw.exe, Pid: 5508, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-18T15:28:59.553 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 70, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17b61-0.MAI, EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: mysqldump.exe, Pid: 2264, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 14% 2026-09-18T15:28:59.553 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: powershell.exe, Pid: 2224, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: DeviceCensus.exe, Pid: 6356, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 3% 2026-09-18T15:28:59.553 ProcessImageName: cmd.exe, Pid: 2732, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: powershell.exe, Pid: 1708, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp1C25.tmp, EstimatedImpact: 0% 2026-09-18T15:28:59.553 ProcessImageName: taskhostw.exe, Pid: 5920, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-18T15:31:37.867 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T15:31:37.867 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T15:31:37.867 [Cloud] Queued cloud request. 2026-09-18T15:31:37.867 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T15:31:37.867 [Cloud] Dequeued cloud request. 2026-09-18T15:31:37.867 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T15:31:45.961 [Cloud] End of cloud request. 2026-09-18T15:31:46.461 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T15:36:24.932 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T15:41:38.466 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T15:41:38.466 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T15:41:38.466 [Cloud] Queued cloud request. 2026-09-18T15:41:38.466 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T15:41:38.466 [Cloud] Dequeued cloud request. 2026-09-18T15:41:38.466 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T15:41:38.653 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{052E6E02-993E-58E9-B43F-62E3C0C2B208} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 15:41:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T15:41:39.153 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T15:46:20.780 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T15:46:20.780 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T15:46:20.780 [Cloud] Queued cloud request. 2026-09-18T15:46:20.780 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T15:46:20.780 [Cloud] Dequeued cloud request. 2026-09-18T15:46:20.780 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T15:46:20.968 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0F3A0EC7-91D2-8AF3-78F4-169DABF853F2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 15:46:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T15:46:21.483 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T15:51:29.938 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T16:00:32.303 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T16:00:32.303 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T16:00:32.303 [Cloud] Queued cloud request. 2026-09-18T16:00:32.303 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T16:00:32.303 [Cloud] Dequeued cloud request. 2026-09-18T16:00:32.303 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T16:00:32.490 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F4C4636D-6E3E-5D14-E72C-222DD2E676B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 16:00:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T16:00:32.990 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T16:06:34.945 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T16:09:08.417 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T16:09:08.417 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T16:09:08.417 [Cloud] Queued cloud request. 2026-09-18T16:09:08.417 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T16:09:08.417 [Cloud] Dequeued cloud request. 2026-09-18T16:09:08.417 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T16:09:08.854 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{47E9694F-9CD2-6788-C6A9-CCF095DAD5F3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 16:09:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T16:09:09.354 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T16:17:34.827 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T16:17:34.827 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T16:17:34.827 [Cloud] Queued cloud request. 2026-09-18T16:17:34.827 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T16:17:34.827 [Cloud] Dequeued cloud request. 2026-09-18T16:17:34.827 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T16:17:35.015 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{847D3FCC-862F-EFAC-813B-6384E3418BEE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 16:17:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T16:17:35.515 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T16:21:39.953 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T16:28:36.458 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T16:28:36.458 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T16:28:36.458 [Cloud] Queued cloud request. 2026-09-18T16:28:36.458 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T16:28:36.458 [Cloud] Dequeued cloud request. 2026-09-18T16:28:36.458 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T16:28:36.645 [Cloud] End of cloud request. 2026-09-18T16:28:37.161 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T16:36:44.962 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T16:45:21.574 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T16:45:21.574 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T16:45:21.574 [Cloud] Queued cloud request. 2026-09-18T16:45:21.574 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T16:45:21.574 [Cloud] Dequeued cloud request. 2026-09-18T16:45:21.574 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T16:45:21.746 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{98180E09-77DF-41B5-57A1-88DAABB8E9C8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 16:45:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T16:45:22.261 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T16:51:49.969 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T16:53:03.017 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T16:53:03.017 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T16:53:03.017 [Cloud] Queued cloud request. 2026-09-18T16:53:03.017 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T16:53:03.017 [Cloud] Dequeued cloud request. 2026-09-18T16:53:03.017 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T16:53:03.173 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CBDB67C6-86ED-3EB0-C9B7-21E884A260A1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 16:53:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T16:53:03.673 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T17:04:02.459 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T17:04:02.459 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T17:04:02.459 [Cloud] Queued cloud request. 2026-09-18T17:04:02.459 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T17:04:02.459 [Cloud] Dequeued cloud request. 2026-09-18T17:04:02.459 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T17:04:02.880 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7C4632BE-7EE6-D28F-C1CC-8A73A4115F54} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 17:04:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T17:04:03.396 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T17:06:41.695 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T17:06:41.695 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T17:06:41.695 [Cloud] Queued cloud request. 2026-09-18T17:06:41.695 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T17:06:41.695 [Cloud] Dequeued cloud request. 2026-09-18T17:06:41.695 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T17:06:41.836 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0B818DD6-8C0E-5247-3B75-F0FFEABDAE3F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 17:06:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T17:06:42.351 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T17:06:54.976 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T17:21:59.984 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T17:28:59.628 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 28385, Count: 2033, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 18604, Count: 1503, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: AgentShell.exe, Pid: 2772, TotalTime: 5705, Count: 470, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: powershell.exe, Pid: 1948, TotalTime: 1614, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 33% 2026-09-18T17:28:59.628 ProcessImageName: WmiPrvSE.exe, Pid: 5636, TotalTime: 947, Count: 58, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: php.exe, Pid: 7824, TotalTime: 801, Count: 21, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-18T17:28:59.628 ProcessImageName: AgentShellService.exe, Pid: 2516, TotalTime: 744, Count: 20, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 55% 2026-09-18T17:28:59.628 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 647, Count: 61, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: powershell.exe, Pid: 7104, TotalTime: 357, Count: 23, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-18T17:28:59.628 ProcessImageName: WmiPrvSE.exe, Pid: 7928, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\ndis.sys, EstimatedImpact: 100% 2026-09-18T17:28:59.628 ProcessImageName: python.exe, Pid: 7732, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-18T17:28:59.628 ProcessImageName: upfc.exe, Pid: 6468, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml, EstimatedImpact: 100% 2026-09-18T17:28:59.628 ProcessImageName: taskhostw.exe, Pid: 5508, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-18T17:28:59.628 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 70, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-17b61-0.MAI, EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: mysqldump.exe, Pid: 2264, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 14% 2026-09-18T17:28:59.628 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 31, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: powershell.exe, Pid: 2224, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: DeviceCensus.exe, Pid: 6356, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 3% 2026-09-18T17:28:59.628 ProcessImageName: cmd.exe, Pid: 2732, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: powershell.exe, Pid: 1708, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp1C25.tmp, EstimatedImpact: 0% 2026-09-18T17:28:59.628 ProcessImageName: taskhostw.exe, Pid: 5920, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-18T17:32:15.599 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T17:32:15.599 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T17:32:15.599 [Cloud] Queued cloud request. 2026-09-18T17:32:15.599 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T17:32:15.599 [Cloud] Dequeued cloud request. 2026-09-18T17:32:15.599 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T17:32:15.786 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E6C2EC33-1FDD-2FFA-13ED-3429522A5FB6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 17:32:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T17:32:16.302 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T17:34:22.880 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T17:34:22.880 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T17:34:22.880 [Cloud] Queued cloud request. 2026-09-18T17:34:22.880 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T17:34:22.880 [Cloud] Dequeued cloud request. 2026-09-18T17:34:22.880 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T17:34:23.067 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F96C2A61-0451-2330-E6DE-292F7049645B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 17:34:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T17:34:23.583 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T17:37:04.989 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T17:43:00.947 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T17:43:00.947 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T17:43:00.947 [Cloud] Queued cloud request. 2026-09-18T17:43:00.947 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T17:43:00.947 [Cloud] Dequeued cloud request. 2026-09-18T17:43:00.947 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T17:43:01.150 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{00FF4145-285A-D097-3E62-15213C737C27} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 17:43:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T17:43:01.650 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T17:45:53.385 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T17:45:53.385 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T17:45:53.385 [Cloud] Queued cloud request. 2026-09-18T17:45:53.385 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T17:45:53.541 [Cloud] Dequeued cloud request. 2026-09-18T17:45:53.541 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T17:45:53.713 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BDF93B7B-8CB2-18D1-88C5-320AE62CE507} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 17:45:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T17:45:54.213 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T17:47:02.590 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T17:47:02.590 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T17:47:02.590 [Cloud] Queued cloud request. 2026-09-18T17:47:02.590 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T17:47:02.590 [Cloud] Dequeued cloud request. 2026-09-18T17:47:02.590 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T17:47:12.715 [Cloud] End of cloud request. 2026-09-18T17:47:13.215 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T17:51:06.231 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T17:51:06.231 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T17:51:06.231 [Cloud] Queued cloud request. 2026-09-18T17:51:06.231 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T17:51:06.231 [Cloud] Dequeued cloud request. 2026-09-18T17:51:06.231 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T17:51:06.419 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9619561F-A63B-0B21-2E01-19CB2B621ABA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 17:51:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T17:51:06.919 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T17:52:09.997 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T17:58:25.892 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T17:58:25.892 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T17:58:25.892 [Cloud] Queued cloud request. 2026-09-18T17:58:25.892 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T17:58:25.892 [Cloud] Dequeued cloud request. 2026-09-18T17:58:25.892 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T17:58:32.814 [Cloud] End of cloud request. 2026-09-18T17:58:33.314 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T18:06:32.052 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T18:06:32.052 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T18:06:32.052 [Cloud] Queued cloud request. 2026-09-18T18:06:32.052 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T18:06:32.052 [Cloud] Dequeued cloud request. 2026-09-18T18:06:32.052 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T18:06:32.224 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F87A5F59-3B2F-DDFB-DCB3-971B4B3E5D0A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 18:06:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T18:06:32.724 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T18:07:15.005 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T18:07:40.397 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T18:07:40.397 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T18:07:40.397 [Cloud] Queued cloud request. 2026-09-18T18:07:40.397 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T18:07:40.397 [Cloud] Dequeued cloud request. 2026-09-18T18:07:40.397 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{3969EE77-BB07-8F76-D8D2-73BB3DF6B908} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 18:07:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T18:07:40.537 [Cloud] End of cloud request. 2026-09-18T18:07:41.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T18:18:47.933 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T18:18:47.933 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T18:18:47.933 [Cloud] Queued cloud request. 2026-09-18T18:18:47.933 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T18:18:47.933 [Cloud] Dequeued cloud request. 2026-09-18T18:18:47.933 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T18:18:48.121 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6D1DF228-0779-FE05-0B2C-9A4D0FBDA684} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 18:18:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T18:18:48.621 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T18:21:22.480 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T18:21:22.480 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T18:21:22.480 [Cloud] Queued cloud request. 2026-09-18T18:21:22.480 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T18:21:22.480 [Cloud] Dequeued cloud request. 2026-09-18T18:21:22.480 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T18:21:22.683 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5BC008AB-7D2F-6A4F-4289-56F482C1E168} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 18:21:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T18:21:23.199 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T18:22:20.013 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T18:37:25.020 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T18:40:07.366 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T18:40:07.366 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T18:40:07.366 [Cloud] Queued cloud request. 2026-09-18T18:40:07.366 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T18:40:07.366 [Cloud] Dequeued cloud request. 2026-09-18T18:40:07.366 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T18:40:07.522 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{91B10FB2-6CB1-AA0B-552E-43E3C97AF103} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 18:40:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T18:40:08.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T18:52:30.027 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T19:04:38.017 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T19:04:38.017 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T19:04:38.017 [Cloud] Queued cloud request. 2026-09-18T19:04:38.017 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T19:04:38.017 [Cloud] Dequeued cloud request. 2026-09-18T19:04:38.017 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T19:04:48.157 [Cloud] End of cloud request. 2026-09-18T19:04:48.657 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T19:07:35.034 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T19:09:02.051 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T19:09:02.051 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T19:09:02.051 [Cloud] Queued cloud request. 2026-09-18T19:09:02.051 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T19:09:02.051 [Cloud] Dequeued cloud request. 2026-09-18T19:09:02.051 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T19:09:02.238 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B0921475-7798-E490-CBC1-C04BCDA1FBA9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 19:09:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T19:09:02.738 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T19:10:12.926 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T19:10:12.926 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T19:10:12.926 [Cloud] Queued cloud request. 2026-09-18T19:10:12.926 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T19:10:12.926 [Cloud] Dequeued cloud request. 2026-09-18T19:10:12.926 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T19:10:13.145 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{453CBC0A-A231-0DD3-C1AE-477113C7F56B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 19:10:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T19:10:13.660 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T19:13:28.192 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T19:13:28.192 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T19:13:28.192 [Cloud] Queued cloud request. 2026-09-18T19:13:28.192 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T19:13:28.192 [Cloud] Dequeued cloud request. 2026-09-18T19:13:28.192 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T19:13:28.379 [Cloud] End of cloud request. 2026-09-18T19:13:28.879 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T19:22:40.042 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T19:25:36.262 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T19:25:36.262 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T19:25:36.262 [Cloud] Queued cloud request. 2026-09-18T19:25:36.262 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T19:25:36.262 [Cloud] Dequeued cloud request. 2026-09-18T19:25:36.262 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T19:25:46.371 [Cloud] End of cloud request. 2026-09-18T19:25:46.887 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T19:28:20.045 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-18T19:28:20.060 Job Notification: New process added to job (6520) 2026-09-18T19:28:20.076 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-18T19:28:20.076 Aggressive catchup quick scan threshold: 692459850340 / 25920000000000 2026-09-18T19:28:20.076 Job Notification: New process added to job (8184) 2026-09-18T19:28:20.091 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:6520] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:8184]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-18T19:28:20.225 Job Notification: New process added to job (6548) 2026-09-18T19:28:20.232 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-18T19:28:20.248 Job Notification: New process added to job (6772) 2026-09-18T19:28:20.310 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpCmdRun.exe][Pid:6548] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:6772]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-18T19:28:20.388 Job Notification: New process added to job (5736) 2026-09-18T19:28:20.451 Task(GetDeviceTicket -AccessKey 9AE8A2B0-9E67-EB63-E24B-59AFF152BE00 ) launched as network service 2026-09-18T19:28:20.591 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-18T19:28:20.625 [RTP] Duplicating the current plugin configuration object... 2026-09-18T19:28:20.625 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-18T19:28:20.625 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-18T19:28:20.625 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-18T19:28:20.625 [RTP] No config change detected. Not updating plugin configuration. 2026-09-18T19:28:20.625 [RTP] No config changes found. No configuration switch. 2026-09-18T19:28:20.625 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-18T19:28:21.060 Job Notification: Process exited from job (5736) 2026-09-18T19:28:21.216 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-18T19:28:21.216 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T19:28:21.216 [Cloud] Queued cloud request. 2026-09-18T19:28:21.216 [Cloud] Dequeued cloud request. 2026-09-18T19:28:21.216 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T19:28:21.342 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-18T19:28:21.342 [Cloud] End of cloud request. 2026-09-18T19:28:21.717 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T19:28:44.014 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-18T19:28:44.014 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-18T19:28:44.014 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-18T19:28:44.014 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-18T19:28:44.029 [PlatUpd] Verified C:\Windows\SystemTemp\8D8A9874-7C63-438E-BF05-71EB9EC565B4\MpUpdate.dll. Calling MpUpdateStub(0) ... 2026-09-18T19:28:46.608 [PlatUpd] MpUpdateStub() succeeded. Stub DLL: C:\Windows\SystemTemp\8D8A9874-7C63-438E-BF05-71EB9EC565B4\MpUpdate.dll. 2026-09-18T19:28:46.608 [KSL] Entering CKSLEngine::DisableKSL. 2026-09-18T19:28:46.608 [KSL] Entering CKSLEngine::shutdownImpl. 2026-09-18T19:28:46.639 [KSL] Leaving CKSLEngine::shutdownImpl(0). 2026-09-18T19:28:46.639 [KSL] Leaving CKSLEngine::DisableKSL(0). 2026-09-18T19:28:46.639 [KSL] OnPlatformUpdate: hr=[0x8000000a] Type=[1] KslServiceExists=[1] KslActive=[1] KslState=[2] 2026-09-18T19:28:46.639 Updated service WdAiNisDrv start type from: 4, to: 3 2026-09-18T19:28:46.654 [PlatUpd] DlpActive 0, CopyAccActive 0 2026-09-18T19:28:46.654 [PlatUpd] PlatformUpdate is now allowed. Resuming platform update from C:\Windows\SystemTemp\8D8A9874-7C63-438E-BF05-71EB9EC565B4. 2026-09-18T19:28:46.654 [PlatUpd] NewLocation set to [C:\Windows\SystemTemp\8D8A9874-7C63-438E-BF05-71EB9EC565B4] to indicate we are in the middle of an update. 2026-09-18T19:28:46.701 Task(-RestartService) launched as PPL process 2026-09-18T19:28:46.701 Job Notification: New process added to job (7160) 2026-09-18T19:28:46.701 Job Notification: New process added to job (8188) -------------------------------------------------------------------------------- Microsoft Defender Antivirus (77BDAF73-B396-481F-9042-AD358843EC24) Service Log Started On 09-18-2026 19:28:51 ************************************************************ OS install time: 01/03/2024 14:58:11.0 UTC Current time: 09/18/2026 19:28:51.15705800 UTC (1556519531 ms since boot) 2026-09-18T19:28:51.076 MpEnsureProcessMitigationPolicy(0x7) returns 0x1 2026-09-18T19:28:51.076 [HybridMode] isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-18T19:28:51.076 ProductId: 2, ProductFeature: 0, LaunchedProtected: 3, IsWcos: 0, IsContainerOs: 0, DirtyShutdownDetected: 0, PassiveRemediation: 0, IsHybridModePolicyEnabled: 0, IsVerifiedAndReputableTrustModeEnabled: 0 2026-09-18T19:28:51.092 [WPP] Starting WPP trace with buffersize 4MB, maxfilesize: 16MB, filename: MpWppTracing-20260918-192851-00000003-fffffffeffffffff.bin ... 2026-09-18T19:28:51.092 [WPP] Trace session started - MpWppTracing-20260918-192851-00000003-fffffffeffffffff.bin 2026-09-18T19:28:51.092 MpReinforceExclusionsAcls from LoadCapability: (hr = 0) 2026-09-18T19:28:51.092 [RbM] Rollback manager succesfully initialized. 2026-09-18T19:28:51.092 [RbM] Rollback manager EnableRollbackManager called. 2026-09-18T19:28:51.108 [RbM] Rollback manager EnableRollbackManager completed. 2026-09-18T19:28:51.108 [PlatUpd] Stage 1 - Starting platform update from %ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-18T19:28:53.092 [PlatUpd] Updated service binary of WdNisSvc from "%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.3-0\NisSrv.exe" to "%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\NisSrv.exe" 2026-09-18T19:28:53.092 [PlatUpd] Updated driver binary link C:\Windows\system32\drivers\wd\WdAiNisDrv.sys to C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\Drivers\WdAiNisDrv.sys 2026-09-18T19:28:53.092 [PlatUpd] Updated driver binary link C:\Windows\system32\drivers\wd\WdBoot.sys to C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\Drivers\WdBoot.sys 2026-09-18T19:28:53.092 [PlatUpd] Updated driver binary link C:\Windows\system32\drivers\wd\WdFilter.sys to C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\Drivers\WdFilter.sys 2026-09-18T19:28:53.092 [PlatUpd] Updated driver binary link C:\Windows\system32\drivers\wd\WdNisDrv.sys to C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\Drivers\WdNisDrv.sys 2026-09-18T19:28:53.311 [PlatUpd] Updated driver binary link C:\Windows\system32\drivers\wd\WdDevFlt.sys to C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\Drivers\WdDevFlt.sys 2026-09-18T19:28:54.514 [PlatUpd] Updated SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32[(default)] from "%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpOav.dll" to "%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpOav.dll" 2026-09-18T19:28:54.514 [PlatUpd] Updated SOFTWARE\WOW6432Node\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32[(default)] from "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\X86\MpOav.dll" to "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\X86\MpOav.dll" 2026-09-18T19:28:54.529 [PlatUpd] MpAddMpUxRegistration succeeded 2026-09-18T19:28:54.529 [PlatUpd] MpManagementUpdateHandler: starting update for install path %ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0. 2026-09-18T19:28:54.529 [PlatUpd] MpManagementUpdateHandler: calling MpUpdateManagement() 2026-09-18T19:28:54.529 [PlatUpd] MpUpdateManagement: Management platform update started for components (3) 2026-09-18T19:28:54.529 [PlatUpd] Defender MDM CSP platform update not supported on Server SKUs 2026-09-18T19:28:54.529 [PlatUpd] WMI/PS provider platform update started 2026-09-18T19:28:54.529 [PlatUpd] Powershell module update started: ConfigDefender -> C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ConfigDefender 2026-09-18T19:28:54.529 [PlatUpd] Powershell module update completed: ConfigDefender -> C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ConfigDefender 2026-09-18T19:28:54.529 [PlatUpd] Powershell module update started: ConfigDefender -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigDefender 2026-09-18T19:28:54.545 [PlatUpd] Powershell module update completed: ConfigDefender -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigDefender 2026-09-18T19:28:54.545 [PlatUpd] Powershell module update started: ConfigDefenderPerformance -> C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ConfigDefenderPerformance 2026-09-18T19:28:54.545 [PlatUpd] Powershell module update completed: ConfigDefenderPerformance -> C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ConfigDefenderPerformance 2026-09-18T19:28:54.545 [PlatUpd] Powershell module update started: ConfigDefenderPerformance -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigDefenderPerformance 2026-09-18T19:28:54.545 [PlatUpd] Powershell module update completed: ConfigDefenderPerformance -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigDefenderPerformance 2026-09-18T19:28:54.811 [PlatUpd] WMI repository update completed 2026-09-18T19:28:54.811 [PlatUpd] Updated SOFTWARE\Classes\CLSID\{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}\InprocServer32[(default)] from "%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.3-0\ProtectionManagement.dll" to "%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\ProtectionManagement.dll" 2026-09-18T19:28:54.811 [PlatUpd] Unload current WMI provider so that new instance can be loaded 2026-09-18T19:28:54.920 [PlatUpd] WMI/PS provider platform update completed 2026-09-18T19:28:54.920 [PlatUpd] MpUpdateManagement: Management platform update completed 2026-09-18T19:28:54.951 [PlatUpd] Firewall rules updated for %ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe 2026-09-18T19:28:54.951 [PlatUpd] MpCheckAndUpdateBinaryLocationTo(%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0): 10 items checked, 7 required update. hrMui: 0x1 hrEtw: 0 2026-09-18T19:28:54.951 [PlatUpd] Stage 1 - NewLocation updated from C:\Windows\SystemTemp\8D8A9874-7C63-438E-BF05-71EB9EC565B4 to C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 to indicate we are in the middle of an update 2026-09-18T19:28:54.951 [PlatUpd] Stage 1 - Service binary path updated to "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe". 2026-09-18T19:28:54.951 [PlatUpd] Stage 1 - Removed BlockedLocation [C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0] to indicate we are loaded successfully. 2026-09-18T19:28:54.983 Task(-RestartService) launched as PPL process 2026-09-18T19:28:54.983 MpPostPlatformUpdate is requesting a service restart. We will abort the current service start -------------------------------------------------------------------------------- Microsoft Defender Antivirus (77BDAF73-B396-481F-9042-AD358843EC24) Service Log Started On 09-18-2026 19:28:55 ************************************************************ OS install time: 01/03/2024 14:58:11.0 UTC Current time: 09/18/2026 19:28:55.142501500 UTC (1556523656 ms since boot) 2026-09-18T19:28:55.139 MpEnsureProcessMitigationPolicy(0x7) returns 0x1 2026-09-18T19:28:55.139 [HybridMode] isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-18T19:28:55.139 ProductId: 2, ProductFeature: 0, LaunchedProtected: 3, IsWcos: 0, IsContainerOs: 0, DirtyShutdownDetected: 0, PassiveRemediation: 0, IsHybridModePolicyEnabled: 0, IsVerifiedAndReputableTrustModeEnabled: 0 2026-09-18T19:28:55.154 [WPP] Starting WPP trace with buffersize 4MB, maxfilesize: 16MB, filename: MpWppTracing-20260918-192855-00000003-fffffffeffffffff.bin ... 2026-09-18T19:28:55.154 [WPP] Trace session started - MpWppTracing-20260918-192855-00000003-fffffffeffffffff.bin 2026-09-18T19:28:55.154 MpReinforceExclusionsAcls from LoadCapability: (hr = 0) 2026-09-18T19:28:55.154 [RbM] Rollback manager succesfully initialized. 2026-09-18T19:28:55.154 [RbM] Rollback manager EnableRollbackManager called. 2026-09-18T19:28:55.154 [RbM] Rollback manager EnableRollbackManager completed. 2026-09-18T19:28:55.154 [PlatUpd] Stage 2 - Service started from new location. Removed NewLocation value: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 2026-09-18T19:28:55.154 [PlatUpd] [Catalog] Catalog installer only supported on client OS. No further processing required. 2026-09-18T19:28:55.154 [PlatUpd] Stage 2 - Updated BackupLocation to C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0. 2026-09-18T19:28:55.186 [PlatUpd] MpRemoveMpUxRegistration failed (Ignored). hr = 0x800401f0 2026-09-18T19:28:55.186 [RbM] Platform LKG candidate becoming LKG: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0. 2026-09-18T19:28:55.311 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-18T19:28:55.326 [PlatUpd] Stage 2 - ReinforceServiceAcl (hr = 0) 2026-09-18T19:28:55.326 [PlatUpd] Stage 2 - Readded platform files to MOAC after ACL and Trust Label enforcement. hr=0 2026-09-18T19:28:55.326 MdCoreSvc is supported in this platform and OS 2026-09-18T19:28:55.326 MdCoreSvc is supported in this platform and OS 2026-09-18T19:28:55.326 [PlatUpd] MDCoreSvc is supported by the version of the platform we are switching to. Making sure the service is registered with SCM 2026-09-18T19:28:55.326 [PlatUpd] Updated service binary of MDCoreSvc from "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MpDefenderCoreService.exe" to "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpDefenderCoreService.exe" 2026-09-18T19:28:55.326 [PlatUpd] Because we updated service binary, and MdCoreSvc service was already running, we need to restart the service 2026-09-18T19:28:56.342 [WSC] MpPostPlatformUpdate: Initializing WSC library early on normal platform startup (before MpCheckAndUpdateBinaryLocationTo) 2026-09-18T19:28:57.873 [PlatUpd] MpAddMpUxRegistration succeeded 2026-09-18T19:28:57.873 [PlatUpd] MpManagementUpdateHandler: starting update for install path %ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0. 2026-09-18T19:28:57.873 [PlatUpd] MpManagementUpdateHandler: calling MpUpdateManagement() 2026-09-18T19:28:57.873 [PlatUpd] MpUpdateManagement: Management platform update started for components (3) 2026-09-18T19:28:57.873 [PlatUpd] Defender MDM CSP platform update not supported on Server SKUs 2026-09-18T19:28:57.873 [PlatUpd] WMI/PS provider platform update started 2026-09-18T19:28:57.873 [PlatUpd] WMI/PS provider platform update not required 2026-09-18T19:28:57.873 [PlatUpd] MpUpdateManagement: Management platform update completed 2026-09-18T19:28:57.873 [PlatUpd] MpCheckAndUpdateBinaryLocationTo(%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0): 10 items checked, 0 required update. hrMui: 0x1 hrEtw: 0 2026-09-18T19:28:57.873 [TS] Troubleshooting mode is not available! 2026-09-18T19:28:57.873 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: False 2026-09-18T19:28:57.873 CheckProductDisabled(fWaitWSC: 1, fRemoveConfigs: 0) ... 2026-09-18T19:28:57.873 Service is asked to be reenabled. 2026-09-18T19:28:57.920 Task(-EnableService) launched as PPL process 2026-09-18T19:28:57.920 [Service] Enabling IOAV/IEV/ShellExt/EtwLogger registrations ... 2026-09-18T19:28:57.920 [Service] Enabling AutoLoggers ... 2026-09-18T19:28:57.936 DefenderApiLogger stopped successfully. 2026-09-18T19:28:57.936 DefenderApiLogger already stopped. 2026-09-18T19:28:57.936 DefenderApiLogger started successfully. 2026-09-18T19:28:57.951 DefenderApiLoggerLowPriv started successfully. 2026-09-18T19:28:57.951 [Service] Enabling AMSI registration ... 2026-09-18T19:28:57.951 [Service] Leaving EnableIOAVWorker(1, 0) with hr = 0 2026-09-18T19:28:57.951 Cache C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\654A635C-0000-0000-0000-500600000000-1.bin loaded.**********Cache stats************ No. Of buckets -> 61033 Each Bucket has max capacity of -> 1 entries number of Entries is 44350 Number of invalid entries is 0 Number of inserts issued is 736043 Number of replaces issued is 0 Number of insert failures is 7 Number of inserts with duplicate entries is 3351 Number of lookups is 75548686 Number of lookup misses is 2533406 Number of fast lookup misses is 17281807 Number of false fast lookups is 2533404 Number of invalidations is 394204 Number of maintenance invalidations is 89828 Current File Size is 1499136 Journal ID = 1d864ae105a6246 Trusted image state = 4 USN = 1171c7 Setup boot count = 2 2026-09-18T19:28:57.951 Verifying license file... 2026-09-18T19:28:57.951 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\msmplics.dll]. File not in cache (0x1) 2026-09-18T19:28:57.967 Verified [C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\msmplics.dll] 2026-09-18T19:28:57.983 SharedSignatureRoot not configured. Disabling remote image load for msmpeng.exe. Once disabled, it can no longer be enabled without a service restart. hr=0x1 2026-09-18T19:28:57.983 Loaded module#0 MpComServer. 2026-09-18T19:28:57.983 Loaded module#1 StartupPolicies. 2026-09-18T19:28:57.983 Loaded module#2 DefenderBranding. 2026-09-18T19:28:57.983 [SCC][CID=1556526500_3672] Initializing SCC (phase: PreEngine) 2026-09-18T19:28:57.983 [SCC][CID=1556526500_3672] Early (pre-engine) SCC init disabled by feature control; deferring to Phase 2 2026-09-18T19:28:57.983 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: False 2026-09-18T19:28:57.983 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 2026-09-18T19:28:57.983 COM server initialized successfully. 2026-09-18T19:28:57.998 MpRefreshDefenderCoreConfigs: failed because engine is not ready, we cannot let the process continue because we might start core service while its configuration is not ready. 2026-09-18T19:28:58.026 [Plugin] Verifying C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\mprtp.dll ... 2026-09-18T19:28:58.026 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\mprtp.dll] due to PPL. 2026-09-18T19:28:58.076 [RTP] [RTP] FilterCommunicator object 0x0000016F84B0FD80 initialized (\MicrosoftMalwareProtectionAsyncPortWD, , ), threads: 0 normal, 0 very low, 0 alt, thread pool threads: 4 normal, 0 very low, 0 alt 2026-09-18T19:28:58.076 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-18T19:28:58.076 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-18T19:28:58.076 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-18T19:28:58.076 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-18T19:28:58.076 [RTP] Setting RegLinkHardeningMode to 0 (hr=0). 2026-09-18T19:28:58.076 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-18T19:28:58.076 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-18T19:28:58.076 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-18T19:28:58.076 [RTP] Setting PreventPagingFileAbuse to 1 (hr=0). 2026-09-18T19:28:58.076 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-18T19:28:58.076 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-18T19:28:58.076 [RTP] [RTP] FilterCommunicator object 0x0000016F84B0FF80 initialized (\MicrosoftMalwareProtectionPortWD, \MicrosoftMalwareProtectionVeryLowIoPortWD, \MicrosoftMalwareProtectionRemoteIoPortWD), threads: 6 normal, 2 very low, 0 alt, thread pool threads: 0 normal, 0 very low, 6 alt 2026-09-18T19:28:58.076 [RTP] SyncDssAvailableThreads cap limit initialized by MiscConfig to: 14 2026-09-18T19:28:58.076 [RTP] [RtpCopyAccelerator] Windows19H1 1, WindowsCobalt 0, IsServerSKU 1, IsPassiveOrSideBySidePassiveMode 0, IsDevMode 0, fIsWindowsInhouseBuild 0, BuildLabEx 20348.1.amd64fre.fe_release.210507-1500 2026-09-18T19:28:58.076 [RTP] [RTP] StartCommunication 0x0000016F84B0FD80 (\MicrosoftMalwareProtectionAsyncPortWD, ), threads: 0 normal, 0 very low, 0 alt, thread pool threads: 4 normal, 0 very low, 0 alt 2026-09-18T19:28:58.076 [init][RTP] RTPPlugin initialization completed 2026-09-18T19:28:58.076 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\mpnirtp.dll] due to PPL. 2026-09-18T19:28:58.092 [RTP] [NiRTP] CNiRtpPlugin::Initialize completed successfully 2026-09-18T19:28:58.092 [init][NiRTP] NiRTPPlugin initialization completed 2026-09-18T19:28:58.092 OS boot count = 2 2026-09-18T19:28:58.092 OS Install = 0 2026-09-18T19:28:58.108 [ManagedAgent] HooksInitialize: skipped (unsupported platform) 2026-09-18T19:28:58.108 [init] MpAddMpUxRegistrationForToast failed (Ignored). hr = 0x8000401a 2026-09-18T19:28:58.108 [KSL] Entering CKSLEngine::Initialize. 2026-09-18T19:28:58.108 [KSL] Leaving CKSLEngine::Initialize(0). 2026-09-18T19:28:58.108 [KSL] Entering CKSLEngine::EnableKSL. State: [1] 2026-09-18T19:28:58.108 [KSL] MpInstallKslD: hr=0 2026-09-18T19:28:58.108 [KSL] MpRegisterKslD: hr=0 2026-09-18T19:28:58.126 [KSL] MpStartKslD: hr=0 2026-09-18T19:28:58.126 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-18T19:28:58.126 Loading engine... 2026-09-18T19:28:58.126 Verifying engine and signature files (source: 1) ... 2026-09-18T19:28:58.126 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpengine.dll] due to PPL. 2026-09-18T19:28:58.126 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpasbase.vdm]. File not in cache (0x1) 2026-09-18T19:28:59.108 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpasbase.vdm] 2026-09-18T19:28:59.108 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpasdlta.vdm] (file in cache) 2026-09-18T19:28:59.108 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpavbase.vdm]. File not in cache (0x1) 2026-09-18T19:28:59.561 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpavbase.vdm] 2026-09-18T19:28:59.561 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpavdlta.vdm] (file in cache) 2026-09-18T19:28:59.592 [Engine] IsHybridMode: 0 2026-09-18T19:28:59.592 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-18T19:28:59.592 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-4DC35AB4C0FCEDD113A747E6EC036B2C792ED383.bin): 0x00000002 2026-09-18T19:28:59.608 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-4DC35AB4C0FCEDD113A747E6EC036B2C792ED383.bin) 2026-09-18T19:28:59.608 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-18T19:28:59.608 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-18T19:28:59.608 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-18T19:28:59.608 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-18T19:29:10.342 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-18T19:29:10.342 [AutoExclusion] Applied roles from cache. 2026-09-18T19:29:10.342 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-18T19:29:10.358 [Engine] New active engine 00007FFCF68AB020 (no old engine). Number of active engines: 1 2026-09-18T19:29:10.358 EngineInit:Global ASOC is enabled 2026-09-18T19:29:10.358 EngineInit:ASOO is enabled for developer volumes 2026-09-18T19:29:10.436 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-18T19:29:10.436 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.436 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.451 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:29:10.483 MpWriteUupSignatureVersion 1.459.256.0, hr = 0 2026-09-18T19:29:10.483 [SigStatUpd] CSignatureStatus: back to good 2026-09-18T19:29:10.483 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-18T19:29:10.530 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-18T19:29:10.530 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-18T19:29:10.530 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-18T19:29:10.530 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-18T19:29:10.545 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-18T19:29:10.545 [Plugin] Initializing RTP plugin state... 2026-09-18T19:29:10.545 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-18T19:29:10.545 [RTP] ****************************RTP Perf Log*************************** RTP Start:N/A Last Perf:(null) First RTP Scan:N/A Plugin States: AV:2 AS:2 RTP:2 OA:2 BM:2 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:0 System File Cache: Hits:0 Misses:0 BM Queue:0,0,0 Proc:0,0,0 File:0,0,0 NamedPipe:0,0,0 Plugin Queue:0,0,0 Threat:0,0,0 Susp:0,0,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,1,0 SetEngine:1,1,0 SetState:0,0,0 SetUser:0,0,0 Config:0,0,0 ProcExcl:0,0,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:0 Pending:0 RegSize:2882 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:2102 AsyncQCurrent:0 BMFlags:8 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:30 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:65 TotalHits:0 InstanceCacheInserts:1 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:1 InstanceCacheMisses:31 InstanceCacheOverflows:0 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:-1ms (0/0) Success: 0, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-18T19:29:10.545 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA} 2026-09-18T19:29:10.545 [SCC][CID=1556526500_3672] [1DS] SCCState hr=0x0 msg={"error":"","hr":"0x0","init":false,"source":"None","state":"None"} 2026-09-18T19:29:10.545 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-18T19:29:10.545 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-18T19:29:10.545 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-18T19:29:10.545 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-18T19:29:10.545 Engine loaded! 2026-09-18T19:29:10.545 [DLP] Create FeatureControlState instance 2026-09-18T19:29:10.545 Engine:Failure in process enumeration: Image:, Error:GetImageNameConfigurationEx, 0x80078020, PID: 0 2026-09-18T19:29:10.545 Engine:Failure in process enumeration: Image:, Error:GetImageNameConfigurationEx, 0x80078020, PID: 4 2026-09-18T19:29:10.561 [SCC][CID=1556526500_3672] Initializing SCC (phase: PostEngine) 2026-09-18T19:29:10.561 [SCC][CID=1556526500_3672] SCC Initialize! The feature is OFF on this machine (E5 = 0), hr: 0x80004001 2026-09-18T19:29:10.561 RegisterSModeChangeListener: hr = 0x1 2026-09-18T19:29:10.561 RegisterHybridModeChangeListener: hr = 0 2026-09-18T19:29:10.561 [PlatUpd] Updated install location from C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\ to C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\ 2026-09-18T19:29:10.576 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-18T19:29:10.670 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-18T19:29:10.670 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 2026-09-18T19:29:10.670 [AutoPurge] Auto purger task is scheduled to run in 600000(ms) from now with period 86400000(ms) 2026-09-18T19:29:10.670 [SigReleaseHb] Initialized with Stage 0 2026-09-18T19:29:10.670 [EmergencySigManager] Emergency sig checks are currently disabled. Timer interval: 15 minutes. 2026-09-18T19:29:10.686 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-18T19:29:10.686 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-18T19:29:10.686 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-18T19:29:10.686 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-18T19:29:10.686 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-18T19:29:10.686 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-18T19:29:10.686 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-18T19:29:10.686 [RTP] Generating the base plugin configuration ... 2026-09-18T19:29:10.686 [RTP] Path exclusion changed, new size in bytes: 2 2026-09-18T19:29:10.686 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-18T19:29:10.686 [RTP] Calling GenerateEngineConfigStruct (0x3e) ... 2026-09-18T19:29:10.686 [RTP] [RTP] RTPPlugin state has changed as follow: ASStatus:0->1, AVStatus:0->1, RTPStatus:0->1 2026-09-18T19:29:10.686 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-18T19:29:10.686 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-18T19:29:10.686 [NRI] Stopping NIS service ... 2026-09-18T19:29:10.686 [RTP] [RTP] Killbits updated: 0x200000000000000 -> 0x4000000 2026-09-18T19:29:10.686 [RTP] [RTP] LastAccessTimeSuppression is enabled (default behavior). 2026-09-18T19:29:10.686 [RTP] [RTP] StartCommunication 0x0000016F84B0FF80 (\MicrosoftMalwareProtectionPortWD, \MicrosoftMalwareProtectionVeryLowIoPortWD), threads: 6 normal, 2 very low, 0 alt, thread pool threads: 0 normal, 0 very low, 6 alt 2026-09-18T19:29:10.686 Updated service WdAiNisDrv start type from: 3, to: 4 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.256.0 AV Signature Version: 1.459.256.0 ************************************************************ 2026-09-18T19:29:10.686 Ci Endpoint Security Policy Installation: Unsupported, hr = 0x00000001 2026-09-18T19:29:10.686 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-18T19:29:10.686 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-18T19:29:10.686 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-18T19:29:10.686 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-18T19:29:10.686 MdCoreSvc is supported in this platform and OS 2026-09-18T19:29:10.686 [WSC] WSCReconcile InitComplete v=1 succeeded=1 tentativeOnReported=0 2026-09-18T19:29:10.701 [RTP] [RTP] RTP worker threads ready [6 threads] 2026-09-18T19:29:10.701 Trying to initialize resource usage monitoring... 2026-09-18T19:29:10.726 Resource usage Monitoring is enabled 2026-09-18T19:29:10.748 Job Notification: New process added to job (7504) 2026-09-18T19:29:10.748 [RTP] [Mini-filter] First scan on a volume: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\NisSrv.exe 2026-09-18T19:29:10.983 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b IDynamicConfig::ReportChange value=EnableSmsEmsOnArm64_MpRamp new=False oldTrue IDynamicConfig::ReportChange value=MpFC_CoreSvcEnableUpdateLogging new=0 old1 IDynamicConfig::ReportChange value=MpDisableBmHealthOneDsEvent new=False oldTrue 2026-09-18T19:29:10.998 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-18T19:29:10.998 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-18T19:29:10.998 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-18T19:29:10.998 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-18T19:29:10.998 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-18T19:29:10.998 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-18T19:29:10.998 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-18T19:29:11.186 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T19:29:11.186 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T19:29:11.186 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T19:29:11.186 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T19:29:11.186 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T19:29:13.764 [RTP] Duplicating the current plugin configuration object... 2026-09-18T19:29:13.764 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-18T19:29:13.764 [RTP] Updating plugin configuration due to recent config changes (0x600) ... 2026-09-18T19:29:13.764 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-18T19:29:13.764 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x600, Changed: 0x218 2026-09-18T19:29:57.967 Process scan (poststartupscan) started. 2026-09-18T19:29:57.967 Process scan (poststartupscan) completed. 2026-09-18T19:29:58.467 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-18T19:29:58.467 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-18T19:30:01.045 [RTP] Duplicating the current plugin configuration object... 2026-09-18T19:30:01.045 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-18T19:30:01.045 [RTP] Updating plugin configuration due to recent config changes (0x400) ... 2026-09-18T19:30:01.045 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-18T19:30:01.045 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x400, Changed: 0x218 2026-09-18T19:34:10.406 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-18T19:34:10.672 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T19:39:10.674 Timer callback: Initializating/verifying scheduled tasks ... 2026-09-18T19:39:10.674 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-18T19:39:10.690 Job Notification: New process added to job (2224) 2026-09-18T19:39:10.721 Job Notification: New process added to job (2568) 2026-09-18T19:39:10.768 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:2224] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:2568]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-18T19:39:10.799 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-18T19:39:10.862 Task(Scan -ScheduleJob -RestrictPrivileges -ScanType 2 -ScanTrigger 52) is scheduled to run in 26796986(ms) from now at 05:05 (03:05 UTC) with period 86400000(ms). Daily task start time is randomized to reduce spikes. 2026-09-18T19:39:10.862 [TaskUpdate] Run lost signature update scheduled job: SignatureUpdate -ScheduleJob -RestrictPrivileges 2026-09-18T19:39:10.862 [TaskUpdate] Run lost signature update scheduled job: SignatureUpdate -ScheduleJob -RestrictPrivileges 2026-09-18T19:39:10.893 Job Notification: New process added to job (5624) 2026-09-18T19:39:10.893 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-18T19:39:10.893 Job Notification: New process added to job (7196) 2026-09-18T19:39:10.925 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-18T19:39:10.925 Job Notification: New process added to job (6352) 2026-09-18T19:39:10.925 Job Notification: New process added to job (4676) 2026-09-18T19:39:10.940 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:5624] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7196]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-18T19:39:10.955 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:6352] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:4676]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-18T19:39:10.987 Job Notification: Process exited from job (5624) 2026-09-18T19:39:10.987 Job Notification: Process exited from job (7196) 2026-09-18T19:39:10.987 [TaskUpdate] MpCmdRun process completed before completion signal is received 2026-09-18T19:39:21.034 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\17777E54-7C1D-484F-837D-10E8AFBAAE9513d0.1dd47a56546f601 2026-09-18T19:39:21.112 Verifying engine and signature files (source: 0) ... 2026-09-18T19:39:21.112 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730}\mpengine.dll] due to PPL. 2026-09-18T19:39:21.112 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730}\mpasbase.vdm]. File not in cache (0x1) 2026-09-18T19:39:22.080 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730}\mpasbase.vdm] 2026-09-18T19:39:22.080 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-18T19:39:22.096 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730}\mpasdlta.vdm] 2026-09-18T19:39:22.096 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730}\mpavbase.vdm]. File not in cache (0x1) 2026-09-18T19:39:22.518 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730}\mpavbase.vdm] 2026-09-18T19:39:22.518 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-18T19:39:22.549 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730}\mpavdlta.vdm] 2026-09-18T19:39:22.705 [Engine] IsHybridMode: 0 2026-09-18T19:39:22.705 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-18T19:39:22.721 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-91E1E5DD17BE2A68BD518198BCA5B6E4CF92B433.bin): 0x00000002 2026-09-18T19:39:22.721 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-91E1E5DD17BE2A68BD518198BCA5B6E4CF92B433.bin) 2026-09-18T19:39:22.721 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-18T19:39:22.721 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-18T19:39:22.721 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-18T19:39:22.721 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-18T19:39:34.565 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-18T19:39:34.565 [AutoExclusion] Applied roles from cache. 2026-09-18T19:39:34.565 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-18T19:39:34.659 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF68AB020, lRefCount: 6, hr=0 2026-09-18T19:39:34.659 [Engine] New active engine 00007FFCF4ABB020 replacing engine 00007FFCF68AB020. Number of active engines: 2 2026-09-18T19:39:34.674 EngineInit:Global ASOC is enabled 2026-09-18T19:39:34.674 EngineInit:ASOO is enabled for developer volumes 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.752 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-18T19:39:34.784 MpWriteUupSignatureVersion 1.459.273.0, hr = 0 2026-09-18T19:39:34.784 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-18T19:39:34.815 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-18T19:39:34.815 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-18T19:39:34.815 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-18T19:39:34.815 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-18T19:39:34.830 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-18T19:39:34.830 [Plugin] Initializing RTP plugin state... 2026-09-18T19:39:34.830 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-18T19:39:34.830 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎18‎-‎2026 21:29:10 Last Perf:‎09‎-‎18‎-‎2026 21:29:10 First RTP Scan:‎09‎-‎18‎-‎2026 21:29:10 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:105 Misses:119 BM Queue:0,12,0 Proc:0,12,0 File:0,4,0 NamedPipe:0,0,0 Plugin Queue:0,0,0 Threat:0,0,0 Susp:0,0,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,4,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:3618 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:703458 AsyncQCurrent:0 BMFlags:40127 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:259 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:522 TotalHits:2191 InstanceCacheInserts:2 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:1 InstanceCacheMisses:577 InstanceCacheOverflows:0 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:6ms (135/20) Success: 20, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-18T19:39:34.830 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730} 2026-09-18T19:39:34.830 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8319D6B8-C068-4771-957A-6B57084AF35F} removed 2026-09-18T19:39:34.830 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA}\mpasbase.vdm in use, hr=0x80070020 2026-09-18T19:39:34.830 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-18T19:39:34.830 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-18T19:39:34.830 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-18T19:39:34.830 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-18T19:39:34.830 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-18T19:39:34.846 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-18-2026 19:39:34 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-18-2026 19:39:34 2026-09-18T19:39:34.846 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-18T19:39:34.846 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-18T19:39:34.846 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-18T19:39:34.846 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-18T19:39:34.846 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-18T19:39:34.846 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-18T19:39:34.846 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-18T19:39:34.846 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-18T19:39:34.846 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-18T19:39:34.846 MdCoreSvc is supported in this platform and OS Signature updated on 09-18-2026 19:39:34 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.273.0 AV Signature Version: 1.459.273.0 ************************************************************ 2026-09-18T19:39:34.862 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-18T19:39:34.862 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\17777E54-7C1D-484F-837D-10E8AFBAAE9513d0.1dd47a56546f601 2026-09-18T19:39:34.925 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-18T19:39:34.925 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-18-2026 19:39:35 ************************************************************ 2026-09-18T19:39:35.034 Job Notification: Process exited from job (2224) 2026-09-18T19:39:35.034 Job Notification: Process exited from job (2568) 2026-09-18T19:39:35.034 Job Notification: Process exited from job (6352) 2026-09-18T19:39:35.049 Job Notification: Process exited from job (4676) 2026-09-18T19:39:35.112 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-18T19:39:35.112 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-18T19:39:35.127 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-18T19:39:35.127 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-18T19:39:35.127 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-18T19:39:35.127 [Engine] Engine 00007FFCF68AB020 no longer in use. Number of active engines: 1 2026-09-18T19:39:35.127 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-18T19:39:35.127 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-18T19:39:35.237 ProcessImageName: svchost.exe, Pid: 8136, TotalTime: 1280, Count: 2, MaxTime: 812, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 51% 2026-09-18T19:39:35.237 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 578, Count: 40, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mamCAL\config.inc.php, EstimatedImpact: 0% 2026-09-18T19:39:35.237 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 196, Count: 15, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-18T19:39:35.237 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 122, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification->(UTF-16LE), EstimatedImpact: 71% 2026-09-18T19:39:35.237 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-18T19:39:35.268 [Engine] RSIG_UNLOADENGINE, 00007FFCF68AB020, err=0x0 2026-09-18T19:39:35.284 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FA778C71-DECA-45A4-8A34-4357855B90BA} removed 2026-09-18T19:39:35.299 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-18T19:39:35.299 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-18T19:39:35.299 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-18T19:39:57.971 Process scan (postsignatureupdatescan) started. 2026-09-18T19:40:11.534 Process scan (postsignatureupdatescan) completed. 2026-09-18T19:44:34.722 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-18T19:49:15.679 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T20:04:20.684 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T20:07:41.406 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T20:07:41.406 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T20:07:41.406 [Cloud] Queued cloud request. 2026-09-18T20:07:41.406 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T20:07:41.406 [Cloud] Dequeued cloud request. 2026-09-18T20:07:41.406 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T20:07:41.828 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{42B8136D-089C-1E42-8D9F-72BF40B42938} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 20:07:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T20:07:42.344 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T20:10:15.298 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T20:10:15.298 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T20:10:15.298 [Cloud] Queued cloud request. 2026-09-18T20:10:15.298 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T20:10:15.298 [Cloud] Dequeued cloud request. 2026-09-18T20:10:15.298 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T20:10:15.455 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D48995AF-8CAC-96EE-E3D1-8EED2FE6F8E4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 20:10:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T20:10:15.955 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T20:13:47.924 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T20:13:47.924 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T20:13:47.924 [Cloud] Queued cloud request. 2026-09-18T20:13:47.924 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T20:13:47.924 [Cloud] Dequeued cloud request. 2026-09-18T20:13:47.924 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{E30E4C7C-DEB9-B496-5669-D07585F9261B} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 20:13:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T20:13:52.940 [Cloud] SubmitReport(CMpBmSpyNetReportContext) 2026-09-18T20:13:52.940 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T20:13:52.940 [Cloud] Queued cloud request. 2026-09-18T20:13:52.940 [Cloud] Dequeued cloud request. 2026-09-18T20:13:52.940 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T20:13:53.033 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-18T20:13:53.033 [Cloud] End of cloud request. 2026-09-18T20:13:53.549 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T20:13:53.658 [Cloud] End of cloud request. 2026-09-18T20:13:54.174 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T20:19:25.693 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T20:34:30.700 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T20:37:53.108 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T20:37:53.108 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T20:37:53.108 [Cloud] Queued cloud request. 2026-09-18T20:37:53.108 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T20:37:53.108 [Cloud] Dequeued cloud request. 2026-09-18T20:37:53.108 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T20:37:53.311 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D4E7C6AA-0004-8DC9-CF2E-918DA6B314CA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 20:37:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T20:37:53.811 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T20:48:29.707 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T20:48:29.707 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T20:48:29.707 [Cloud] Queued cloud request. 2026-09-18T20:48:29.707 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T20:48:29.707 [Cloud] Dequeued cloud request. 2026-09-18T20:48:29.707 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T20:48:29.894 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6BAF23B6-CD3C-8798-AF7B-04B01788C318} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 20:48:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T20:48:30.410 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T20:49:35.707 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T20:52:38.458 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T20:52:38.458 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T20:52:38.458 [Cloud] Queued cloud request. 2026-09-18T20:52:38.458 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T20:52:38.458 [Cloud] Dequeued cloud request. 2026-09-18T20:52:38.458 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T20:52:38.661 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D61EF8C5-3769-CB11-A26E-A466626322E6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 20:52:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T20:52:39.161 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T20:54:29.334 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T20:54:29.334 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T20:54:29.334 [Cloud] Queued cloud request. 2026-09-18T20:54:29.334 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T20:54:29.334 [Cloud] Dequeued cloud request. 2026-09-18T20:54:29.334 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T20:54:29.537 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D29E79FD-3A3B-8FF1-BBF6-B70AA5C4BC0B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 20:54:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T20:54:30.038 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T21:04:40.713 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T21:07:05.762 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T21:07:05.762 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T21:07:05.762 [Cloud] Queued cloud request. 2026-09-18T21:07:05.762 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T21:07:05.762 [Cloud] Dequeued cloud request. 2026-09-18T21:07:05.762 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T21:07:05.949 [Cloud] End of cloud request. 2026-09-18T21:07:06.465 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T21:11:24.528 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T21:11:24.528 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T21:11:24.528 [Cloud] Queued cloud request. 2026-09-18T21:11:24.528 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T21:11:24.528 [Cloud] Dequeued cloud request. 2026-09-18T21:11:24.528 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T21:11:24.669 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{977E0F90-3C2E-02CF-21B5-03869A2C323B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 21:11:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T21:11:25.185 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T21:19:17.283 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T21:19:17.283 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T21:19:17.283 [Cloud] Queued cloud request. 2026-09-18T21:19:17.283 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T21:19:17.283 [Cloud] Dequeued cloud request. 2026-09-18T21:19:17.283 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T21:19:17.455 [Cloud] End of cloud request. 2026-09-18T21:19:17.971 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T21:19:45.721 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T21:34:50.727 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T21:35:08.805 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T21:35:08.805 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T21:35:08.805 [Cloud] Queued cloud request. 2026-09-18T21:35:08.805 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T21:35:08.805 [Cloud] Dequeued cloud request. 2026-09-18T21:35:08.805 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T21:35:08.992 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CBEAE651-80A8-0539-4AF1-C1F588FE60AC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 21:35:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T21:35:09.492 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T21:35:15.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T21:35:15.445 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T21:35:15.445 [Cloud] Queued cloud request. 2026-09-18T21:35:15.445 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T21:35:15.445 [Cloud] Dequeued cloud request. 2026-09-18T21:35:15.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T21:35:15.524 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1C4D56CA-57E4-B6D7-2B55-E2CF8E3931A3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 21:35:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T21:35:16.039 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T21:39:34.714 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 3906, Count: 249, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\menu.html, EstimatedImpact: 0% 2026-09-18T21:39:34.714 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 2152, Count: 180, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-18T21:39:34.714 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-18T21:39:34.714 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-18T21:39:34.714 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-18T21:39:34.714 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-18T21:39:34.714 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-18T21:39:34.714 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-18T21:39:34.714 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-18T21:39:34.714 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-18T21:39:34.714 ProcessImageName: taskhostw.exe, Pid: 6400, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-18T21:39:34.714 ProcessImageName: ngentask.exe, Pid: 7364, TotalTime: 0, Count: 5, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 0% 2026-09-18T21:49:55.734 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T21:50:13.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T21:50:13.672 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T21:50:13.672 [Cloud] Queued cloud request. 2026-09-18T21:50:13.672 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T21:50:13.672 [Cloud] Dequeued cloud request. 2026-09-18T21:50:13.672 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T21:50:13.859 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9402CFFF-E7F2-3E44-213F-3CDA89C88F2F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 21:50:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T21:50:14.375 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T22:02:42.490 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T22:02:42.490 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T22:02:42.490 [Cloud] Queued cloud request. 2026-09-18T22:02:42.490 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T22:02:42.490 [Cloud] Dequeued cloud request. 2026-09-18T22:02:42.490 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T22:02:42.677 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1E1F9F67-28B2-070D-EC38-D5C6B75AAD02} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 22:02:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T22:02:43.193 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T22:05:00.740 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T22:15:09.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T22:15:09.088 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T22:15:09.088 [Cloud] Queued cloud request. 2026-09-18T22:15:09.088 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T22:15:09.088 [Cloud] Dequeued cloud request. 2026-09-18T22:15:09.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T22:15:09.228 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D186E265-23F8-50A2-F2DE-E6AE16E3FD71} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 22:15:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T22:15:09.728 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T22:20:05.747 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T22:35:10.754 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T22:35:17.566 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T22:35:17.566 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T22:35:17.566 [Cloud] Queued cloud request. 2026-09-18T22:35:17.566 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T22:35:17.566 [Cloud] Dequeued cloud request. 2026-09-18T22:35:17.566 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T22:35:17.707 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9D195F94-5F98-8FF5-D824-C7E699CD1EEA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 22:35:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T22:35:18.207 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T22:36:26.832 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T22:36:26.832 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T22:36:26.832 [Cloud] Queued cloud request. 2026-09-18T22:36:26.832 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T22:36:26.832 [Cloud] Dequeued cloud request. 2026-09-18T22:36:26.832 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T22:36:28.004 [Cloud] End of cloud request. 2026-09-18T22:36:28.504 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T22:44:42.725 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T22:44:42.725 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T22:44:42.725 [Cloud] Queued cloud request. 2026-09-18T22:44:42.725 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T22:44:42.725 [Cloud] Dequeued cloud request. 2026-09-18T22:44:42.725 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T22:44:42.882 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{708C5084-2B00-C7B6-EA85-ED0F8BCB396E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 22:44:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T22:44:43.397 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T22:47:23.697 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T22:47:23.697 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T22:47:23.697 [Cloud] Queued cloud request. 2026-09-18T22:47:23.697 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T22:47:23.697 [Cloud] Dequeued cloud request. 2026-09-18T22:47:23.697 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T22:47:33.838 [Cloud] End of cloud request. 2026-09-18T22:47:34.354 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T22:50:15.760 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T23:05:20.766 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T23:09:29.237 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T23:09:29.237 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T23:09:29.237 [Cloud] Queued cloud request. 2026-09-18T23:09:29.237 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T23:09:29.237 [Cloud] Dequeued cloud request. 2026-09-18T23:09:29.237 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T23:09:29.394 [Cloud] End of cloud request. 2026-09-18T23:09:29.894 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T23:17:36.913 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T23:17:36.913 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T23:17:36.913 [Cloud] Queued cloud request. 2026-09-18T23:17:36.913 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T23:17:36.913 [Cloud] Dequeued cloud request. 2026-09-18T23:17:36.913 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T23:17:37.054 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7C5E31FC-6E6C-1C6E-899A-B6152F7BCA12} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 23:17:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T23:17:37.554 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T23:20:25.773 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T23:21:31.602 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T23:21:31.602 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T23:21:31.602 [Cloud] Queued cloud request. 2026-09-18T23:21:31.602 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T23:21:31.602 [Cloud] Dequeued cloud request. 2026-09-18T23:21:31.602 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T23:21:31.758 [Cloud] End of cloud request. 2026-09-18T23:21:32.258 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T23:24:32.650 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T23:24:32.650 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T23:24:32.650 [Cloud] Queued cloud request. 2026-09-18T23:24:32.650 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T23:24:32.650 [Cloud] Dequeued cloud request. 2026-09-18T23:24:32.650 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T23:24:42.728 [Cloud] End of cloud request. 2026-09-18T23:24:43.228 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T23:29:01.371 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T23:29:01.371 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T23:29:01.371 [Cloud] Queued cloud request. 2026-09-18T23:29:01.371 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T23:29:01.371 [Cloud] Dequeued cloud request. 2026-09-18T23:29:01.371 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T23:29:01.527 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F3596F6-771F-238A-6768-23BCE79725EF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 23:29:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T23:29:02.027 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{43C7BFF6-6793-8DFD-A2F0-F4CB2E8E2CBF} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-18-2026 23:30:16 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T23:30:17.294 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T23:30:17.294 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T23:30:17.294 [Cloud] Queued cloud request. 2026-09-18T23:30:17.294 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T23:30:17.294 [Cloud] Dequeued cloud request. 2026-09-18T23:30:17.294 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T23:30:17.590 [Cloud] End of cloud request. 2026-09-18T23:30:18.090 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T23:34:30.591 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T23:34:30.591 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T23:34:30.591 [Cloud] Queued cloud request. 2026-09-18T23:34:30.591 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T23:34:30.762 [Cloud] Dequeued cloud request. 2026-09-18T23:34:30.762 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T23:34:30.919 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A12D70D1-3CA4-A3B9-B122-58DD9F1707BF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 23:34:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T23:34:31.434 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T23:35:30.778 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-18T23:36:16.685 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T23:36:16.685 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T23:36:16.685 [Cloud] Queued cloud request. 2026-09-18T23:36:16.685 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T23:36:16.685 [Cloud] Dequeued cloud request. 2026-09-18T23:36:16.685 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T23:36:16.826 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{428A1069-24DF-F26D-D699-5C6E9A00F49F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 23:36:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T23:36:17.326 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T23:39:34.782 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 8896, Count: 600, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0% 2026-09-18T23:39:34.782 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 4077, Count: 353, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-18T23:39:34.782 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-18T23:39:34.782 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 1121, Count: 68, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-18T23:39:34.782 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-18T23:39:34.782 ProcessImageName: AgentShellService.exe, Pid: 6300, TotalTime: 665, Count: 24, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-18T23:39:34.782 ProcessImageName: WmiPrvSE.exe, Pid: 5900, TotalTime: 494, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-18T23:39:34.782 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 195, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-18T23:39:34.782 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-18T23:39:34.782 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-18T23:39:34.782 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-18T23:39:34.782 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-18T23:39:34.782 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-18T23:39:34.782 ProcessImageName: powershell.exe, Pid: 4980, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-18T23:39:34.782 ProcessImageName: taskhostw.exe, Pid: 6400, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-18T23:39:34.782 ProcessImageName: ngentask.exe, Pid: 7364, TotalTime: 0, Count: 5, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 0% 2026-09-18T23:40:12.766 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T23:40:12.766 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T23:40:12.766 [Cloud] Queued cloud request. 2026-09-18T23:40:12.766 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T23:40:12.766 [Cloud] Dequeued cloud request. 2026-09-18T23:40:12.766 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T23:40:12.907 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D70D9117-AA97-2F00-5B83-AD73451C6A5B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 23:40:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T23:40:13.407 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T23:43:51.470 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T23:43:51.470 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T23:43:51.470 [Cloud] Queued cloud request. 2026-09-18T23:43:51.470 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T23:43:51.470 [Cloud] Dequeued cloud request. 2026-09-18T23:43:51.470 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T23:43:51.611 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{64884760-30BD-6BEA-39EF-2F69DB129EB5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 23:43:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T23:43:52.111 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T23:49:46.489 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-18T23:49:46.489 [Cloud] Start of cloud request. Passive mode: 0 2026-09-18T23:49:46.489 [Cloud] Queued cloud request. 2026-09-18T23:49:46.489 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-18T23:49:46.489 [Cloud] Dequeued cloud request. 2026-09-18T23:49:46.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-18T23:49:46.677 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{67D50130-BEF3-DBF0-3C91-C09F3DFB7280} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-18-2026 23:49:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-18T23:49:47.208 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-18T23:50:35.786 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T00:00:10.728 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T00:00:10.728 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T00:00:10.728 [Cloud] Queued cloud request. 2026-09-19T00:00:10.728 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T00:00:10.728 [Cloud] Dequeued cloud request. 2026-09-19T00:00:10.728 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T00:00:10.916 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{628BE80F-8C87-65D8-25F6-D226807304F5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 00:00:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T00:00:11.416 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T00:01:51.572 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T00:01:51.572 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T00:01:51.572 [Cloud] Queued cloud request. 2026-09-19T00:01:51.572 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T00:01:51.572 [Cloud] Dequeued cloud request. 2026-09-19T00:01:51.572 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T00:01:51.713 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AC7A9CFB-B23A-0D91-40C7-62F8069786D9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 00:01:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T00:01:52.229 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T00:05:40.792 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T00:20:45.798 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T00:34:05.288 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T00:34:05.288 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T00:34:05.288 [Cloud] Queued cloud request. 2026-09-19T00:34:05.288 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T00:34:05.288 [Cloud] Dequeued cloud request. 2026-09-19T00:34:05.288 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T00:34:05.476 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{209CCE60-EBF0-B6C3-A603-A856C3301B3D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 00:34:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T00:34:05.976 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T00:35:50.805 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T00:50:21.014 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T00:50:21.014 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T00:50:21.014 [Cloud] Queued cloud request. 2026-09-19T00:50:21.014 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T00:50:21.014 [Cloud] Dequeued cloud request. 2026-09-19T00:50:21.014 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T00:50:21.202 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DE7284CE-77C9-E0B2-1311-0724F7F003DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 00:50:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T00:50:21.717 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T00:50:55.811 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T00:51:06.280 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T00:51:06.280 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T00:51:06.280 [Cloud] Queued cloud request. 2026-09-19T00:51:06.280 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T00:51:06.280 [Cloud] Dequeued cloud request. 2026-09-19T00:51:06.280 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T00:51:06.389 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D3CF042D-2CBB-989A-C1E9-B2C33DEBE3FE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 00:51:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T00:51:06.905 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T00:53:21.217 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T00:53:21.217 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T00:53:21.217 [Cloud] Queued cloud request. 2026-09-19T00:53:21.217 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T00:53:21.217 [Cloud] Dequeued cloud request. 2026-09-19T00:53:21.217 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T00:53:21.389 [Cloud] End of cloud request. 2026-09-19T00:53:21.889 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T00:56:22.344 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T00:56:22.344 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T00:56:22.344 [Cloud] Queued cloud request. 2026-09-19T00:56:22.344 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T00:56:22.344 [Cloud] Dequeued cloud request. 2026-09-19T00:56:22.344 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T00:56:22.516 [Cloud] End of cloud request. 2026-09-19T00:56:23.031 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T01:00:02.269 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111137, FileId: 0x1800000003f4a4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.269 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111138, FileId: 0x2700000003ea94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.285 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111143, FileId: 0x1a00000003f4a4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.285 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111144, FileId: 0x2900000003ea94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.300 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111150, FileId: 0x1c00000003f4a4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.300 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111149, FileId: 0x2b00000003ea94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.316 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111155, FileId: 0x1e00000003f4a4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.316 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111156, FileId: 0x2d00000003ea94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.316 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111161, FileId: 0x2000000003f4a4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.316 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111162, FileId: 0x2f00000003ea94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.332 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111167, FileId: 0x2200000003f4a4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.332 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111168, FileId: 0x3100000003ea94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.347 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111173, FileId: 0x2400000003f4a4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.347 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111174, FileId: 0x3300000003ea94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.347 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111179, FileId: 0x2600000003f4a4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.347 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111180, FileId: 0x3500000003ea94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.363 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111185, FileId: 0x2800000003f4a4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.363 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111186, FileId: 0x3700000003ea94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.363 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111191, FileId: 0x2a00000003f4a4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.363 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111192, FileId: 0x3900000003ea94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.378 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111197, FileId: 0x2c00000003f4a4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.378 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111198, FileId: 0x3b00000003ea94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.394 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111204, FileId: 0x3d00000003ea94, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:00:02.394 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #111203, FileId: 0x2e00000003f4a4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T01:02:03.082 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T01:02:03.082 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T01:02:03.082 [Cloud] Queued cloud request. 2026-09-19T01:02:03.082 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T01:02:03.269 [Cloud] Dequeued cloud request. 2026-09-19T01:02:03.269 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T01:02:03.457 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9AB56DEE-1E55-812B-995E-075E343C8AFF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 01:02:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T01:02:03.957 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T01:06:00.816 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T01:07:42.397 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T01:07:42.397 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T01:07:42.397 [Cloud] Queued cloud request. 2026-09-19T01:07:42.397 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T01:07:42.397 [Cloud] Dequeued cloud request. 2026-09-19T01:07:42.397 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T01:07:42.600 [Cloud] End of cloud request. 2026-09-19T01:07:43.100 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T01:11:23.398 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T01:11:23.398 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T01:11:23.398 [Cloud] Queued cloud request. 2026-09-19T01:11:23.398 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T01:11:23.398 [Cloud] Dequeued cloud request. 2026-09-19T01:11:23.398 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T01:11:23.585 [Cloud] End of cloud request. 2026-09-19T01:11:24.085 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T01:14:47.993 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T01:14:47.993 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T01:14:47.993 [Cloud] Queued cloud request. 2026-09-19T01:14:47.993 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T01:14:47.993 [Cloud] Dequeued cloud request. 2026-09-19T01:14:47.993 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T01:14:48.180 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7D60325D-29A6-2642-009C-6AD9F6EC52AD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 01:14:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T01:14:48.680 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T01:16:07.696 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T01:16:07.696 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T01:16:07.696 [Cloud] Queued cloud request. 2026-09-19T01:16:07.696 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T01:16:07.696 [Cloud] Dequeued cloud request. 2026-09-19T01:16:07.696 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T01:16:07.915 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{453D9FCC-7EE9-2DDE-5868-A8C5190DD7E4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 01:16:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T01:16:08.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T01:19:07.949 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:84FACA9D-32B5-4BFA-A08D-9C5E08691C60, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-19T01:19:07.949 Scheduled scan with Id 84FACA9D-32B5-4BFA-A08D-9C5E08691C60 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-19T01:19:07.949 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-19T01:19:07.949 [SFC] System file cache build is not needed (already completed) 2026-09-19T01:19:29.261 Engine:Triggered AR EMS scan 2026-09-19T01:19:29.261 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.277 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.277 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.292 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.292 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.308 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.308 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.324 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.339 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.339 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.339 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.339 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.355 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.355 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.355 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.371 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.371 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.386 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.386 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.386 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.386 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.402 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.402 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.402 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.402 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.417 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.433 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.433 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.449 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.449 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.449 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.464 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.464 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.464 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.480 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.480 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.496 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.496 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.511 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.511 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.511 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.511 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.527 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.527 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.542 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.542 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.542 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.558 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.574 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.574 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.574 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.574 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.589 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.589 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.589 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.589 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.605 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.605 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.621 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.636 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:19:29.636 Engine:EMS scan for process: svchost pid: 8060, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-19T01:20:16.886 QuickScan:ScanID:84FACA9D-32B5-4BFA-A08D-9C5E08691C60: Quick scan finished with error 0 2026-09-19T01:20:17.402 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-19T01:20:17.402 [RTP] Duplicating the current plugin configuration object... 2026-09-19T01:20:17.402 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-19T01:20:17.402 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-19T01:20:17.402 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-19T01:20:17.402 [RTP] No config change detected. Not updating plugin configuration. 2026-09-19T01:20:17.402 [RTP] No config changes found. No configuration switch. 2026-09-19T01:20:17.402 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-19T01:21:05.824 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T01:24:06.872 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T01:24:06.872 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T01:24:06.872 [Cloud] Queued cloud request. 2026-09-19T01:24:06.872 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T01:24:06.872 [Cloud] Dequeued cloud request. 2026-09-19T01:24:06.872 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T01:24:07.060 [Cloud] End of cloud request. 2026-09-19T01:24:07.560 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T01:36:10.830 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T01:39:34.848 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 10086, Count: 654, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0% 2026-09-19T01:39:34.848 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 4077, Count: 353, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T01:39:34.848 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 3242, Count: 261, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-19T01:39:34.848 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-19T01:39:34.848 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-19T01:39:34.848 ProcessImageName: AgentShellService.exe, Pid: 6300, TotalTime: 665, Count: 24, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-19T01:39:34.848 ProcessImageName: WmiPrvSE.exe, Pid: 5900, TotalTime: 494, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-19T01:39:34.848 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 286, Count: 25, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-19T01:39:34.848 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T01:39:34.848 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-19T01:39:34.848 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2.MAI, EstimatedImpact: 48% 2026-09-19T01:39:34.848 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T01:39:34.848 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T01:39:34.848 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T01:39:34.848 ProcessImageName: powershell.exe, Pid: 4980, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-19T01:39:34.848 ProcessImageName: mysqldump.exe, Pid: 7852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 12% 2026-09-19T01:39:34.848 ProcessImageName: taskhostw.exe, Pid: 6400, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-19T01:39:34.848 ProcessImageName: cmd.exe, Pid: 3304, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-19T01:39:34.848 ProcessImageName: ngentask.exe, Pid: 7364, TotalTime: 0, Count: 5, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 0% 2026-09-19T01:51:15.837 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T02:06:20.843 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T02:21:25.849 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T02:36:30.856 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T02:51:11.846 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T02:51:11.846 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T02:51:11.846 [Cloud] Queued cloud request. 2026-09-19T02:51:11.846 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T02:51:11.846 [Cloud] Dequeued cloud request. 2026-09-19T02:51:11.846 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T02:51:12.049 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B4527D85-F166-5E7C-2A76-89E94D103080} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 02:51:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T02:51:12.549 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T02:51:35.862 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T03:06:40.869 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T03:07:07.056 [AutoPurge] Cleanup Routine tasks have started. 2026-09-19T03:07:07.056 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-19T03:07:07.056 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-19T03:07:07.056 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-19T03:07:07.056 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-19T03:07:07.056 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-19T03:07:07.056 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-19T03:07:07.056 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-19T03:07:07.056 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-19T03:07:07.072 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-19-2026 03:07:07 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-19-2026 03:07:07 2026-09-19T03:07:07.072 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-19T03:07:07.072 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-19T03:07:07.072 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-19T03:07:07.072 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-19T03:07:07.072 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-19T03:07:07.119 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-19T03:07:07.119 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-19T03:07:07.197 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-19T03:07:07.197 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-19T03:07:07.212 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-19T03:07:07.212 [AutoPurge] Removing expired default signature package ... 2026-09-19T03:07:07.447 Job Notification: New process added to job (3048) 2026-09-19T03:07:08.150 Job Notification: Process exited from job (3048) 2026-09-19T03:07:08.212 [AutoPurge] Verification Routine tasks have ended. 2026-09-19T03:07:43.339 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T03:07:43.339 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T03:07:43.339 [Cloud] Queued cloud request. 2026-09-19T03:07:43.339 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T03:07:43.339 [Cloud] Dequeued cloud request. 2026-09-19T03:07:43.339 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T03:07:50.948 [Cloud] End of cloud request. 2026-09-19T03:07:51.448 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-19T03:07:51.464 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:07:51.464 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-19T03:07:51.464 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-19T03:07:51.464 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-19T03:07:51.464 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-19T03:07:51.464 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-19T03:07:51.464 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-19T03:07:51.464 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-19T03:07:51.464 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-19T03:07:51.464 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-19T03:07:51.464 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-19T03:07:51.464 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-19T03:07:51.464 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-19T03:07:51.464 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-19T03:07:51.464 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-19T03:07:51.464 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-19T03:07:51.464 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-19T03:07:51.464 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-19T03:07:51.464 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-19T03:07:51.464 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-19T03:07:51.464 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-19T03:07:51.464 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:07:51.479 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:07:51.479 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:07:51.479 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:07:54.042 [RTP] Duplicating the current plugin configuration object... 2026-09-19T03:07:54.042 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-19T03:07:54.042 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-19T03:07:54.042 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-19T03:07:54.042 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-19T03:07:54.042 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-19T03:11:25.417 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T03:11:25.417 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T03:11:25.417 [Cloud] Queued cloud request. 2026-09-19T03:11:25.417 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T03:11:25.417 [Cloud] Dequeued cloud request. 2026-09-19T03:11:25.417 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T03:11:25.558 [Cloud] End of cloud request. 2026-09-19T03:11:26.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:12:31.200 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T03:12:31.200 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T03:12:31.200 [Cloud] Queued cloud request. 2026-09-19T03:12:31.200 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T03:12:31.200 [Cloud] Dequeued cloud request. 2026-09-19T03:12:31.200 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T03:12:31.340 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{00F68500-3B70-E133-577C-CB1964779875} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 03:12:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T03:12:31.856 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:21:45.875 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T03:25:23.126 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T03:25:23.126 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T03:25:23.126 [Cloud] Queued cloud request. 2026-09-19T03:25:23.126 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T03:25:23.126 [Cloud] Dequeued cloud request. 2026-09-19T03:25:23.126 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T03:25:23.563 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A15FCC66-9005-E61C-CA43-1B0C764A20D2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 03:25:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T03:25:24.064 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:30:17.067 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T03:30:17.067 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T03:30:17.067 [Cloud] Queued cloud request. 2026-09-19T03:30:17.067 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T03:30:17.067 [Cloud] Dequeued cloud request. 2026-09-19T03:30:17.067 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T03:30:17.254 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{38EBC1D1-66A8-1A57-BF42-841D86D2757A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 03:30:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T03:30:17.754 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:33:53.912 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T03:33:53.912 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T03:33:53.912 [Cloud] Queued cloud request. 2026-09-19T03:33:53.912 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T03:33:53.912 [Cloud] Dequeued cloud request. 2026-09-19T03:33:53.912 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T03:33:54.349 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DC7116B6-3E64-0C27-ADC7-079FAEAA3C8B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 03:33:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T03:33:54.849 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:34:16.990 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T03:34:16.990 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T03:34:16.990 [Cloud] Queued cloud request. 2026-09-19T03:34:16.990 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T03:34:16.990 [Cloud] Dequeued cloud request. 2026-09-19T03:34:16.990 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T03:34:17.068 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6DF86E1C-20F5-D269-0B5C-967F76FB0E8B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 03:34:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T03:34:17.584 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:36:50.881 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T03:39:34.914 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 12872, Count: 885, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0% 2026-09-19T03:39:34.914 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 5281, Count: 455, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-19T03:39:34.914 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 4077, Count: 353, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T03:39:34.914 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-19T03:39:34.914 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-19T03:39:34.914 ProcessImageName: AgentShellService.exe, Pid: 6300, TotalTime: 665, Count: 24, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-19T03:39:34.914 ProcessImageName: WmiPrvSE.exe, Pid: 5900, TotalTime: 494, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-19T03:39:34.914 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 346, Count: 29, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-19T03:39:34.914 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T03:39:34.914 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-19T03:39:34.914 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 76, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T03:39:34.914 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T03:39:34.914 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 52, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2.MAI, EstimatedImpact: 48% 2026-09-19T03:39:34.914 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T03:39:34.914 ProcessImageName: DeviceCensus.exe, Pid: 8100, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 4% 2026-09-19T03:39:34.914 ProcessImageName: powershell.exe, Pid: 4980, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-19T03:39:34.914 ProcessImageName: mysqldump.exe, Pid: 7852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 12% 2026-09-19T03:39:34.914 ProcessImageName: taskhostw.exe, Pid: 6400, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-19T03:39:34.914 ProcessImageName: cmd.exe, Pid: 3304, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-19T03:39:34.914 ProcessImageName: ngentask.exe, Pid: 7364, TotalTime: 0, Count: 5, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 0% 2026-09-19T03:43:14.135 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T03:43:14.135 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T03:43:14.135 [Cloud] Queued cloud request. 2026-09-19T03:43:14.135 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T03:43:14.135 [Cloud] Dequeued cloud request. 2026-09-19T03:43:14.135 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T03:43:14.338 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8187CF87-225D-433B-6027-AECAAEA2E34E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 03:43:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T03:43:14.838 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:50:43.481 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T03:50:43.481 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T03:50:43.481 [Cloud] Queued cloud request. 2026-09-19T03:50:43.481 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T03:50:43.481 [Cloud] Dequeued cloud request. 2026-09-19T03:50:43.481 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T03:50:43.668 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F0A65075-9BAB-B792-A1FB-17EB9C9C4C2F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 03:50:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T03:50:44.184 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T03:51:55.887 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T03:52:43.840 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T03:52:43.840 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T03:52:43.840 [Cloud] Queued cloud request. 2026-09-19T03:52:43.840 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T03:52:43.840 [Cloud] Dequeued cloud request. 2026-09-19T03:52:43.840 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T03:52:44.028 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{14F17430-E7C6-FACC-39CB-A339DB6D1C17} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 03:52:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T03:52:44.528 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T04:00:42.095 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T04:00:42.095 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T04:00:42.095 [Cloud] Queued cloud request. 2026-09-19T04:00:42.095 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T04:00:42.095 [Cloud] Dequeued cloud request. 2026-09-19T04:00:42.095 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T04:00:52.282 [Cloud] End of cloud request. 2026-09-19T04:00:52.782 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T04:07:00.894 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T04:22:05.901 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T04:34:51.561 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T04:34:51.561 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T04:34:51.561 [Cloud] Queued cloud request. 2026-09-19T04:34:51.561 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T04:34:51.561 [Cloud] Dequeued cloud request. 2026-09-19T04:34:51.561 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T04:34:51.764 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AF50D2BA-6EED-B693-169A-B5220A8873EA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 04:34:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T04:34:52.264 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T04:37:10.906 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T04:52:15.912 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T05:07:20.919 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T05:22:25.926 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T05:30:43.601 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T05:30:43.601 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T05:30:43.601 [Cloud] Queued cloud request. 2026-09-19T05:30:43.601 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T05:30:43.601 [Cloud] Dequeued cloud request. 2026-09-19T05:30:43.601 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T05:30:43.804 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B33A70F5-ABB4-1E08-86DB-997CC7F7E619} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 05:30:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T05:30:44.304 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T05:37:30.932 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T05:39:34.980 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 17859, Count: 1311, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0% 2026-09-19T05:39:34.980 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 7496, Count: 651, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-19T05:39:34.980 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 4077, Count: 353, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T05:39:34.980 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-19T05:39:34.980 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-19T05:39:34.980 ProcessImageName: AgentShellService.exe, Pid: 6300, TotalTime: 665, Count: 24, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-19T05:39:34.980 ProcessImageName: WmiPrvSE.exe, Pid: 5900, TotalTime: 494, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-19T05:39:34.980 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 346, Count: 29, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-19T05:39:34.980 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T05:39:34.980 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2.MAI, EstimatedImpact: 0% 2026-09-19T05:39:34.980 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-19T05:39:34.980 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 76, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T05:39:34.980 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T05:39:34.980 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T05:39:34.980 ProcessImageName: DeviceCensus.exe, Pid: 8100, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 4% 2026-09-19T05:39:34.980 ProcessImageName: powershell.exe, Pid: 4980, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-19T05:39:34.980 ProcessImageName: mysqldump.exe, Pid: 7852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 12% 2026-09-19T05:39:34.980 ProcessImageName: taskhostw.exe, Pid: 6400, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-19T05:39:34.980 ProcessImageName: cmd.exe, Pid: 3304, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-19T05:39:34.980 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-19T05:39:34.980 ProcessImageName: ngentask.exe, Pid: 7364, TotalTime: 0, Count: 5, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 0% 2026-09-19T05:52:35.937 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T06:04:34.022 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T06:04:34.022 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T06:04:34.022 [Cloud] Queued cloud request. 2026-09-19T06:04:34.022 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T06:04:34.022 [Cloud] Dequeued cloud request. 2026-09-19T06:04:34.022 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T06:04:34.178 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8712C27B-D4EC-5C15-9B6C-CB776F714A94} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 06:04:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T06:04:34.678 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T06:07:40.945 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T06:18:32.512 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T06:18:32.512 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T06:18:32.512 [Cloud] Queued cloud request. 2026-09-19T06:18:32.512 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T06:18:32.512 [Cloud] Dequeued cloud request. 2026-09-19T06:18:32.512 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T06:18:32.747 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D7E8E221-E83F-0ADD-71C0-43C43DDF5EFF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 06:18:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T06:18:33.262 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T06:22:45.950 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T06:33:43.314 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T06:33:43.314 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T06:33:43.314 [Cloud] Queued cloud request. 2026-09-19T06:33:43.314 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T06:33:43.314 [Cloud] Dequeued cloud request. 2026-09-19T06:33:43.314 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T06:33:43.470 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{00A1636B-07B8-660F-73A7-8D6AE9B3C146} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 06:33:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T06:33:43.970 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T06:37:50.958 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T06:45:04.617 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T06:45:04.617 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T06:45:04.617 [Cloud] Queued cloud request. 2026-09-19T06:45:04.617 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T06:45:04.617 [Cloud] Dequeued cloud request. 2026-09-19T06:45:04.617 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T06:45:04.820 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{73B936D0-2982-E4B2-E12E-C3ACC6754E8B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 06:45:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T06:45:05.320 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T06:52:55.964 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T07:08:00.971 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T07:23:05.975 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T07:27:04.978 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T07:27:04.978 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T07:27:04.978 [Cloud] Queued cloud request. 2026-09-19T07:27:04.978 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T07:27:04.978 [Cloud] Dequeued cloud request. 2026-09-19T07:27:04.978 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T07:27:05.181 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D87C10AD-5714-1C40-3BC1-EA1A6CF993C0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 07:27:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T07:27:05.681 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T07:28:09.683 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T07:28:09.683 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T07:28:09.683 [Cloud] Queued cloud request. 2026-09-19T07:28:09.683 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T07:28:09.683 [Cloud] Dequeued cloud request. 2026-09-19T07:28:09.683 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T07:28:09.854 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3853293D-DF66-B82A-4976-CB6372A37CB1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 07:28:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T07:28:10.370 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T07:28:24.167 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T07:28:24.167 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T07:28:24.167 [Cloud] Queued cloud request. 2026-09-19T07:28:24.167 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T07:28:24.167 [Cloud] Dequeued cloud request. 2026-09-19T07:28:24.167 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T07:28:24.245 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{007C9EBB-F169-4109-23F1-A39990BD2CEA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 07:28:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T07:28:24.761 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T07:29:35.433 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T07:29:35.433 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T07:29:35.433 [Cloud] Queued cloud request. 2026-09-19T07:29:35.433 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T07:29:35.433 [Cloud] Dequeued cloud request. 2026-09-19T07:29:35.433 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T07:29:45.558 [Cloud] End of cloud request. 2026-09-19T07:29:46.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T07:36:42.918 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T07:36:42.918 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T07:36:42.918 [Cloud] Queued cloud request. 2026-09-19T07:36:42.918 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T07:36:42.918 [Cloud] Dequeued cloud request. 2026-09-19T07:36:42.918 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T07:36:43.106 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CC5F7DA0-BF2F-65F1-C5D8-33C449C9B15B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 07:36:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T07:36:43.622 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T07:38:10.983 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T07:39:35.031 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 18729, Count: 1354, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0% 2026-09-19T07:39:35.031 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 9693, Count: 844, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-19T07:39:35.031 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 4077, Count: 353, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T07:39:35.031 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-19T07:39:35.031 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-19T07:39:35.031 ProcessImageName: AgentShellService.exe, Pid: 6300, TotalTime: 665, Count: 24, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-19T07:39:35.031 ProcessImageName: WmiPrvSE.exe, Pid: 5900, TotalTime: 494, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-19T07:39:35.031 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 422, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-19T07:39:35.031 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T07:39:35.031 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T07:39:35.031 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2.MAI, EstimatedImpact: 0% 2026-09-19T07:39:35.031 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-19T07:39:35.031 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 90, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T07:39:35.031 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T07:39:35.031 ProcessImageName: DeviceCensus.exe, Pid: 8100, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 4% 2026-09-19T07:39:35.031 ProcessImageName: powershell.exe, Pid: 4980, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-19T07:39:35.031 ProcessImageName: mysqldump.exe, Pid: 7852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 12% 2026-09-19T07:39:35.031 ProcessImageName: taskhostw.exe, Pid: 6400, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-19T07:39:35.031 ProcessImageName: cmd.exe, Pid: 3304, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-19T07:39:35.031 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-19T07:39:35.031 ProcessImageName: ngentask.exe, Pid: 7364, TotalTime: 0, Count: 5, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 0% 2026-09-19T07:44:19.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T07:44:19.672 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T07:44:19.672 [Cloud] Queued cloud request. 2026-09-19T07:44:19.672 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T07:44:19.672 [Cloud] Dequeued cloud request. 2026-09-19T07:44:19.672 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T07:44:19.859 [Cloud] End of cloud request. 2026-09-19T07:44:20.359 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T07:53:15.990 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T08:04:43.822 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T08:04:43.822 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T08:04:43.822 [Cloud] Queued cloud request. 2026-09-19T08:04:43.822 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T08:04:43.822 [Cloud] Dequeued cloud request. 2026-09-19T08:04:43.822 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T08:04:44.040 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CDCEBE0D-887F-2C53-EE94-EBEE411191F3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 08:04:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T08:04:44.556 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T08:08:20.996 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T08:09:11.231 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T08:09:11.231 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T08:09:11.231 [Cloud] Queued cloud request. 2026-09-19T08:09:11.231 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T08:09:11.231 [Cloud] Dequeued cloud request. 2026-09-19T08:09:11.231 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T08:09:11.372 [Cloud] End of cloud request. 2026-09-19T08:09:11.872 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T08:12:33.466 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T08:12:33.466 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T08:12:33.466 [Cloud] Queued cloud request. 2026-09-19T08:12:33.466 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T08:12:33.466 [Cloud] Dequeued cloud request. 2026-09-19T08:12:33.466 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T08:12:33.622 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F744115-58E7-F357-8F4C-F4B9632712F1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 08:12:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T08:12:34.122 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T08:23:26.003 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T08:38:27.697 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T08:38:27.697 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T08:38:27.697 [Cloud] Queued cloud request. 2026-09-19T08:38:27.697 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T08:38:27.697 [Cloud] Dequeued cloud request. 2026-09-19T08:38:27.697 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T08:38:27.885 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D2FBC24E-1D23-634E-8686-126D0DF83A22} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 08:38:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T08:38:28.385 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T08:38:31.010 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T08:51:52.170 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T08:51:52.170 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T08:51:52.170 [Cloud] Queued cloud request. 2026-09-19T08:51:52.170 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T08:51:52.170 [Cloud] Dequeued cloud request. 2026-09-19T08:51:52.170 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T08:51:52.358 [Cloud] End of cloud request. 2026-09-19T08:51:52.858 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T08:53:36.014 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T08:54:53.220 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T08:54:53.220 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T08:54:53.220 [Cloud] Queued cloud request. 2026-09-19T08:54:53.220 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T08:54:53.220 [Cloud] Dequeued cloud request. 2026-09-19T08:54:53.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T08:54:53.407 [Cloud] End of cloud request. 2026-09-19T08:54:53.907 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T09:06:26.818 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T09:06:26.818 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T09:06:26.818 [Cloud] Queued cloud request. 2026-09-19T09:06:26.818 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T09:06:26.818 [Cloud] Dequeued cloud request. 2026-09-19T09:06:26.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T09:06:34.428 [Cloud] End of cloud request. 2026-09-19T09:06:34.943 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T09:08:41.023 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T09:09:29.851 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T09:09:29.851 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T09:09:29.851 [Cloud] Queued cloud request. 2026-09-19T09:09:29.851 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T09:09:29.851 [Cloud] Dequeued cloud request. 2026-09-19T09:09:29.851 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T09:09:30.086 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{946929C9-0118-624E-057C-A9E748BC57A4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 09:09:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T09:09:30.601 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T09:09:53.602 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T09:09:53.602 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T09:09:53.602 [Cloud] Queued cloud request. 2026-09-19T09:09:53.602 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T09:09:53.602 [Cloud] Dequeued cloud request. 2026-09-19T09:09:53.602 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T09:09:53.680 [Cloud] End of cloud request. 2026-09-19T09:09:54.195 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T09:10:57.961 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T09:10:57.961 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T09:10:57.961 [Cloud] Queued cloud request. 2026-09-19T09:10:57.961 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T09:10:57.961 [Cloud] Dequeued cloud request. 2026-09-19T09:10:57.961 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T09:10:58.133 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F3A43BDA-089F-C9D3-9E20-5AECD7E4415E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 09:10:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T09:10:58.633 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T09:12:43.447 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T09:12:43.447 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T09:12:43.447 [Cloud] Queued cloud request. 2026-09-19T09:12:43.447 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T09:12:43.447 [Cloud] Dequeued cloud request. 2026-09-19T09:12:43.447 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T09:12:43.634 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{04C74CD9-5CB6-D23B-E8AA-FEDEAE0AE3FB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 09:12:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T09:12:44.134 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T09:23:46.030 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T09:31:05.235 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T09:31:05.235 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T09:31:05.235 [Cloud] Queued cloud request. 2026-09-19T09:31:05.235 [Cloud] Dequeued cloud request. 2026-09-19T09:31:05.235 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T09:31:05.235 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T09:31:05.423 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{04705861-1016-8B90-56EB-D593AC9BAFC0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 09:31:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T09:31:05.923 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T09:37:29.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T09:37:29.145 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T09:37:29.145 [Cloud] Queued cloud request. 2026-09-19T09:37:29.145 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T09:37:29.145 [Cloud] Dequeued cloud request. 2026-09-19T09:37:29.145 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T09:37:29.348 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{05A5A6B6-64AB-12BA-AB68-884E59E7CFDE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 09:37:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T09:37:29.848 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T09:38:51.037 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T09:39:35.099 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 19872, Count: 1465, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0% 2026-09-19T09:39:35.099 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 11815, Count: 1039, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-19T09:39:35.099 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 4077, Count: 353, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T09:39:35.099 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-19T09:39:35.099 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-19T09:39:35.099 ProcessImageName: AgentShellService.exe, Pid: 6300, TotalTime: 665, Count: 24, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-19T09:39:35.099 ProcessImageName: WmiPrvSE.exe, Pid: 5900, TotalTime: 494, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-19T09:39:35.099 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 437, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-19T09:39:35.099 ProcessImageName: powershell.exe, Pid: 8176, TotalTime: 216, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-19T09:39:35.099 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T09:39:35.099 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T09:39:35.099 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2.MAI, EstimatedImpact: 0% 2026-09-19T09:39:35.099 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 105, Count: 11, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T09:39:35.099 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 91, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T09:39:35.099 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-19T09:39:35.099 ProcessImageName: python.exe, Pid: 7688, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-19T09:39:35.099 ProcessImageName: DeviceCensus.exe, Pid: 8100, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 4% 2026-09-19T09:39:35.099 ProcessImageName: powershell.exe, Pid: 4980, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-19T09:39:35.099 ProcessImageName: mysqldump.exe, Pid: 7852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 12% 2026-09-19T09:39:35.099 ProcessImageName: taskhostw.exe, Pid: 6400, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-19T09:39:35.099 ProcessImageName: cmd.exe, Pid: 3304, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-19T09:39:35.099 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-19T09:39:35.099 ProcessImageName: ngentask.exe, Pid: 7364, TotalTime: 0, Count: 5, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 0% 2026-09-19T09:51:06.870 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T09:51:06.870 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T09:51:06.870 [Cloud] Queued cloud request. 2026-09-19T09:51:06.870 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T09:51:06.870 [Cloud] Dequeued cloud request. 2026-09-19T09:51:06.870 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T09:51:07.057 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D6ADCE5C-F537-4F1B-398F-9DB97496AEF8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 09:51:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T09:51:07.557 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T09:53:56.044 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T10:02:36.124 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T10:02:36.124 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T10:02:36.124 [Cloud] Queued cloud request. 2026-09-19T10:02:36.124 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T10:02:36.124 [Cloud] Dequeued cloud request. 2026-09-19T10:02:36.124 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{057A33D4-8D61-59A1-F083-F8FE231331C7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 10:02:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T10:02:36.312 [Cloud] End of cloud request. 2026-09-19T10:02:36.812 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T10:04:54.391 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T10:04:54.391 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T10:04:54.391 [Cloud] Queued cloud request. 2026-09-19T10:04:54.391 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T10:04:54.391 [Cloud] Dequeued cloud request. 2026-09-19T10:04:54.391 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T10:04:54.578 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3D735CD8-3F3B-560F-A50F-6F731F110AA3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 10:04:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T10:04:55.078 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T10:09:01.051 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T10:11:52.849 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T10:11:52.849 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T10:11:52.849 [Cloud] Queued cloud request. 2026-09-19T10:11:52.849 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T10:11:52.849 [Cloud] Dequeued cloud request. 2026-09-19T10:11:52.849 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T10:11:53.099 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4758642F-F969-0148-EC2C-4532301A0451} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 10:11:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T10:11:53.614 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T10:12:59.427 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T10:12:59.427 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T10:12:59.427 [Cloud] Queued cloud request. 2026-09-19T10:12:59.427 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T10:12:59.427 [Cloud] Dequeued cloud request. 2026-09-19T10:12:59.427 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T10:12:59.583 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FE039E04-F290-C2CF-37ED-6B67CE4C8B40} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 10:12:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T10:13:00.083 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T10:24:06.058 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T10:32:54.748 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T10:32:54.748 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T10:32:54.748 [Cloud] Queued cloud request. 2026-09-19T10:32:54.748 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T10:32:54.748 [Cloud] Dequeued cloud request. 2026-09-19T10:32:54.748 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T10:32:54.935 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7027A20F-8692-0A56-CF8E-672E54DFEDB8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 10:32:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T10:32:55.435 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x0000157E64CB44FC, sigsha=7c0b559aa2db6c78a415037aa029894b41e6d3eb, cached=false, source=2, resourceid=0x772bc208 Internal signature match:subtype=Lowfi, sigseq=0x0000157E438D3445, sigsha=8ae8752b953590c958b0c8f046232237ead1313e, cached=false, source=2, resourceid=0x772bc208 Internal signature match:subtype=Lowfi, sigseq=0x0000157E44D6FE51, sigsha=57c5b33aed8fd23766000a3467a65f287bda9f45, cached=false, source=2, resourceid=0x772bc208 Internal signature match:subtype=Lowfi, sigseq=0x0000157E4BE8B987, sigsha=a147a1bd4255971ce0ff7ec275b37724ba8bd537, cached=false, source=2, resourceid=0x772bc208 Internal signature match:subtype=Lowfi, sigseq=0x0000157E62DAF59A, sigsha=412bb4ad89051211df5fa9b2f63557d107875d94, cached=false, source=2, resourceid=0x772bc208 Internal signature match:subtype=Lowfi, sigseq=0x0000157EEDC1FDAA, sigsha=957d8fbfe7987111d93ac432453760da86bb5a7d, cached=false, source=2, resourceid=0x772bc208 Internal signature match:subtype=Lowfi, sigseq=0x0000157EDBC612FC, sigsha=d5f1909a20fbb89ca049ea3ac446bcfd3acf514e, cached=false, source=2, resourceid=0x1c7b2e12 2026-09-19T10:33:51.624 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T10:33:51.624 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T10:33:51.624 [Cloud] Queued cloud request. 2026-09-19T10:33:51.624 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T10:33:51.624 [Cloud] Dequeued cloud request. 2026-09-19T10:33:51.624 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T10:33:51.702 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DA02288E-F6E5-8FCE-7CC1-32D94B37DEDA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 10:33:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T10:33:52.202 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T10:39:11.065 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T10:54:16.072 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T11:05:17.388 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T11:05:17.388 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T11:05:17.388 [Cloud] Queued cloud request. 2026-09-19T11:05:17.388 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T11:05:17.388 [Cloud] Dequeued cloud request. 2026-09-19T11:05:17.388 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T11:05:17.576 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{77E9B762-EF69-AAE6-A7E7-6D3ACE0DB6D5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 11:05:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T11:05:18.091 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T11:07:37.172 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T11:07:37.172 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T11:07:37.172 [Cloud] Queued cloud request. 2026-09-19T11:07:37.172 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T11:07:37.172 [Cloud] Dequeued cloud request. 2026-09-19T11:07:37.172 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T11:07:37.594 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{708340B5-709F-52A9-B026-CDEF0A09B0F2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 11:07:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T11:07:38.109 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T11:09:21.079 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T11:16:50.535 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T11:16:50.535 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T11:16:50.535 [Cloud] Queued cloud request. 2026-09-19T11:16:50.535 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T11:16:50.535 [Cloud] Dequeued cloud request. 2026-09-19T11:16:50.535 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T11:16:50.707 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{988EEFC1-4C2C-CD47-B7F3-690AE279CC78} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 11:16:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T11:16:51.223 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T11:24:26.086 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T11:24:27.383 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T11:24:27.383 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T11:24:27.383 [Cloud] Queued cloud request. 2026-09-19T11:24:27.383 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T11:24:27.383 [Cloud] Dequeued cloud request. 2026-09-19T11:24:27.383 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T11:24:27.524 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{669B1186-BA57-63AF-21B0-47FD16A3E870} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 11:24:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T11:24:28.039 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T11:37:24.749 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T11:37:24.749 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T11:37:24.749 [Cloud] Queued cloud request. 2026-09-19T11:37:24.749 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T11:37:24.749 [Cloud] Dequeued cloud request. 2026-09-19T11:37:24.749 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T11:37:24.921 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C76E113B-9A4C-5E22-A3FA-8099C79A2EF3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 11:37:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T11:37:25.436 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T11:39:20.609 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T11:39:20.609 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T11:39:20.609 [Cloud] Queued cloud request. 2026-09-19T11:39:20.609 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T11:39:20.609 [Cloud] Dequeued cloud request. 2026-09-19T11:39:20.609 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T11:39:20.750 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3DE7BFB7-7D87-7755-E8AB-43340A647647} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 11:39:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T11:39:21.250 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T11:39:31.094 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T11:39:35.156 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 23484, Count: 1810, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0% 2026-09-19T11:39:35.156 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 13858, Count: 1232, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-19T11:39:35.156 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 4077, Count: 353, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T11:39:35.156 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-19T11:39:35.156 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-19T11:39:35.156 ProcessImageName: AgentShellService.exe, Pid: 6300, TotalTime: 665, Count: 24, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-19T11:39:35.156 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 527, Count: 46, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-19T11:39:35.156 ProcessImageName: WmiPrvSE.exe, Pid: 5900, TotalTime: 494, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-19T11:39:35.156 ProcessImageName: powershell.exe, Pid: 8176, TotalTime: 216, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-19T11:39:35.156 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T11:39:35.156 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 120, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T11:39:35.156 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T11:39:35.156 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2.MAI, EstimatedImpact: 0% 2026-09-19T11:39:35.156 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 91, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T11:39:35.156 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-19T11:39:35.156 ProcessImageName: python.exe, Pid: 7688, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-19T11:39:35.156 ProcessImageName: DeviceCensus.exe, Pid: 8100, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 4% 2026-09-19T11:39:35.156 ProcessImageName: powershell.exe, Pid: 4980, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-19T11:39:35.156 ProcessImageName: mysqldump.exe, Pid: 7852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 12% 2026-09-19T11:39:35.156 ProcessImageName: taskhostw.exe, Pid: 6400, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-19T11:39:35.156 ProcessImageName: cmd.exe, Pid: 3304, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-19T11:39:35.156 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-19T11:39:35.156 ProcessImageName: ngentask.exe, Pid: 7364, TotalTime: 0, Count: 5, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 0% 2026-09-19T11:39:35.156 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 3668, TotalTime: 0, Count: 3, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\1.3.271.7\psmachine_64.dll, EstimatedImpact: 0% 2026-09-19T11:42:39.626 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T11:42:39.626 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T11:42:39.626 [Cloud] Queued cloud request. 2026-09-19T11:42:39.626 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T11:42:39.626 [Cloud] Dequeued cloud request. 2026-09-19T11:42:39.626 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T11:42:39.829 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2C60550A-B4A3-05B7-155E-C45FCEBCEBF5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 11:42:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T11:42:40.345 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T11:46:35.003 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T11:46:35.003 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T11:46:35.003 [Cloud] Queued cloud request. 2026-09-19T11:46:35.003 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T11:46:35.003 [Cloud] Dequeued cloud request. 2026-09-19T11:46:35.003 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T11:46:35.160 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BC4BFAAE-7854-3125-2D40-540E53F16024} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 11:46:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T11:46:35.675 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T11:54:36.102 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T11:59:00.119 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T11:59:00.119 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T11:59:00.119 [Cloud] Queued cloud request. 2026-09-19T11:59:00.119 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T11:59:00.119 [Cloud] Dequeued cloud request. 2026-09-19T11:59:00.119 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T11:59:00.338 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4DE0159D-232D-C16A-87FB-641B8B7B117F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 11:59:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T11:59:00.854 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T12:09:21.640 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T12:09:21.640 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T12:09:21.640 [Cloud] Queued cloud request. 2026-09-19T12:09:21.640 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T12:09:21.640 [Cloud] Dequeued cloud request. 2026-09-19T12:09:21.640 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T12:09:21.827 [Cloud] End of cloud request. 2026-09-19T12:09:22.327 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T12:09:41.109 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T12:24:46.117 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T12:28:51.384 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T12:28:51.384 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T12:28:51.384 [Cloud] Queued cloud request. 2026-09-19T12:28:51.384 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T12:28:51.384 [Cloud] Dequeued cloud request. 2026-09-19T12:28:51.384 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T12:28:51.572 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25AD01C6-7AC9-C47D-1CA1-F64CD8A71F26} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 12:28:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T12:28:52.072 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T12:38:02.139 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T12:38:02.139 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T12:38:02.139 [Cloud] Queued cloud request. 2026-09-19T12:38:02.139 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T12:38:02.311 [Cloud] Dequeued cloud request. 2026-09-19T12:38:02.311 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T12:38:02.498 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3A41C587-DD6C-85EC-4C93-389F1D04BE05} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 12:38:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T12:38:03.014 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T12:39:51.124 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T12:42:56.655 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T12:42:56.655 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T12:42:56.655 [Cloud] Queued cloud request. 2026-09-19T12:42:56.655 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T12:42:56.655 [Cloud] Dequeued cloud request. 2026-09-19T12:42:56.655 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T12:42:56.843 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0AB5CDC0-D4ED-FEB5-4BDA-54D93314C288} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 12:42:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T12:42:57.343 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T12:48:58.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T12:48:58.925 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T12:48:58.925 [Cloud] Queued cloud request. 2026-09-19T12:48:58.925 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T12:48:58.925 [Cloud] Dequeued cloud request. 2026-09-19T12:48:58.925 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T12:49:09.050 [Cloud] End of cloud request. 2026-09-19T12:49:09.566 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T12:53:53.849 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T12:53:53.849 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T12:53:53.849 [Cloud] Queued cloud request. 2026-09-19T12:53:53.849 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T12:53:53.849 [Cloud] Dequeued cloud request. 2026-09-19T12:53:53.849 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T12:53:54.037 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E03926B5-BDFB-4372-5BB3-5ADB9E9A0A98} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 12:53:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T12:53:54.537 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T12:54:56.130 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T13:02:11.494 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T13:02:11.494 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T13:02:11.494 [Cloud] Queued cloud request. 2026-09-19T13:02:11.494 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T13:02:11.494 [Cloud] Dequeued cloud request. 2026-09-19T13:02:11.494 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T13:02:11.682 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AA5370EA-A747-6A4E-E500-D25F81DE937C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 13:02:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T13:02:12.182 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T13:10:01.139 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T13:19:12.065 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T13:19:12.065 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T13:19:12.065 [Cloud] Queued cloud request. 2026-09-19T13:19:12.065 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T13:19:12.065 [Cloud] Dequeued cloud request. 2026-09-19T13:19:12.065 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T13:19:12.252 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{125A90DB-31B6-B5AA-13C8-2E42CFC706A6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 13:19:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T13:19:12.768 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T13:22:16.613 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T13:22:16.613 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T13:22:16.613 [Cloud] Queued cloud request. 2026-09-19T13:22:16.613 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T13:22:16.613 [Cloud] Dequeued cloud request. 2026-09-19T13:22:16.613 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T13:22:16.801 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{66E1850A-81B0-A15E-A5BA-02C7728ED7D6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 13:22:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T13:22:17.301 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T13:25:06.144 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T13:39:35.216 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 25684, Count: 1929, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-19T13:39:35.216 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 15916, Count: 1416, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-19T13:39:35.216 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 4077, Count: 353, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T13:39:35.216 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-19T13:39:35.216 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-19T13:39:35.216 ProcessImageName: AgentShellService.exe, Pid: 6300, TotalTime: 665, Count: 24, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-19T13:39:35.216 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 557, Count: 48, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-19T13:39:35.216 ProcessImageName: WmiPrvSE.exe, Pid: 5900, TotalTime: 494, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-19T13:39:35.216 ProcessImageName: powershell.exe, Pid: 8176, TotalTime: 216, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-19T13:39:35.216 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T13:39:35.216 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 135, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T13:39:35.216 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T13:39:35.216 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2.MAI, EstimatedImpact: 0% 2026-09-19T13:39:35.216 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 91, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T13:39:35.216 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-19T13:39:35.216 ProcessImageName: python.exe, Pid: 7688, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-19T13:39:35.216 ProcessImageName: DeviceCensus.exe, Pid: 8100, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 4% 2026-09-19T13:39:35.216 ProcessImageName: powershell.exe, Pid: 4980, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-19T13:39:35.216 ProcessImageName: mysqldump.exe, Pid: 7852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 12% 2026-09-19T13:39:35.216 ProcessImageName: taskhostw.exe, Pid: 6400, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-19T13:39:35.216 ProcessImageName: cmd.exe, Pid: 3304, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-19T13:39:35.216 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-19T13:39:35.216 ProcessImageName: ngentask.exe, Pid: 7364, TotalTime: 0, Count: 5, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 0% 2026-09-19T13:39:35.216 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 3668, TotalTime: 0, Count: 3, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\1.3.271.7\psmachine_64.dll, EstimatedImpact: 0% 2026-09-19T13:40:11.154 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T13:43:13.546 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T13:43:13.546 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T13:43:13.546 [Cloud] Queued cloud request. 2026-09-19T13:43:13.546 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T13:43:13.546 [Cloud] Dequeued cloud request. 2026-09-19T13:43:13.546 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T13:43:13.702 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{42720174-4BE0-B4C2-90E5-82078216AF2C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 13:43:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T13:43:14.218 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T13:43:26.233 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T13:43:26.233 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T13:43:26.233 [Cloud] Queued cloud request. 2026-09-19T13:43:26.233 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T13:43:26.233 [Cloud] Dequeued cloud request. 2026-09-19T13:43:26.233 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T13:43:26.327 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CC79A1E0-561C-C1C9-7EDD-156D53D85D0C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 13:43:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T13:43:26.843 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T13:46:41.734 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T13:46:41.734 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T13:46:41.734 [Cloud] Queued cloud request. 2026-09-19T13:46:41.734 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T13:46:41.734 [Cloud] Dequeued cloud request. 2026-09-19T13:46:41.734 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{C8449859-1714-B257-FE2D-0875979C2063} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 13:46:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T13:46:41.891 [Cloud] End of cloud request. 2026-09-19T13:46:42.391 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T13:55:16.161 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T14:02:40.086 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T14:02:40.086 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T14:02:40.086 [Cloud] Queued cloud request. 2026-09-19T14:02:40.086 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T14:02:40.086 [Cloud] Dequeued cloud request. 2026-09-19T14:02:40.086 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T14:02:40.274 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0381C376-4E74-E9DE-ADE0-6A32E05EF42B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 14:02:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T14:02:40.774 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T14:10:21.169 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T14:21:48.141 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T14:21:48.141 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T14:21:48.141 [Cloud] Queued cloud request. 2026-09-19T14:21:48.141 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T14:21:48.141 [Cloud] Dequeued cloud request. 2026-09-19T14:21:48.141 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T14:21:48.313 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{71D29C8F-26B8-9824-9A5D-BC839589035A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 14:21:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T14:21:48.829 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T14:25:26.176 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T14:29:21.099 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T14:29:21.099 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T14:29:21.099 [Cloud] Queued cloud request. 2026-09-19T14:29:21.099 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T14:29:21.350 [Cloud] Dequeued cloud request. 2026-09-19T14:29:21.350 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T14:29:21.506 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F6A68C4-51CC-8C95-DA7D-0262E7D1BDF6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 14:29:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T14:29:22.006 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T14:38:36.120 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T14:38:36.120 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T14:38:36.120 [Cloud] Queued cloud request. 2026-09-19T14:38:36.120 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T14:38:36.120 [Cloud] Dequeued cloud request. 2026-09-19T14:38:36.120 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T14:38:42.073 [Cloud] End of cloud request. 2026-09-19T14:38:42.589 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T14:40:31.183 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T14:41:02.824 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T14:41:02.824 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T14:41:02.824 [Cloud] Queued cloud request. 2026-09-19T14:41:02.824 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T14:41:02.824 [Cloud] Dequeued cloud request. 2026-09-19T14:41:02.824 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T14:41:02.965 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8F5D6B18-0271-2099-6822-377D6786166A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 14:41:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T14:41:03.465 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T14:43:50.560 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T14:43:50.560 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T14:43:50.560 [Cloud] Queued cloud request. 2026-09-19T14:43:50.560 [Cloud] Dequeued cloud request. 2026-09-19T14:43:50.560 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T14:43:50.560 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T14:43:50.700 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0DDF7818-6596-CC38-D868-D97533BAAB06} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 14:43:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T14:43:51.216 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T14:47:53.656 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T14:47:53.656 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T14:47:53.656 [Cloud] Queued cloud request. 2026-09-19T14:47:53.656 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T14:47:53.656 [Cloud] Dequeued cloud request. 2026-09-19T14:47:53.656 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T14:47:53.797 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F608E00-DAC0-BC80-AF31-D27A17BCCA25} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 14:47:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T14:47:54.297 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T14:49:03.984 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T14:49:03.984 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T14:49:03.984 [Cloud] Queued cloud request. 2026-09-19T14:49:03.984 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T14:49:03.984 [Cloud] Dequeued cloud request. 2026-09-19T14:49:03.984 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T14:49:04.125 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7FA92504-D85F-BC1A-26BD-4AD18BC0251C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 14:49:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T14:49:04.641 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T14:49:20.016 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T14:49:20.016 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T14:49:20.016 [Cloud] Queued cloud request. 2026-09-19T14:49:20.016 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T14:49:20.016 [Cloud] Dequeued cloud request. 2026-09-19T14:49:20.016 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T14:49:20.094 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{71C2E256-1823-1102-512A-84ED683DC5D0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 14:49:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T14:49:20.609 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T14:55:36.189 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T15:09:59.775 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T15:09:59.775 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T15:09:59.775 [Cloud] Queued cloud request. 2026-09-19T15:09:59.775 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T15:09:59.775 [Cloud] Dequeued cloud request. 2026-09-19T15:09:59.775 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T15:09:59.932 [Cloud] End of cloud request. 2026-09-19T15:10:00.432 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T15:10:41.197 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T15:19:31.155 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T15:19:31.155 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T15:19:31.155 [Cloud] Queued cloud request. 2026-09-19T15:19:31.155 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T15:19:31.155 [Cloud] Dequeued cloud request. 2026-09-19T15:19:31.155 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T15:19:31.296 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{19BCB082-468B-59D2-313F-D68B22ADF3A4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 15:19:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T15:19:31.796 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T15:20:30.218 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T15:20:30.218 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T15:20:30.218 [Cloud] Queued cloud request. 2026-09-19T15:20:30.218 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T15:20:30.218 [Cloud] Dequeued cloud request. 2026-09-19T15:20:30.218 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T15:20:30.296 [Cloud] End of cloud request. 2026-09-19T15:20:30.812 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T15:24:07.080 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T15:24:07.080 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T15:24:07.080 [Cloud] Queued cloud request. 2026-09-19T15:24:07.080 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T15:24:07.080 [Cloud] Dequeued cloud request. 2026-09-19T15:24:07.080 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T15:24:07.314 [Cloud] End of cloud request. 2026-09-19T15:24:07.814 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T15:25:46.205 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T15:34:53.241 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T15:34:53.241 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T15:34:53.241 [Cloud] Queued cloud request. 2026-09-19T15:34:53.241 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T15:34:53.241 [Cloud] Dequeued cloud request. 2026-09-19T15:34:53.241 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T15:34:53.397 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{86E63398-D9F7-893B-B76B-6A621E84D59D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 15:34:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T15:34:53.913 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T15:39:35.275 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27337, Count: 2012, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-19T15:39:35.275 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 18020, Count: 1605, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-19T15:39:35.275 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 4077, Count: 353, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T15:39:35.275 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-19T15:39:35.275 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-19T15:39:35.275 ProcessImageName: AgentShellService.exe, Pid: 6300, TotalTime: 665, Count: 24, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-19T15:39:35.275 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 617, Count: 52, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-19T15:39:35.275 ProcessImageName: WmiPrvSE.exe, Pid: 5900, TotalTime: 494, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-19T15:39:35.275 ProcessImageName: powershell.exe, Pid: 8176, TotalTime: 216, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-19T15:39:35.275 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T15:39:35.275 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 180, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T15:39:35.275 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T15:39:35.275 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2.MAI, EstimatedImpact: 0% 2026-09-19T15:39:35.275 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 91, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T15:39:35.275 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-19T15:39:35.275 ProcessImageName: python.exe, Pid: 7688, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-19T15:39:35.275 ProcessImageName: DeviceCensus.exe, Pid: 8100, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 4% 2026-09-19T15:39:35.275 ProcessImageName: powershell.exe, Pid: 4980, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-19T15:39:35.275 ProcessImageName: mysqldump.exe, Pid: 7852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 12% 2026-09-19T15:39:35.275 ProcessImageName: taskhostw.exe, Pid: 6400, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-19T15:39:35.275 ProcessImageName: cmd.exe, Pid: 3304, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-19T15:39:35.275 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-19T15:39:35.275 ProcessImageName: ngentask.exe, Pid: 7364, TotalTime: 0, Count: 5, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 0% 2026-09-19T15:39:35.275 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 3668, TotalTime: 0, Count: 3, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\1.3.271.7\psmachine_64.dll, EstimatedImpact: 0% 2026-09-19T15:40:51.213 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T15:42:08.728 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T15:42:08.728 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T15:42:08.728 [Cloud] Queued cloud request. 2026-09-19T15:42:08.728 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T15:42:08.728 [Cloud] Dequeued cloud request. 2026-09-19T15:42:08.728 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T15:42:08.869 [Cloud] End of cloud request. 2026-09-19T15:42:09.369 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T15:44:32.965 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T15:44:32.965 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T15:44:32.965 [Cloud] Queued cloud request. 2026-09-19T15:44:32.965 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T15:44:32.965 [Cloud] Dequeued cloud request. 2026-09-19T15:44:32.965 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T15:44:33.121 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{89B90328-50EF-C6A4-8416-8992680AF8DE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 15:44:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T15:44:33.621 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T15:44:38.043 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T15:44:38.043 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T15:44:38.043 [Cloud] Queued cloud request. 2026-09-19T15:44:38.043 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T15:44:38.043 [Cloud] Dequeued cloud request. 2026-09-19T15:44:38.043 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T15:44:38.121 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{19E1E2C4-1389-54EA-4677-74F270571FCC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 15:44:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T15:44:38.621 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T15:48:56.998 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T15:48:56.998 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T15:48:56.998 [Cloud] Queued cloud request. 2026-09-19T15:48:56.998 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T15:48:56.998 [Cloud] Dequeued cloud request. 2026-09-19T15:48:56.998 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T15:48:57.186 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{32D98A20-5D14-A388-1E36-7CA005F2A370} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 15:48:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T15:48:57.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T15:55:56.219 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T16:07:33.054 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T16:07:33.054 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T16:07:33.054 [Cloud] Queued cloud request. 2026-09-19T16:07:33.054 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T16:07:33.054 [Cloud] Dequeued cloud request. 2026-09-19T16:07:33.054 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T16:07:34.554 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2D30A3FA-E0DC-3A89-9F05-EF2B281AB94A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 16:07:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T16:07:35.070 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T16:11:01.227 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T16:13:12.774 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T16:13:12.774 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T16:13:12.774 [Cloud] Queued cloud request. 2026-09-19T16:13:12.774 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T16:13:12.774 [Cloud] Dequeued cloud request. 2026-09-19T16:13:12.774 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T16:13:12.914 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{991BB716-CDDD-74E5-F47D-835D0BAE5D2A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 16:13:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T16:13:13.414 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T16:17:52.153 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T16:17:52.153 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T16:17:52.153 [Cloud] Queued cloud request. 2026-09-19T16:17:52.153 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T16:17:52.153 [Cloud] Dequeued cloud request. 2026-09-19T16:17:52.153 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T16:17:52.341 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4C179EB8-9343-F093-9432-FCABDB7720FA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 16:17:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T16:17:52.841 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T16:20:46.154 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T16:20:46.154 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T16:20:46.154 [Cloud] Queued cloud request. 2026-09-19T16:20:46.154 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T16:20:46.154 [Cloud] Dequeued cloud request. 2026-09-19T16:20:46.154 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T16:20:46.341 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9C1B7D49-721E-DF21-0499-1D2D0894A625} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 16:20:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T16:20:46.841 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T16:24:14.718 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T16:24:14.718 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T16:24:14.718 [Cloud] Queued cloud request. 2026-09-19T16:24:14.718 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T16:24:14.718 [Cloud] Dequeued cloud request. 2026-09-19T16:24:14.718 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T16:24:21.078 [Cloud] End of cloud request. 2026-09-19T16:24:21.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T16:26:06.234 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T16:41:11.242 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T16:42:19.321 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T16:42:19.321 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T16:42:19.321 [Cloud] Queued cloud request. 2026-09-19T16:42:19.321 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T16:42:19.321 [Cloud] Dequeued cloud request. 2026-09-19T16:42:19.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T16:42:19.509 [Cloud] End of cloud request. 2026-09-19T16:42:20.025 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T16:45:12.166 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T16:45:12.166 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T16:45:12.166 [Cloud] Queued cloud request. 2026-09-19T16:45:12.166 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T16:45:12.166 [Cloud] Dequeued cloud request. 2026-09-19T16:45:12.166 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T16:45:22.291 [Cloud] End of cloud request. 2026-09-19T16:45:22.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T16:51:39.373 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T16:51:39.373 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T16:51:39.373 [Cloud] Queued cloud request. 2026-09-19T16:51:39.373 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T16:51:39.373 [Cloud] Dequeued cloud request. 2026-09-19T16:51:39.373 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T16:51:39.545 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D6CCF6DA-9347-DDCF-9132-A17423FCBFC3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 16:51:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T16:51:40.045 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T16:52:52.451 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T16:52:52.451 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T16:52:52.451 [Cloud] Queued cloud request. 2026-09-19T16:52:52.451 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T16:52:52.451 [Cloud] Dequeued cloud request. 2026-09-19T16:52:52.451 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T16:52:52.639 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A1390D7A-A07D-557F-9D51-DD1B17E5FE15} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 16:52:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T16:52:53.154 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T16:56:16.250 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T17:08:03.334 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T17:08:03.334 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T17:08:03.334 [Cloud] Queued cloud request. 2026-09-19T17:08:03.334 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T17:08:03.334 [Cloud] Dequeued cloud request. 2026-09-19T17:08:03.334 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T17:08:13.459 [Cloud] End of cloud request. 2026-09-19T17:08:13.960 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T17:10:11.570 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T17:10:11.570 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T17:10:11.570 [Cloud] Queued cloud request. 2026-09-19T17:10:11.570 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T17:10:11.570 [Cloud] Dequeued cloud request. 2026-09-19T17:10:11.570 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T17:10:11.882 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{34D0FB4E-1464-283C-F5C5-8EF324F72584} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 17:10:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T17:10:12.382 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T17:11:21.257 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T17:26:26.264 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T17:39:35.334 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 28099, Count: 2079, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-19T17:39:35.334 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 20078, Count: 1799, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-19T17:39:35.334 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 4077, Count: 353, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T17:39:35.334 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-19T17:39:35.334 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-19T17:39:35.334 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 693, Count: 56, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-19T17:39:35.334 ProcessImageName: AgentShellService.exe, Pid: 6300, TotalTime: 665, Count: 24, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-19T17:39:35.334 ProcessImageName: WmiPrvSE.exe, Pid: 5900, TotalTime: 494, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-19T17:39:35.334 ProcessImageName: powershell.exe, Pid: 8176, TotalTime: 216, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-19T17:39:35.334 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 210, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T17:39:35.334 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T17:39:35.334 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 62, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2.MAI, EstimatedImpact: 0% 2026-09-19T17:39:35.334 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T17:39:35.334 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 91, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T17:39:35.334 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-19T17:39:35.334 ProcessImageName: python.exe, Pid: 7688, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-19T17:39:35.334 ProcessImageName: DeviceCensus.exe, Pid: 8100, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 4% 2026-09-19T17:39:35.334 ProcessImageName: powershell.exe, Pid: 4980, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-19T17:39:35.334 ProcessImageName: mysqldump.exe, Pid: 7852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 12% 2026-09-19T17:39:35.334 ProcessImageName: taskhostw.exe, Pid: 6400, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-19T17:39:35.334 ProcessImageName: cmd.exe, Pid: 3304, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-19T17:39:35.334 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-19T17:39:35.334 ProcessImageName: ngentask.exe, Pid: 7364, TotalTime: 0, Count: 5, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 0% 2026-09-19T17:39:35.334 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 3668, TotalTime: 0, Count: 3, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\1.3.271.7\psmachine_64.dll, EstimatedImpact: 0% 2026-09-19T17:40:25.209 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T17:40:25.209 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T17:40:25.209 [Cloud] Queued cloud request. 2026-09-19T17:40:25.209 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T17:40:25.209 [Cloud] Dequeued cloud request. 2026-09-19T17:40:25.209 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T17:40:25.365 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6E272302-3321-4442-E606-E7422E071BAD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 17:40:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T17:40:25.865 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T17:41:31.271 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T17:51:41.949 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T17:51:41.949 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T17:51:41.949 [Cloud] Queued cloud request. 2026-09-19T17:51:41.949 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T17:51:41.949 [Cloud] Dequeued cloud request. 2026-09-19T17:51:41.949 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T17:51:42.105 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2892780B-0788-1DF3-1B22-B8A4FD98FF47} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 17:51:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T17:51:42.605 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T17:52:54.824 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T17:52:54.824 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T17:52:54.824 [Cloud] Queued cloud request. 2026-09-19T17:52:54.824 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T17:52:54.824 [Cloud] Dequeued cloud request. 2026-09-19T17:52:54.824 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T17:52:57.152 [Cloud] End of cloud request. 2026-09-19T17:52:57.668 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T17:53:16.199 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T17:53:16.199 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T17:53:16.199 [Cloud] Queued cloud request. 2026-09-19T17:53:16.199 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T17:53:16.199 [Cloud] Dequeued cloud request. 2026-09-19T17:53:16.199 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T17:53:16.277 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F6E5D696-11D7-A011-A022-6EFDA5E0AF8E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 17:53:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T17:53:16.793 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T17:56:36.279 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T18:05:32.534 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T18:05:32.534 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T18:05:32.534 [Cloud] Queued cloud request. 2026-09-19T18:05:32.534 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T18:05:32.534 [Cloud] Dequeued cloud request. 2026-09-19T18:05:32.534 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T18:05:32.722 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E5A8BB1B-F51A-9C0D-2AFE-A7B0ED440BD5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 18:05:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T18:05:33.237 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T18:06:47.831 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T18:06:47.831 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T18:06:47.831 [Cloud] Queued cloud request. 2026-09-19T18:06:47.831 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T18:06:47.831 [Cloud] Dequeued cloud request. 2026-09-19T18:06:47.831 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T18:06:48.003 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{15AE97D5-CB09-4B17-5505-F8E13CA88851} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 18:06:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T18:06:48.503 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T18:07:43.661 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T18:07:43.661 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T18:07:43.661 [Cloud] Queued cloud request. 2026-09-19T18:07:43.661 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T18:07:43.661 [Cloud] Dequeued cloud request. 2026-09-19T18:07:43.661 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T18:07:43.739 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F4ED961C-E422-C238-9B8A-9384249631E6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 18:07:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T18:07:44.254 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T18:08:27.942 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T18:08:27.942 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T18:08:27.942 [Cloud] Queued cloud request. 2026-09-19T18:08:27.942 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T18:08:27.942 [Cloud] Dequeued cloud request. 2026-09-19T18:08:27.942 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T18:08:28.020 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3922239C-F1EE-38DB-8E4D-BDB3214F8887} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 18:08:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T18:08:28.520 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T18:09:01.942 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T18:09:01.942 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T18:09:01.942 [Cloud] Queued cloud request. 2026-09-19T18:09:01.942 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T18:09:01.942 [Cloud] Dequeued cloud request. 2026-09-19T18:09:01.942 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T18:09:02.020 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{36DAB680-C71B-8323-1ACE-DEB396C50844} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 18:09:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T18:09:02.536 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T18:10:20.834 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T18:10:20.834 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T18:10:20.834 [Cloud] Queued cloud request. 2026-09-19T18:10:20.834 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T18:10:20.834 [Cloud] Dequeued cloud request. 2026-09-19T18:10:20.834 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T18:10:21.021 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{27711F1A-1D4B-A0C4-E3D1-C56CB0C7ACCF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 18:10:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T18:10:21.521 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T18:11:17.287 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T18:11:17.287 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T18:11:17.287 [Cloud] Queued cloud request. 2026-09-19T18:11:17.287 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T18:11:17.287 [Cloud] Dequeued cloud request. 2026-09-19T18:11:17.287 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T18:11:17.381 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AF8DAC13-500E-878A-FF73-E5CF051057D9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 18:11:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T18:11:17.881 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T18:11:41.287 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T18:18:11.244 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T18:18:11.244 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T18:18:11.244 [Cloud] Queued cloud request. 2026-09-19T18:18:11.244 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T18:18:11.244 [Cloud] Dequeued cloud request. 2026-09-19T18:18:11.244 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T18:18:11.431 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EB4A8169-69F0-F81A-5CEC-B91C81F83037} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 18:18:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T18:18:11.931 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T18:19:37.635 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T18:19:37.635 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T18:19:37.635 [Cloud] Queued cloud request. 2026-09-19T18:19:37.635 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T18:19:37.635 [Cloud] Dequeued cloud request. 2026-09-19T18:19:37.635 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T18:19:37.807 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A77A64CA-6A98-45D0-EE5A-F79404399342} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 18:19:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T18:19:38.307 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T18:23:55.869 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T18:23:55.869 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T18:23:55.869 [Cloud] Queued cloud request. 2026-09-19T18:23:55.869 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T18:23:55.869 [Cloud] Dequeued cloud request. 2026-09-19T18:23:55.869 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T18:23:56.057 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4DA7AF29-B45E-F053-977B-7AF01496A364} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 18:23:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T18:23:56.573 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T18:26:46.293 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T18:37:15.188 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T18:37:15.188 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T18:37:15.188 [Cloud] Queued cloud request. 2026-09-19T18:37:15.188 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T18:37:15.188 [Cloud] Dequeued cloud request. 2026-09-19T18:37:15.188 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T18:37:15.345 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7ECBB029-41C0-094D-8B56-B99DAE75E8E5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 18:37:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T18:37:15.860 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T18:41:51.300 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T18:43:24.582 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T18:43:24.582 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T18:43:24.582 [Cloud] Queued cloud request. 2026-09-19T18:43:24.582 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T18:43:24.582 [Cloud] Dequeued cloud request. 2026-09-19T18:43:24.582 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T18:43:24.707 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{849A759E-DA92-A18B-69B3-3ECDD5FC5AD0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 18:43:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T18:43:25.222 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T18:56:56.308 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T19:09:40.487 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T19:09:40.487 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T19:09:40.487 [Cloud] Queued cloud request. 2026-09-19T19:09:40.487 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T19:09:40.487 [Cloud] Dequeued cloud request. 2026-09-19T19:09:40.487 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T19:09:40.675 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{43D098D9-68B0-14B2-951B-B31E6D13798D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 19:09:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T19:09:41.190 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T19:12:01.316 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T19:17:15.553 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T19:17:15.553 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T19:17:15.553 [Cloud] Queued cloud request. 2026-09-19T19:17:15.553 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T19:17:15.553 [Cloud] Dequeued cloud request. 2026-09-19T19:17:15.553 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T19:17:15.741 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1EE3F17A-D09C-550F-F57E-55BFB9F03322} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 19:17:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T19:17:16.241 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T19:27:06.323 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T19:39:11.330 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-19T19:39:11.361 Job Notification: New process added to job (7704) 2026-09-19T19:39:11.361 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-19T19:39:11.361 Aggressive catchup quick scan threshold: 660034208145 / 25920000000000 2026-09-19T19:39:11.361 Job Notification: New process added to job (8128) 2026-09-19T19:39:11.376 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:7704] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:8128]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-19T19:39:11.486 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-19T19:39:11.486 Job Notification: New process added to job (7388) 2026-09-19T19:39:11.486 Job Notification: New process added to job (5488) 2026-09-19T19:39:11.548 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:7388] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:5488]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-19T19:39:11.658 Job Notification: New process added to job (6432) 2026-09-19T19:39:11.736 Task(GetDeviceTicket -AccessKey 9DCD5938-9E5E-A0B5-50DB-BC1A5F86804C ) launched as network service 2026-09-19T19:39:11.876 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-19T19:39:11.876 [RTP] Duplicating the current plugin configuration object... 2026-09-19T19:39:11.876 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-19T19:39:11.876 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-19T19:39:11.876 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-19T19:39:11.876 [RTP] No config change detected. Not updating plugin configuration. 2026-09-19T19:39:11.876 [RTP] No config changes found. No configuration switch. 2026-09-19T19:39:11.876 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-19T19:39:12.205 Job Notification: Process exited from job (6432) 2026-09-19T19:39:12.376 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-19T19:39:12.376 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T19:39:12.376 [Cloud] Queued cloud request. 2026-09-19T19:39:12.376 [Cloud] Dequeued cloud request. 2026-09-19T19:39:12.376 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T19:39:19.580 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-19T19:39:19.580 [Cloud] End of cloud request. 2026-09-19T19:39:20.111 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T19:39:24.345 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\66FE00E0-9F84-44E7-A718-A0EA8C0874D84c0.1dd486e91acf281 2026-09-19T19:39:24.455 Verifying engine and signature files (source: 0) ... 2026-09-19T19:39:24.455 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1}\mpengine.dll] due to PPL. 2026-09-19T19:39:24.455 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1}\mpasbase.vdm]. File not in cache (0x1) 2026-09-19T19:39:25.470 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1}\mpasbase.vdm] 2026-09-19T19:39:25.470 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-19T19:39:25.486 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1}\mpasdlta.vdm] 2026-09-19T19:39:25.486 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1}\mpavbase.vdm]. File not in cache (0x1) 2026-09-19T19:39:25.923 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1}\mpavbase.vdm] 2026-09-19T19:39:25.923 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-19T19:39:25.955 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1}\mpavdlta.vdm] 2026-09-19T19:39:26.142 [Engine] IsHybridMode: 0 2026-09-19T19:39:26.142 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-19T19:39:26.142 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-89E322B75CBF03904A31F937731D84D53D6F330A.bin): 0x00000002 2026-09-19T19:39:26.142 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-89E322B75CBF03904A31F937731D84D53D6F330A.bin) 2026-09-19T19:39:26.142 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-19T19:39:26.142 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-19T19:39:26.142 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-19T19:39:26.142 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff 2026-09-19T19:39:35.408 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 28298, Count: 2095, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-19T19:39:35.408 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 22232, Count: 1991, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-19T19:39:35.408 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 4077, Count: 353, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T19:39:35.408 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-19T19:39:35.408 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-19T19:39:35.408 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 739, Count: 60, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-19T19:39:35.408 ProcessImageName: AgentShellService.exe, Pid: 6300, TotalTime: 665, Count: 24, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-19T19:39:35.408 ProcessImageName: WmiPrvSE.exe, Pid: 5900, TotalTime: 494, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-19T19:39:35.408 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 240, Count: 20, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T19:39:35.408 ProcessImageName: powershell.exe, Pid: 8176, TotalTime: 216, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-19T19:39:35.408 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T19:39:35.408 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2.MAI, EstimatedImpact: 0% 2026-09-19T19:39:35.408 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T19:39:35.408 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 91, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T19:39:35.408 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-19T19:39:35.408 ProcessImageName: python.exe, Pid: 7688, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-19T19:39:35.408 ProcessImageName: DeviceCensus.exe, Pid: 8100, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 4% 2026-09-19T19:39:35.408 ProcessImageName: powershell.exe, Pid: 4980, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-19T19:39:35.408 ProcessImageName: mysqldump.exe, Pid: 7852, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 12% 2026-09-19T19:39:35.408 ProcessImageName: taskhostw.exe, Pid: 6400, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-19T19:39:35.408 ProcessImageName: cmd.exe, Pid: 3304, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-19T19:39:35.408 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-19T19:39:35.408 ProcessImageName: ngentask.exe, Pid: 7364, TotalTime: 0, Count: 5, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 0% 2026-09-19T19:39:35.408 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 3668, TotalTime: 0, Count: 3, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\1.3.271.7\psmachine_64.dll, EstimatedImpact: 0% IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-19T19:39:37.720 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-19T19:39:37.720 [AutoExclusion] Applied roles from cache. 2026-09-19T19:39:37.720 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-19T19:39:37.814 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF4ABB020, lRefCount: 6, hr=0 2026-09-19T19:39:37.814 [Engine] New active engine 00007FFCF68AB020 replacing engine 00007FFCF4ABB020. Number of active engines: 2 2026-09-19T19:39:37.830 EngineInit:Global ASOC is enabled 2026-09-19T19:39:37.830 EngineInit:ASOO is enabled for developer volumes 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.908 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-19T19:39:37.939 MpWriteUupSignatureVersion 1.459.292.0, hr = 0 2026-09-19T19:39:37.939 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-19T19:39:37.970 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-19T19:39:37.970 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-19T19:39:37.970 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-19T19:39:37.970 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-19T19:39:37.986 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-19T19:39:37.986 [Plugin] Initializing RTP plugin state... 2026-09-19T19:39:37.986 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-19T19:39:37.986 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎18‎-‎2026 21:39:35 Last Perf:‎09‎-‎18‎-‎2026 21:39:34 First RTP Scan:‎09‎-‎18‎-‎2026 21:39:35 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1329 Misses:7063 BM Queue:0,139,0 Proc:0,26,0 File:0,139,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:481723 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:91582140 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:3443 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:15273 TotalHits:235971 InstanceCacheInserts:216 InstanceCacheUpdates:0 InstanceCacheDeletes:88 InstanceCacheHits:68 InstanceCacheMisses:9083 InstanceCacheOverflows:0 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:4ms (6991/1478) Success: 1478, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-19T19:39:37.986 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1} 2026-09-19T19:39:37.986 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730}\mpasbase.vdm in use, hr=0x80070020 2026-09-19T19:39:37.986 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C75691B9-DF6D-460A-9F90-CD401F34C1B9} removed 2026-09-19T19:39:37.986 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-19T19:39:37.986 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-19T19:39:37.986 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-19T19:39:37.986 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-19T19:39:37.986 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-19T19:39:37.986 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-19-2026 19:39:37 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-19-2026 19:39:37 2026-09-19T19:39:38.001 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-19T19:39:38.001 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-19T19:39:38.001 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-19T19:39:38.001 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-19T19:39:38.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T19:39:38.001 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-19T19:39:38.001 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-19T19:39:38.001 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-19T19:39:38.001 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-19T19:39:38.001 MdCoreSvc is supported in this platform and OS Signature updated on 09-19-2026 19:39:38 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.292.0 AV Signature Version: 1.459.292.0 ************************************************************ 2026-09-19T19:39:38.001 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-19T19:39:38.001 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\66FE00E0-9F84-44E7-A718-A0EA8C0874D84c0.1dd486e91acf281 2026-09-19T19:39:38.017 Process scan (postsignatureupdatescan) started. 2026-09-19T19:39:38.064 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-19T19:39:38.064 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-19-2026 19:39:38 ************************************************************ 2026-09-19T19:39:38.205 Job Notification: Process exited from job (7704) 2026-09-19T19:39:38.226 Job Notification: Process exited from job (8128) 2026-09-19T19:39:38.226 Job Notification: Process exited from job (7388) 2026-09-19T19:39:38.236 Job Notification: Process exited from job (5488) 2026-09-19T19:39:38.267 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-19T19:39:38.267 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-19T19:39:38.267 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-19T19:39:38.267 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-19T19:39:38.267 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-19T19:39:38.283 [Engine] Engine 00007FFCF4ABB020 no longer in use. Number of active engines: 1 2026-09-19T19:39:38.283 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-19T19:39:38.283 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-19T19:39:38.455 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-19T19:39:38.455 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-19T19:39:38.455 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-19T19:39:38.861 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 28298, Count: 2095, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-19T19:39:38.861 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 22232, Count: 1991, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-19T19:39:38.861 ProcessImageName: AgentShell.exe, Pid: 4684, TotalTime: 4077, Count: 353, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T19:39:38.861 ProcessImageName: powershell.exe, Pid: 6792, TotalTime: 1758, Count: 108, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 38% 2026-09-19T19:39:38.861 ProcessImageName: taskhostw.exe, Pid: 1460, TotalTime: 811, Count: 3, MaxTime: 765, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-09-19T19:39:38.861 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 739, Count: 60, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-19T19:39:38.861 ProcessImageName: AgentShellService.exe, Pid: 6300, TotalTime: 665, Count: 24, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-19T19:39:38.861 ProcessImageName: WmiPrvSE.exe, Pid: 5900, TotalTime: 494, Count: 26, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-19T19:39:38.861 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 240, Count: 20, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T19:39:38.861 ProcessImageName: powershell.exe, Pid: 8176, TotalTime: 216, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-19T19:39:38.861 ProcessImageName: WmiPrvSE.exe, Pid: 196, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T19:39:38.861 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-19645-2.MAI, EstimatedImpact: 0% 2026-09-19T19:39:38.861 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 106, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T19:39:38.861 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 91, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T19:39:38.861 ProcessImageName: taskhostw.exe, Pid: 1964, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-19T19:39:38.939 [Engine] RSIG_UNLOADENGINE, 00007FFCF4ABB020, err=0x0 2026-09-19T19:39:38.970 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6C5A104-E334-4FE0-B913-E043BD45A730} removed 2026-09-19T19:39:51.642 Process scan (postsignatureupdatescan) completed. 2026-09-19T19:42:11.331 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T19:42:17.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T19:42:17.925 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T19:42:17.925 [Cloud] Queued cloud request. 2026-09-19T19:42:17.925 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T19:42:17.925 [Cloud] Dequeued cloud request. 2026-09-19T19:42:17.925 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T19:42:18.112 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F8001941-2035-D0D2-FD76-C8970182980A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 19:42:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T19:42:18.628 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T19:43:02.815 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T19:43:02.815 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T19:43:02.815 [Cloud] Queued cloud request. 2026-09-19T19:43:02.815 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T19:43:02.815 [Cloud] Dequeued cloud request. 2026-09-19T19:43:02.815 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T19:43:02.894 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{18A44117-60B6-A194-43E6-9BB1CF3EDC44} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 19:43:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T19:43:03.409 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T19:44:19.894 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T19:44:19.894 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T19:44:19.894 [Cloud] Queued cloud request. 2026-09-19T19:44:19.894 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T19:44:19.894 [Cloud] Dequeued cloud request. 2026-09-19T19:44:19.894 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T19:44:20.112 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4D39ACE1-20F2-F293-2558-2B9C2EC2D901} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 19:44:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T19:44:20.612 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T19:44:37.878 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-19T19:57:16.337 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T20:06:31.263 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T20:06:31.263 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T20:06:31.263 [Cloud] Queued cloud request. 2026-09-19T20:06:31.263 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T20:06:31.263 [Cloud] Dequeued cloud request. 2026-09-19T20:06:31.263 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T20:06:31.451 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{073F9B1C-6D32-696F-B04C-20B021A458E7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 20:06:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T20:06:31.951 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T20:12:21.346 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T20:13:31.252 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T20:13:31.252 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T20:13:31.252 [Cloud] Queued cloud request. 2026-09-19T20:13:31.252 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T20:13:31.252 [Cloud] Dequeued cloud request. 2026-09-19T20:13:31.252 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T20:13:31.439 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D51D0E84-86B9-C7A8-F508-5FE17DD3FF8C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 20:13:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T20:13:31.955 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T20:27:26.352 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T20:42:31.359 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T20:46:51.876 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T20:46:51.876 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T20:46:51.876 [Cloud] Queued cloud request. 2026-09-19T20:46:51.876 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T20:46:51.876 [Cloud] Dequeued cloud request. 2026-09-19T20:46:51.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T20:46:52.016 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EE9D42DE-F1AC-27A1-E05C-2D063FB2C998} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 20:46:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T20:46:52.532 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T20:50:11.786 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T20:50:11.786 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T20:50:11.786 [Cloud] Queued cloud request. 2026-09-19T20:50:11.786 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T20:50:11.786 [Cloud] Dequeued cloud request. 2026-09-19T20:50:11.786 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T20:50:11.942 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ED775363-978E-1E8B-9543-74B2AA85871B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 20:50:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T20:50:12.442 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T20:51:23.224 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T20:51:23.224 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T20:51:23.224 [Cloud] Queued cloud request. 2026-09-19T20:51:23.224 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T20:51:23.224 [Cloud] Dequeued cloud request. 2026-09-19T20:51:23.224 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T20:51:23.364 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{40481A08-D54B-F919-9037-C1728B27A393} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 20:51:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T20:51:23.880 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T20:57:36.367 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T20:59:58.853 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T20:59:58.853 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T20:59:58.853 [Cloud] Queued cloud request. 2026-09-19T20:59:58.853 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T20:59:58.853 [Cloud] Dequeued cloud request. 2026-09-19T20:59:58.853 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T20:59:59.040 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9E0CFC60-5DAC-5213-37AA-0284FD99DF8E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 20:59:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T20:59:59.556 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T21:02:49.071 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T21:02:49.071 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T21:02:49.071 [Cloud] Queued cloud request. 2026-09-19T21:02:49.071 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T21:02:49.071 [Cloud] Dequeued cloud request. 2026-09-19T21:02:49.071 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T21:02:49.212 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D5E63EC7-64A5-1A6F-275F-35D31B7DF1C4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 21:02:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T21:02:49.728 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T21:08:58.137 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\IDR_XML_DEFAULT_TRANSFORM[1]. Process: \Device\HarddiskVolume2\Windows\System32\taskhostw.exe, Status: 0xc0000001, State: 0, ScanRequest #512262, FileId: 0x2400000003bff7, Reason: OnClose, IoStatusBlockForNewFile: 0x3, DesiredAccess:0x0, FileAttributes:0x2020, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T21:10:54.872 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T21:10:54.872 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T21:10:54.872 [Cloud] Queued cloud request. 2026-09-19T21:10:54.872 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T21:10:54.872 [Cloud] Dequeued cloud request. 2026-09-19T21:10:54.872 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T21:10:55.028 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6C1BADEF-9131-601E-738B-E8A8AC0DCB00} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 21:10:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T21:10:55.528 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T21:12:41.372 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T21:18:33.331 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T21:18:33.331 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T21:18:33.331 [Cloud] Queued cloud request. 2026-09-19T21:18:33.331 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T21:18:33.331 [Cloud] Dequeued cloud request. 2026-09-19T21:18:33.331 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T21:18:33.472 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DF3F2DAB-D3F9-5512-FE04-7CAE83346412} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 21:18:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T21:18:33.972 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T21:27:46.383 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T21:31:40.477 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T21:31:40.477 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T21:31:40.477 [Cloud] Queued cloud request. 2026-09-19T21:31:40.477 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T21:31:40.477 [Cloud] Dequeued cloud request. 2026-09-19T21:31:40.477 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T21:31:40.664 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2DF5E907-89F6-2D68-261F-6DB70D613A98} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 21:31:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T21:31:41.180 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T21:35:19.714 [RTP] [Mini-filter] OpenWithoutRead notification (477, 10052, \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe) sent successfully. 2026-09-19T21:36:18.840 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T21:36:18.840 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T21:36:18.840 [Cloud] Queued cloud request. 2026-09-19T21:36:18.840 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T21:36:18.840 [Cloud] Dequeued cloud request. 2026-09-19T21:36:18.840 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T21:36:19.043 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4A1ED551-92F6-2130-6731-F4D366CB82A3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 21:36:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T21:36:19.558 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T21:39:37.872 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 16006, Count: 1158, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-19T21:39:37.872 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 2092, Count: 198, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T21:39:37.872 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-19T21:39:37.872 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T21:39:37.872 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-19T21:39:37.872 ProcessImageName: taskhostw.exe, Pid: 6232, TotalTime: 61, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-19T21:39:37.872 ProcessImageName: taskhostw.exe, Pid: 5132, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-19T21:39:37.872 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T21:39:37.872 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-19T21:39:37.872 ProcessImageName: tzsync.exe, Pid: 7768, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezones.xml, EstimatedImpact: 3% 2026-09-19T21:39:37.872 ProcessImageName: ngentask.exe, Pid: 4024, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 8% 2026-09-19T21:39:37.872 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T21:39:37.872 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T21:42:51.389 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T21:45:10.593 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T21:45:10.593 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T21:45:10.593 [Cloud] Queued cloud request. 2026-09-19T21:45:10.593 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T21:45:10.593 [Cloud] Dequeued cloud request. 2026-09-19T21:45:10.593 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T21:45:10.765 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7FE1402D-466E-B871-0AF1-F6725AE307EA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 21:45:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T21:45:11.281 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T21:50:29.596 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T21:50:29.596 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T21:50:29.596 [Cloud] Queued cloud request. 2026-09-19T21:50:29.596 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T21:50:29.596 [Cloud] Dequeued cloud request. 2026-09-19T21:50:29.596 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{3D18A418-E816-ED03-9F44-9E9A2798AA2D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 21:50:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T21:50:29.736 [Cloud] End of cloud request. 2026-09-19T21:50:30.236 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T21:54:19.286 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T21:54:19.286 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T21:54:19.286 [Cloud] Queued cloud request. 2026-09-19T21:54:19.286 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T21:54:19.286 [Cloud] Dequeued cloud request. 2026-09-19T21:54:19.286 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T21:54:19.426 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EB767849-5E17-9D28-948E-71A844FAF57E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 21:54:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T21:54:19.926 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T21:54:23.489 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T21:54:23.489 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T21:54:23.489 [Cloud] Queued cloud request. 2026-09-19T21:54:23.489 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T21:54:23.489 [Cloud] Dequeued cloud request. 2026-09-19T21:54:23.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T21:54:23.567 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D800EE05-5A13-2B06-E068-E2E7E4415104} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 21:54:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T21:54:24.083 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T21:57:56.397 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T22:00:58.694 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T22:00:58.694 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T22:00:58.694 [Cloud] Queued cloud request. 2026-09-19T22:00:58.694 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T22:00:58.694 [Cloud] Dequeued cloud request. 2026-09-19T22:00:58.694 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T22:00:58.882 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5F35E77A-7661-0F2A-3451-99900CD1487A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 22:00:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T22:00:59.397 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T22:01:07.100 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T22:01:07.100 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T22:01:07.100 [Cloud] Queued cloud request. 2026-09-19T22:01:07.100 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T22:01:07.100 [Cloud] Dequeued cloud request. 2026-09-19T22:01:07.100 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T22:01:07.225 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{17EC727B-C4FE-A77B-69F8-008EEA0A8C46} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 22:01:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T22:01:07.741 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T22:02:28.133 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T22:02:28.133 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T22:02:28.133 [Cloud] Queued cloud request. 2026-09-19T22:02:28.133 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T22:02:28.133 [Cloud] Dequeued cloud request. 2026-09-19T22:02:28.133 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T22:02:28.305 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{49642F3A-6008-19D6-6F85-45B91B65B03F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 22:02:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T22:02:28.821 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T22:12:17.371 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T22:12:17.371 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T22:12:17.371 [Cloud] Queued cloud request. 2026-09-19T22:12:17.371 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T22:12:17.371 [Cloud] Dequeued cloud request. 2026-09-19T22:12:17.371 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T22:12:17.527 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{83C49BB0-1284-9F9B-7AA0-32BBEBABA32D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 22:12:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T22:12:18.027 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T22:13:01.402 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T22:26:00.832 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T22:26:00.832 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T22:26:00.832 [Cloud] Queued cloud request. 2026-09-19T22:26:00.832 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T22:26:00.832 [Cloud] Dequeued cloud request. 2026-09-19T22:26:00.832 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{A07FD66F-FBF5-1F28-56E1-08B08401EDE7} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 22:26:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T22:26:07.238 [Cloud] End of cloud request. 2026-09-19T22:26:07.738 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T22:28:06.412 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T22:31:33.333 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T22:31:33.333 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T22:31:33.333 [Cloud] Queued cloud request. 2026-09-19T22:31:33.333 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T22:31:33.333 [Cloud] Dequeued cloud request. 2026-09-19T22:31:33.333 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T22:31:33.474 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1165F616-4312-2DD2-F383-C3BE345AAA12} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 22:31:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T22:31:33.974 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T22:35:30.789 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T22:35:30.789 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T22:35:30.789 [Cloud] Queued cloud request. 2026-09-19T22:35:30.789 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T22:35:30.789 [Cloud] Dequeued cloud request. 2026-09-19T22:35:30.789 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T22:35:30.929 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{504D6E9C-CFC4-44C1-BCF2-0B418549C435} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 22:35:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T22:35:31.445 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T22:43:11.418 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T22:58:16.426 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T23:00:04.254 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T23:00:04.254 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T23:00:04.254 [Cloud] Queued cloud request. 2026-09-19T23:00:04.254 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T23:00:04.254 [Cloud] Dequeued cloud request. 2026-09-19T23:00:04.254 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T23:00:04.426 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E6268067-2016-78CC-BB4E-86F7A14E09C5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 23:00:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T23:00:04.926 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T23:05:21.396 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T23:05:21.396 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T23:05:21.396 [Cloud] Queued cloud request. 2026-09-19T23:05:21.396 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T23:05:21.396 [Cloud] Dequeued cloud request. 2026-09-19T23:05:21.396 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T23:05:21.537 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{317C12F3-1F2E-CB06-1D72-8E11E1548907} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 23:05:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T23:05:22.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T23:13:21.430 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T23:17:02.026 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T23:17:02.026 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T23:17:02.026 [Cloud] Queued cloud request. 2026-09-19T23:17:02.026 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T23:17:02.026 [Cloud] Dequeued cloud request. 2026-09-19T23:17:02.026 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T23:17:02.167 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8143A8BF-8D0E-7402-CFE5-C2EABE7695FE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 23:17:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T23:17:02.667 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T23:20:29.154 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T23:20:29.154 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T23:20:29.154 [Cloud] Queued cloud request. 2026-09-19T23:20:29.154 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T23:20:29.154 [Cloud] Dequeued cloud request. 2026-09-19T23:20:29.154 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T23:20:29.310 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F2C1BFA6-6D77-C14F-AA5E-B4ED8D65AAC6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 23:20:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T23:20:29.810 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T23:28:26.440 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T23:29:47.486 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T23:29:47.486 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T23:29:47.486 [Cloud] Queued cloud request. 2026-09-19T23:29:47.486 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T23:29:47.486 [Cloud] Dequeued cloud request. 2026-09-19T23:29:47.486 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T23:29:47.690 [Cloud] End of cloud request. 2026-09-19T23:29:48.205 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T23:29:53.346 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T23:29:53.346 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T23:29:53.346 [Cloud] Queued cloud request. 2026-09-19T23:29:53.346 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T23:29:53.346 [Cloud] Dequeued cloud request. 2026-09-19T23:29:53.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T23:29:53.424 [Cloud] End of cloud request. 2026-09-19T23:29:53.940 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T23:39:37.945 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 17254, Count: 1229, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-19T23:39:37.945 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 4350, Count: 408, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-19T23:39:37.945 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-19T23:39:37.945 ProcessImageName: WmiPrvSE.exe, Pid: 2216, TotalTime: 538, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 10% 2026-09-19T23:39:37.945 ProcessImageName: WmiPrvSE.exe, Pid: 1496, TotalTime: 377, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-19T23:39:37.945 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 212, Count: 16, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-19T23:39:37.945 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-19T23:39:37.945 ProcessImageName: taskhostw.exe, Pid: 6232, TotalTime: 61, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-19T23:39:37.945 ProcessImageName: taskhostw.exe, Pid: 5132, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-19T23:39:37.945 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-19T23:39:37.945 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-19T23:39:37.945 ProcessImageName: tzsync.exe, Pid: 7768, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezones.xml, EstimatedImpact: 3% 2026-09-19T23:39:37.945 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-19T23:39:37.945 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-19T23:39:37.945 ProcessImageName: ngentask.exe, Pid: 4024, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 8% 2026-09-19T23:39:37.945 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-19T23:43:31.445 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-19T23:45:44.993 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-19T23:45:44.993 [Cloud] Start of cloud request. Passive mode: 0 2026-09-19T23:45:44.993 [Cloud] Queued cloud request. 2026-09-19T23:45:44.993 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-19T23:45:45.149 [Cloud] Dequeued cloud request. 2026-09-19T23:45:45.149 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-19T23:45:45.305 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C5F1ED2E-1A3E-1188-3BBE-A5830B3652DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-19-2026 23:45:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-19T23:45:45.805 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-19T23:57:56.969 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_axxhvtf3.ele.psm1. Process: \Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #569456, FileId: 0x1800000003b0b7, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-19T23:58:36.453 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T00:03:16.173 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T00:03:16.173 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T00:03:16.173 [Cloud] Queued cloud request. 2026-09-20T00:03:16.173 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T00:03:16.344 [Cloud] Dequeued cloud request. 2026-09-20T00:03:16.501 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T00:03:16.657 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8D5C81B0-457D-6046-E111-86BB74D66C1B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 00:03:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T00:03:17.173 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T00:05:46.673 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T00:05:46.673 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T00:05:46.673 [Cloud] Queued cloud request. 2026-09-20T00:05:46.673 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T00:05:46.673 [Cloud] Dequeued cloud request. 2026-09-20T00:05:46.673 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T00:05:46.830 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8B4E52B1-48CA-C6BA-0EAE-8805EE3BFC55} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 00:05:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T00:05:47.345 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T00:08:41.396 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T00:08:41.396 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T00:08:41.396 [Cloud] Queued cloud request. 2026-09-20T00:08:41.396 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T00:08:41.396 [Cloud] Dequeued cloud request. 2026-09-20T00:08:41.396 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T00:08:41.552 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{703282C8-3794-DBE2-39E1-0C5161D9BC72} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 00:08:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T00:08:42.052 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T00:09:29.427 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T00:09:29.427 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T00:09:29.427 [Cloud] Queued cloud request. 2026-09-20T00:09:29.427 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T00:09:29.427 [Cloud] Dequeued cloud request. 2026-09-20T00:09:29.427 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T00:09:29.505 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{026CBB62-9EAB-B024-3D81-85D672387ED3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 00:09:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T00:09:30.021 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T00:13:31.021 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T00:13:31.021 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T00:13:31.021 [Cloud] Queued cloud request. 2026-09-20T00:13:31.021 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T00:13:31.021 [Cloud] Dequeued cloud request. 2026-09-20T00:13:31.021 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T00:13:41.099 [Cloud] End of cloud request. 2026-09-20T00:13:41.458 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T00:13:41.614 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T00:16:49.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T00:16:49.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T00:16:49.304 [Cloud] Queued cloud request. 2026-09-20T00:16:49.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T00:16:49.304 [Cloud] Dequeued cloud request. 2026-09-20T00:16:49.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T00:16:49.444 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DB537C1A-FBBD-ECE7-A6D8-ACB859CED9A5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 00:16:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T00:16:49.944 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T00:28:46.467 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T00:39:58.378 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T00:39:58.378 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T00:39:58.378 [Cloud] Queued cloud request. 2026-09-20T00:39:58.378 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T00:39:58.378 [Cloud] Dequeued cloud request. 2026-09-20T00:39:58.378 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T00:39:58.535 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C62F2DB7-F390-0AA2-E380-F8424D7B9D71} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 00:39:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T00:39:59.050 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T00:43:51.473 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T00:51:58.541 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T00:51:58.541 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T00:51:58.541 [Cloud] Queued cloud request. 2026-09-20T00:51:58.541 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T00:51:58.541 [Cloud] Dequeued cloud request. 2026-09-20T00:51:58.541 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T00:51:58.728 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{73BDE808-4E48-1DE2-4190-69D66C79410E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 00:51:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T00:51:59.244 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T00:58:56.482 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T00:59:47.607 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T00:59:47.607 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T00:59:47.607 [Cloud] Queued cloud request. 2026-09-20T00:59:47.607 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T00:59:47.607 [Cloud] Dequeued cloud request. 2026-09-20T00:59:47.607 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T00:59:47.810 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{047920E8-6772-C94B-FFC7-EC8D8325FF46} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 00:59:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T00:59:48.325 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T01:00:01.294 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590790, FileId: 0x4200000003e440, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.294 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590789, FileId: 0x5200000003e980, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.310 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590796, FileId: 0x4400000003e440, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.310 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590795, FileId: 0x5400000003e980, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.325 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590802, FileId: 0x4600000003e440, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.325 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590801, FileId: 0x5600000003e980, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.341 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590807, FileId: 0x5800000003e980, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.341 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590808, FileId: 0x4800000003e440, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.341 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590814, FileId: 0x5a00000003e980, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.341 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590815, FileId: 0x4a00000003e440, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.357 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590820, FileId: 0x5c00000003e980, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.357 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590821, FileId: 0x4c00000003e440, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.372 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590827, FileId: 0x4e00000003e440, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.372 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590826, FileId: 0x5e00000003e980, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.388 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590832, FileId: 0x6000000003e980, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.388 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590833, FileId: 0x5000000003e440, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.404 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590839, FileId: 0x5200000003e440, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.404 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590838, FileId: 0x6200000003e980, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.404 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590844, FileId: 0x6400000003e980, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.404 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590845, FileId: 0x5400000003e440, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.419 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590851, FileId: 0x5600000003e440, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.419 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590850, FileId: 0x6600000003e980, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.435 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590856, FileId: 0x6800000003e980, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:00:01.435 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a142-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #590857, FileId: 0x5800000003e440, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T01:02:01.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T01:02:01.904 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T01:02:01.904 [Cloud] Queued cloud request. 2026-09-20T01:02:01.904 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T01:02:01.904 [Cloud] Dequeued cloud request. 2026-09-20T01:02:01.904 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T01:02:02.091 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3F5FA1B3-0474-B791-3268-7B9EE3F6A4D7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 01:02:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T01:02:02.591 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T01:05:27.531 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T01:05:27.531 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T01:05:27.531 [Cloud] Queued cloud request. 2026-09-20T01:05:27.531 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T01:05:27.531 [Cloud] Dequeued cloud request. 2026-09-20T01:05:27.531 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T01:05:27.687 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EBFE87C5-345A-095B-72B6-A100BD7482C9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 01:05:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T01:05:28.187 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T01:11:53.455 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T01:11:53.455 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T01:11:53.455 [Cloud] Queued cloud request. 2026-09-20T01:11:53.455 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T01:11:53.455 [Cloud] Dequeued cloud request. 2026-09-20T01:11:53.455 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T01:11:53.596 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{13D4BDF7-1675-B4E8-D176-920F80E02918} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 01:11:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T01:11:54.096 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T01:14:01.487 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T01:19:07.960 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:182DDC81-455A-4457-B895-4BB05AEEB670, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-20T01:19:07.960 Scheduled scan with Id 182DDC81-455A-4457-B895-4BB05AEEB670 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-20T01:19:07.976 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-20T01:19:07.976 [SFC] System file cache build is not needed (already completed) 2026-09-20T01:19:29.991 Engine:Triggered AR EMS scan 2026-09-20T01:19:29.991 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.007 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.022 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.022 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.022 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.038 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.054 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.054 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.069 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.069 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.069 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.085 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.085 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.085 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.101 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.101 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.116 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.116 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.116 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.132 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.132 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.132 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.147 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.147 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.147 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.147 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.163 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.179 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.179 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.179 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.179 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.194 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.194 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.210 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.210 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.226 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.226 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.226 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.226 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.226 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.241 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.241 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.241 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.241 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.257 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.272 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.272 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.272 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.288 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.288 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.288 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.304 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.304 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.304 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.304 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.319 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.335 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.335 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.351 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.351 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:19:30.366 Engine:EMS scan for process: svchost pid: 6844, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-20T01:20:07.397 QuickScan:ScanID:182DDC81-455A-4457-B895-4BB05AEEB670: Quick scan finished with error 0 2026-09-20T01:20:07.897 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-20T01:20:07.897 [RTP] Duplicating the current plugin configuration object... 2026-09-20T01:20:07.897 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-20T01:20:07.897 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-20T01:20:07.897 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-20T01:20:07.897 [RTP] No config change detected. Not updating plugin configuration. 2026-09-20T01:20:07.897 [RTP] No config changes found. No configuration switch. 2026-09-20T01:20:07.897 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-20T01:28:11.386 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T01:28:11.386 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T01:28:11.386 [Cloud] Queued cloud request. 2026-09-20T01:28:11.386 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T01:28:11.386 [Cloud] Dequeued cloud request. 2026-09-20T01:28:11.386 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T01:28:11.543 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{62DDFE8B-0885-6331-6A63-B74AF78C0F6D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 01:28:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T01:28:12.043 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T01:29:06.496 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T01:35:02.450 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T01:35:02.450 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T01:35:02.450 [Cloud] Queued cloud request. 2026-09-20T01:35:02.450 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T01:35:02.450 [Cloud] Dequeued cloud request. 2026-09-20T01:35:02.450 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T01:35:02.590 [Cloud] End of cloud request. 2026-09-20T01:35:02.606 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T01:35:02.606 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T01:35:02.606 [Cloud] Queued cloud request. 2026-09-20T01:35:02.606 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T01:35:02.606 [Cloud] Dequeued cloud request. 2026-09-20T01:35:02.606 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T01:35:02.700 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{72053250-211B-0CED-AA6C-2FF8B1D2B2A6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 01:35:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T01:35:03.106 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T01:38:21.391 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T01:38:21.391 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T01:38:21.391 [Cloud] Queued cloud request. 2026-09-20T01:38:21.391 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T01:38:21.391 [Cloud] Dequeued cloud request. 2026-09-20T01:38:21.391 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T01:38:25.938 [Cloud] End of cloud request. 2026-09-20T01:38:26.438 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T01:39:38.001 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 18402, Count: 1311, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-20T01:39:38.001 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 4669, Count: 436, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T01:39:38.001 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 2654, Count: 210, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-20T01:39:38.001 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-20T01:39:38.001 ProcessImageName: AgentShellService.exe, Pid: 8084, TotalTime: 637, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 44% 2026-09-20T01:39:38.001 ProcessImageName: WmiPrvSE.exe, Pid: 2216, TotalTime: 538, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 10% 2026-09-20T01:39:38.001 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 408, Count: 29, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-20T01:39:38.001 ProcessImageName: WmiPrvSE.exe, Pid: 1496, TotalTime: 377, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-20T01:39:38.001 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T01:39:38.001 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-20T01:39:38.001 ProcessImageName: taskhostw.exe, Pid: 6232, TotalTime: 61, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-20T01:39:38.001 ProcessImageName: taskhostw.exe, Pid: 5132, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-20T01:39:38.001 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 60, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-20T01:39:38.001 ProcessImageName: cmd.exe, Pid: 7824, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-20T01:39:38.001 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-20T01:39:38.001 ProcessImageName: DeviceCensus.exe, Pid: 7756, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-20T01:39:38.001 ProcessImageName: tzsync.exe, Pid: 7768, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezones.xml, EstimatedImpact: 3% 2026-09-20T01:39:38.001 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-20T01:39:38.001 ProcessImageName: mysqldump.exe, Pid: 1096, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-20T01:39:38.001 ProcessImageName: ngentask.exe, Pid: 4024, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 8% 2026-09-20T01:39:38.001 ProcessImageName: powershell.exe, Pid: 2500, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4DD5.tmp, EstimatedImpact: 0% 2026-09-20T01:39:38.001 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-20T01:44:11.502 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{B2E9DD21-A165-BBA3-F134-01BB0E364450} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-20-2026 01:52:53 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T01:52:54.631 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T01:52:54.631 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T01:52:54.631 [Cloud] Queued cloud request. 2026-09-20T01:52:54.631 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T01:52:54.631 [Cloud] Dequeued cloud request. 2026-09-20T01:52:54.631 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T01:52:54.928 [Cloud] End of cloud request. 2026-09-20T01:52:55.428 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T01:59:16.510 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T02:14:21.516 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T02:15:22.688 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T02:15:22.688 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T02:15:22.688 [Cloud] Queued cloud request. 2026-09-20T02:15:22.688 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T02:15:22.688 [Cloud] Dequeued cloud request. 2026-09-20T02:15:22.688 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T02:15:22.876 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8F645BA8-AF83-7E40-5217-D50CE184EAE8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 02:15:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T02:15:23.376 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T02:29:26.524 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T02:40:26.435 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T02:40:26.435 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T02:40:26.435 [Cloud] Queued cloud request. 2026-09-20T02:40:26.435 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T02:40:26.435 [Cloud] Dequeued cloud request. 2026-09-20T02:40:26.435 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T02:40:26.638 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1C7E5F29-3690-A57E-688F-7ACD2377E890} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 02:40:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T02:40:27.153 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T02:43:19.888 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T02:43:19.888 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T02:43:19.888 [Cloud] Queued cloud request. 2026-09-20T02:43:19.888 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T02:43:19.888 [Cloud] Dequeued cloud request. 2026-09-20T02:43:19.888 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T02:43:20.075 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5596AFC0-A0E5-F5FE-A0D7-B8019435760C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 02:43:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T02:43:20.575 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T02:44:31.530 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T02:49:38.002 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T02:49:38.002 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T02:49:38.002 [Cloud] Queued cloud request. 2026-09-20T02:49:38.002 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T02:49:38.002 [Cloud] Dequeued cloud request. 2026-09-20T02:49:38.002 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T02:49:38.173 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EA48F679-77E8-625C-E383-CC91AEA2AD96} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 02:49:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T02:49:38.689 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T02:59:36.538 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T03:07:07.056 [AutoPurge] Verification Routine tasks have started. 2026-09-20T03:07:07.056 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-20T03:07:07.056 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-20T03:07:07.056 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-20T03:07:07.056 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-20T03:07:07.056 [AutoPurge] MpSignalMaintenanceMode ...ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-20T03:07:07.165 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-20T03:07:07.181 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-20T03:07:07.196 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-20T03:07:07.212 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-20T03:07:07.212 [AutoPurge] Removing expired default signature package ... 2026-09-20T03:07:07.212 [AutoPurge] Cleanup Routine tasks have started. 2026-09-20T03:07:07.228 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-20T03:07:07.228 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-20T03:07:07.228 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-20-2026 03:07:07 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-20-2026 03:07:07 2026-09-20T03:07:07.228 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-20T03:07:07.228 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-20T03:07:07.228 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-20T03:07:07.228 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-20T03:07:07.228 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-20T03:07:07.243 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-20T03:07:07.525 Job Notification: New process added to job (5648) 2026-09-20T03:07:07.540 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-20T03:07:07.696 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-20T03:07:08.165 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:07:08.384 Job Notification: Process exited from job (5648) 2026-09-20T03:07:08.462 [AutoPurge] Verification Routine tasks have ended. 2026-09-20T03:07:08.759 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-20T03:07:08.884 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-20T03:07:09.353 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-20T03:07:09.431 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-20T03:07:09.603 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-20T03:07:11.275 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:11.618 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-20T03:07:11.853 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-20T03:07:11.868 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:12.071 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-20T03:07:12.743 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-20T03:07:13.368 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-20T03:07:13.478 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-20T03:07:13.634 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-20T03:07:13.884 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:07:14.040 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-20T03:07:14.368 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-20T03:07:14.493 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-20T03:07:14.665 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:14.806 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:14.868 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:14.884 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-20T03:07:15.040 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:07:15.103 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-20T03:07:15.134 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-20T03:07:15.181 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-20T03:07:15.306 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-20T03:07:15.665 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:15.696 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-20T03:07:16.103 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:07:16.228 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-20T03:07:16.853 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-20T03:07:17.368 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:17.493 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:07:17.806 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-20T03:07:18.259 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-20T03:07:18.353 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-20T03:07:18.681 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.271.7\microsoftedgeupdatesetup_x86_1.3.271.7.exe", hr=0x0 2026-09-20T03:07:18.775 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-20T03:07:18.884 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:19.384 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:07:19.525 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-20T03:07:19.525 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-20T03:07:19.572 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-20T03:07:19.759 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-20T03:07:19.837 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-20T03:07:19.884 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:19.978 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-20T03:07:20.212 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-20T03:07:20.603 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-20T03:07:20.822 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-20T03:07:21.369 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-20T03:07:22.572 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-20T03:07:23.057 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-20T03:07:23.088 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-20T03:07:23.119 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-20T03:07:23.119 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-20T03:07:23.135 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-20T03:07:23.275 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-20T03:07:23.478 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-20T03:07:23.510 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:23.572 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-20T03:07:23.978 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-20T03:07:24.025 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-20T03:07:24.041 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-20T03:07:24.088 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-20T03:07:24.572 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:24.807 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:24.822 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-20T03:07:24.869 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-20T03:07:24.885 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:25.307 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-20T03:07:25.650 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-20T03:07:25.666 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:26.369 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-20T03:07:26.401 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-20T03:07:27.072 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:07:27.432 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-20T03:07:27.838 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-20T03:07:27.979 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:28.151 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:28.307 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-20T03:07:28.510 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-20T03:07:28.573 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-20T03:07:28.635 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:29.135 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-20T03:07:29.432 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-20T03:07:29.463 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-20T03:07:29.526 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:07:29.870 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:07:30.073 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-20T03:07:30.182 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-20T03:07:30.307 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-20T03:07:30.338 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-20T03:07:30.416 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-20T03:07:30.979 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-20T03:07:31.401 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-20T03:07:31.510 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-20T03:07:31.620 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-20T03:07:32.167 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-20T03:07:32.198 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:32.542 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-20T03:07:32.635 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-20T03:07:32.635 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-20T03:07:32.667 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-20T03:07:32.760 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-20T03:07:32.792 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-20T03:07:32.838 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-20T03:07:33.229 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-20T03:07:33.229 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-20T03:07:33.557 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-20T03:07:33.760 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:33.854 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-20T03:07:33.870 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-20T03:07:34.089 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:07:34.323 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-20T03:07:34.745 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:07:35.042 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-20T03:07:35.182 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-20T03:07:35.542 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-20T03:07:35.557 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:35.760 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-20T03:07:35.870 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-20T03:07:36.401 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-20T03:07:36.448 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-20T03:07:36.651 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:36.651 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-20T03:07:36.854 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-20T03:07:36.917 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-20T03:07:37.120 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:07:37.667 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:07:37.807 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-20T03:07:37.854 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-20T03:07:38.511 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-20T03:07:38.526 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-20T03:07:38.792 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-20T03:07:38.964 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-20T03:07:39.307 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-20T03:07:39.964 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:07:40.151 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-20T03:07:40.558 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-20T03:07:40.839 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-20T03:07:40.979 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-20T03:07:41.011 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:41.026 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-20T03:07:41.120 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-20T03:07:41.339 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-20T03:07:41.698 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-20T03:07:41.792 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-20T03:07:41.995 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-20T03:07:42.230 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-20T03:07:42.276 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-20T03:07:42.558 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:07:42.761 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-20T03:07:42.948 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-20T03:07:43.776 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:07:43.839 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-20T03:07:43.933 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-20T03:07:43.979 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-20T03:07:44.948 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-20T03:07:45.042 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-20T03:07:45.136 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-20T03:07:45.261 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-20T03:07:45.480 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-20T03:07:45.636 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-20T03:07:46.339 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-20T03:07:46.386 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-20T03:07:46.417 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-20T03:07:46.511 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-20T03:07:46.620 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-20T03:07:46.948 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-20T03:07:47.089 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-20T03:07:47.105 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-20T03:07:47.136 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-20T03:07:47.214 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:47.261 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-20T03:07:47.292 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-20T03:07:47.636 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-20T03:07:47.761 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-20T03:07:48.089 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-20T03:07:48.214 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:48.433 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-20T03:07:48.792 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-20T03:07:48.886 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-20T03:07:49.058 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-20T03:07:49.292 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-20T03:07:49.355 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-20T03:07:49.433 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:07:49.589 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:07:49.776 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-20T03:07:49.839 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-20T03:07:50.042 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:07:50.245 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-20T03:07:50.339 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:07:50.620 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:07:50.651 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-20T03:07:50.698 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-20T03:07:50.886 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-20T03:07:50.917 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-20T03:07:50.933 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-20T03:07:51.370 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-20T03:07:51.433 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:51.464 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-20T03:07:51.560 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:07:51.761 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:07:51.886 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-20T03:07:52.011 Engine:Setting original file name "CopilotUpdate.exe" for "c:\windows\systemtemp\copilotupdate.exe.old{9c304e8d-10bc-445a-8771-81a12ae6dd9b}", hr=0x0 2026-09-20T03:07:52.464 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-20T03:07:52.589 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-20T03:07:52.652 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-20T03:07:52.964 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-20T03:07:52.995 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-20T03:07:53.042 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-20T03:07:53.370 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-20T03:07:53.433 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-20T03:07:53.761 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-20T03:07:53.839 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-20T03:07:53.886 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-20T03:07:53.902 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:53.917 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:53.948 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:07:53.948 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-20T03:07:53.980 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:54.620 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-20T03:07:54.948 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-20T03:07:55.292 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:07:55.339 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-20T03:07:55.605 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:55.620 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:07:55.745 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-20T03:07:56.073 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:56.105 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-20T03:07:56.277 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-20T03:07:56.292 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-20T03:07:56.417 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-20T03:07:56.511 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-20T03:07:56.511 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-20T03:07:56.761 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-20T03:07:56.792 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-20T03:07:56.792 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-20T03:07:56.964 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-20T03:07:57.167 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:57.355 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-20T03:07:57.714 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\systemapps\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-20T03:07:57.823 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-20T03:07:57.948 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-20T03:07:58.152 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-20T03:07:58.323 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-20T03:07:58.323 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-20T03:07:58.339 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:07:58.558 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-20T03:07:58.573 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-20T03:07:58.792 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-20T03:07:58.933 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-20T03:07:58.933 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-20T03:07:59.730 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:07:59.730 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-20T03:07:59.823 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-20T03:07:59.948 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:07:59.948 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:08:00.777 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:08:01.261 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-20T03:08:01.464 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:01.480 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-20T03:08:01.683 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:01.714 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-20T03:08:01.808 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-20T03:08:01.933 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-20T03:08:01.980 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-20T03:08:02.277 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-20T03:08:02.323 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:08:02.573 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:08:02.589 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:02.636 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-20T03:08:03.230 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-20T03:08:03.777 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-20T03:08:03.808 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:03.855 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-20T03:08:03.948 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:08:04.136 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:04.214 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-20T03:08:04.511 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-20T03:08:04.964 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:04.995 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-20T03:08:05.245 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:08:05.417 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-20T03:08:05.620 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-20T03:08:05.636 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:05.917 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-20T03:08:06.292 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-20T03:08:06.339 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:06.449 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:06.574 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-20T03:08:06.605 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-20T03:08:06.964 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-20T03:08:07.089 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:07.277 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-20T03:08:07.308 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-20T03:08:07.324 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:07.370 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:08:07.542 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-20T03:08:07.605 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:08:07.995 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-20T03:08:08.089 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-20T03:08:08.589 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-20T03:08:08.652 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-20T03:08:08.714 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-20T03:08:08.808 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-20T03:08:08.855 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:08:08.886 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-20T03:08:08.933 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-20T03:08:09.386 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-20T03:08:09.574 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-20T03:08:09.855 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-20T03:08:09.855 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-20T03:08:10.183 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-20T03:08:10.199 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:10.495 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-20T03:08:10.824 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-20T03:08:11.089 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-20T03:08:11.167 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-20T03:08:11.230 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-20T03:08:11.308 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:08:11.449 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-20T03:08:11.495 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-20T03:08:11.527 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-20T03:08:11.620 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-20T03:08:11.980 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-20T03:08:12.027 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:08:12.074 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:08:12.464 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-20T03:08:12.574 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:08:12.777 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-20T03:08:13.027 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-20T03:08:13.308 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-20T03:08:13.324 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:13.745 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-20T03:08:13.745 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-20T03:08:13.792 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-20T03:08:14.027 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-20T03:08:14.277 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-20T03:08:14.292 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-20T03:08:14.605 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-20T03:08:14.699 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-20T03:08:14.808 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-20T03:08:14.886 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:08:14.917 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-20T03:08:15.074 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-20T03:08:15.277 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-20T03:08:15.449 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-20T03:08:15.527 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-20T03:08:15.699 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-20T03:08:16.949 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-20T03:08:17.324 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-20T03:08:17.480 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-20T03:08:17.699 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:08:17.949 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-20T03:08:18.136 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-20T03:08:18.417 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-20T03:08:18.667 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-20T03:08:18.761 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-20T03:08:18.792 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-20T03:08:18.808 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-20T03:08:18.933 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-20T03:08:19.230 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-20T03:08:19.245 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:19.261 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-20T03:08:19.339 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-20T03:08:19.355 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-20T03:08:19.464 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-20T03:08:19.839 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-20T03:08:19.933 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-20T03:08:20.120 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-20T03:08:20.120 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:20.261 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-20T03:08:20.261 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-20T03:08:20.480 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-20T03:08:20.542 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:08:20.808 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-20T03:08:21.120 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-20T03:08:21.574 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:08:22.042 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-20T03:08:22.120 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-20T03:08:22.605 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-20T03:08:22.980 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:08:23.089 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:23.370 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-20T03:08:23.636 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-20T03:08:23.699 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-20T03:08:23.855 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-20T03:08:24.011 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-20T03:08:24.464 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-20T03:08:25.183 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-20T03:08:25.261 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-20T03:08:25.339 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-20T03:08:25.917 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-20T03:08:26.042 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-20T03:08:26.308 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-20T03:08:26.386 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-20T03:08:26.480 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-20T03:08:26.480 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-20T03:08:26.917 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-20T03:08:27.027 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-20T03:08:27.042 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:27.074 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-20T03:08:27.386 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-20T03:08:27.417 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:08:27.636 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-20T03:08:27.855 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-20T03:08:28.199 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-20T03:08:28.652 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-20T03:08:28.761 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:08:28.949 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:29.136 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-20T03:08:29.464 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:29.542 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-20T03:08:29.745 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-20T03:08:29.917 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-20T03:08:30.042 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:30.183 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-20T03:08:30.402 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-20T03:08:30.808 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-20T03:08:30.855 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-20T03:08:30.886 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-20T03:08:31.027 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:31.058 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-20T03:08:31.417 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-20T03:08:31.558 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-20T03:08:31.652 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:32.636 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-20T03:08:33.214 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-20T03:08:33.261 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-20T03:08:33.324 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-20T03:08:33.355 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-20T03:08:33.699 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:33.761 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-20T03:08:33.964 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-20T03:08:34.042 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-20T03:08:34.120 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-20T03:08:34.183 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:34.261 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-20T03:08:34.464 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-20T03:08:34.527 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-20T03:08:35.074 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-20T03:08:35.136 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-20T03:08:35.214 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:08:35.230 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-20T03:08:35.245 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-20T03:08:35.245 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-20T03:08:35.370 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-20T03:08:35.386 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:08:35.402 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-20T03:08:35.449 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-20T03:08:35.886 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-20T03:08:35.917 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-20T03:08:36.308 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:08:36.370 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-20T03:08:36.386 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-20T03:08:36.417 Engine:Setting original file name "notification_helper.exe" for "c:\program files (x86)\microsoft\edge\application\153.0.4234.32\notification_click_helper.exe", hr=0x0 2026-09-20T03:08:36.449 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-20T03:08:37.277 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-20T03:08:37.417 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:08:37.589 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:08:37.589 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-20T03:08:37.777 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-20T03:08:37.964 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-20T03:08:38.089 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-20T03:08:38.167 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:38.870 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-20T03:08:38.902 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-20T03:08:39.042 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-20T03:08:39.058 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-20T03:08:39.074 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:08:39.589 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:08:39.589 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-20T03:08:39.730 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-20T03:08:39.745 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-20T03:08:39.902 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-20T03:08:40.339 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-20T03:08:40.730 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-20T03:08:40.964 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:41.355 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-20T03:08:41.605 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-20T03:08:41.652 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-20T03:08:41.792 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-20T03:08:41.824 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-20T03:08:41.902 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-20T03:08:41.995 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-20T03:08:42.089 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-20T03:08:42.105 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:08:42.386 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-20T03:08:42.449 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-20T03:08:42.730 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-20T03:08:42.855 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-20T03:08:43.011 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-20T03:08:43.027 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:08:43.183 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\de-de\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:43.355 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-console-l1-1-0.dll", hr=0x0 2026-09-20T03:08:43.495 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0 2026-09-20T03:08:43.495 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-registry-l2-1-0.dll", hr=0x0 2026-09-20T03:08:43.839 Engine:Setting original file name "MrmCore.dll" for "c:\windows\winsxs\wow64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.20348.5020_none_9e6a80bbc86408d7\mrmcorer.dll", hr=0x0 2026-09-20T03:08:43.855 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:43.980 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_en-gb_56416fd74780e848\vsswmi.dll.mui", hr=0x0 2026-09-20T03:08:43.995 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\es-es\aerolite.msstyles.mui", hr=0x0 2026-09-20T03:08:44.167 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_7573f1c6d4639f87\penimc.dll", hr=0x0 2026-09-20T03:08:44.183 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.data.winmd", hr=0x0 2026-09-20T03:08:44.370 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\de-de\ndisimplatcim.dll.mui", hr=0x0 2026-09-20T03:08:44.449 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_4e347e352039867c\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:44.542 Engine:Setting original file name "winsqlite3" for "c:\windows\winsxs\wow64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.20348.4647_none_c9096b99901f19cd\winsqlite3.dll", hr=0x0 2026-09-20T03:08:44.574 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0 2026-09-20T03:08:44.589 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000c.dll", hr=0x0 2026-09-20T03:08:45.089 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-1-0.dll", hr=0x0 2026-09-20T03:08:45.105 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata000a.dll", hr=0x0 2026-09-20T03:08:45.402 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-2-0.dll", hr=0x0 2026-09-20T03:08:45.495 Engine:Setting original file name "wmic.exe" for "c:\windows\winsxs\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.20348.2849_none_54405a5933961199\wmic.exe", hr=0x0 2026-09-20T03:08:45.667 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.storage.winmd", hr=0x0 2026-09-20T03:08:45.980 Engine:Setting original file name "CRYPT32.DLL" for "c:\windows\systemresources\crypt32.dll.mun", hr=0x0 2026-09-20T03:08:46.230 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_7d8ffbc5cb37c8e0\bootmgr.exe.mui", hr=0x0 2026-09-20T03:08:46.277 Engine:Setting original file name "mstsc.exe" for "c:\windows\systemresources\mstsc.exe.mun", hr=0x0 2026-09-20T03:08:46.495 Engine:Setting original file name "SYSTEMCPL.DLL" for "c:\windows\systemresources\systemcpl.dll.mun", hr=0x0 2026-09-20T03:08:46.542 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0 2026-09-20T03:08:46.667 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1e6e07718388e886\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:46.714 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0 2026-09-20T03:08:47.339 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0 2026-09-20T03:08:47.339 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mpg4decd_31bf3856ad364e35_10.0.20348.2849_none_08e768f194682e23\mpg4decd.dll", hr=0x0 2026-09-20T03:08:47.355 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0 2026-09-20T03:08:47.402 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0 2026-09-20T03:08:47.605 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-1.dll", hr=0x0 2026-09-20T03:08:47.620 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\naturallanguage6.dll", hr=0x0 2026-09-20T03:08:48.074 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0 2026-09-20T03:08:48.324 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0 2026-09-20T03:08:48.605 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ja-jp_5634cc97d85965d9\bootmgr_ex.efi.mui", hr=0x0 2026-09-20T03:08:48.620 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0 2026-09-20T03:08:48.870 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_d7c56d20c9fb1c22\diagpackage.dll.mui", hr=0x0 2026-09-20T03:08:49.136 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgfw_ex.efi.mui", hr=0x0 2026-09-20T03:08:49.183 OriginalFileName Maintenance::28302 files in Moac, 0 skipped (cached), 539 filename set 2026-09-20T03:08:49.183 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-20T03:12:43.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T03:12:43.904 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T03:12:43.904 [Cloud] Queued cloud request. 2026-09-20T03:12:43.904 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T03:12:43.904 [Cloud] Dequeued cloud request. 2026-09-20T03:12:43.904 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T03:12:44.107 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5DE62BEC-5F55-1B40-2F95-6817F812492C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 03:12:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T03:12:44.622 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-20T03:12:44.654 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T03:12:44.654 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-20T03:12:44.654 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-20T03:12:44.654 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-20T03:12:44.654 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-20T03:12:44.654 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-20T03:12:44.654 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-20T03:12:44.654 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-20T03:12:44.654 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-20T03:12:44.654 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-20T03:12:44.654 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-20T03:12:44.654 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-20T03:12:44.654 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-20T03:12:44.654 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-20T03:12:44.654 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-20T03:12:44.654 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T03:12:44.654 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-20T03:12:44.654 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-20T03:12:44.654 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-20T03:12:44.654 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-20T03:12:44.654 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-20T03:12:44.654 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-20T03:12:44.654 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T03:12:44.669 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T03:12:44.669 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T03:12:47.232 [RTP] Duplicating the current plugin configuration object... 2026-09-20T03:12:47.232 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-20T03:12:47.232 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-20T03:12:47.232 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-20T03:12:47.232 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-20T03:12:47.232 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-20T03:12:48.622 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T03:12:48.622 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T03:12:48.622 [Cloud] Queued cloud request. 2026-09-20T03:12:48.622 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T03:12:48.622 [Cloud] Dequeued cloud request. 2026-09-20T03:12:48.622 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T03:12:48.700 [Cloud] End of cloud request. 2026-09-20T03:12:49.216 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T03:14:41.544 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T03:29:46.552 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T03:36:00.570 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T03:36:00.570 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T03:36:00.570 [Cloud] Queued cloud request. 2026-09-20T03:36:00.570 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T03:36:00.570 [Cloud] Dequeued cloud request. 2026-09-20T03:36:00.570 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T03:36:01.039 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F770F0AD-CC36-8414-EFFD-B508E4AED16E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 03:36:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T03:36:01.539 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T03:39:38.072 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 19366, Count: 1362, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-20T03:39:38.072 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 4900, Count: 410, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-20T03:39:38.072 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 4669, Count: 436, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T03:39:38.072 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-20T03:39:38.072 ProcessImageName: AgentShellService.exe, Pid: 8084, TotalTime: 637, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 44% 2026-09-20T03:39:38.072 ProcessImageName: WmiPrvSE.exe, Pid: 2216, TotalTime: 538, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 10% 2026-09-20T03:39:38.072 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 423, Count: 31, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-20T03:39:38.072 ProcessImageName: WmiPrvSE.exe, Pid: 1496, TotalTime: 377, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-20T03:39:38.072 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T03:39:38.072 ProcessImageName: python.exe, Pid: 6660, TotalTime: 166, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-20T03:39:38.072 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-20T03:39:38.072 ProcessImageName: taskhostw.exe, Pid: 6232, TotalTime: 61, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-20T03:39:38.072 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-20T03:39:38.072 ProcessImageName: taskhostw.exe, Pid: 5132, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-20T03:39:38.072 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 60, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-20T03:39:38.072 ProcessImageName: cmd.exe, Pid: 7824, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-20T03:39:38.072 ProcessImageName: DeviceCensus.exe, Pid: 7756, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-20T03:39:38.072 ProcessImageName: tzsync.exe, Pid: 7768, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezones.xml, EstimatedImpact: 3% 2026-09-20T03:39:38.072 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-20T03:39:38.072 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-20T03:39:38.072 ProcessImageName: mysqldump.exe, Pid: 1096, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-20T03:39:38.072 ProcessImageName: ngentask.exe, Pid: 4024, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 8% 2026-09-20T03:39:38.072 ProcessImageName: powershell.exe, Pid: 2500, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4DD5.tmp, EstimatedImpact: 0% 2026-09-20T03:39:38.072 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-20T03:44:00.074 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T03:44:00.074 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T03:44:00.074 [Cloud] Queued cloud request. 2026-09-20T03:44:00.074 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T03:44:00.074 [Cloud] Dequeued cloud request. 2026-09-20T03:44:00.074 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T03:44:00.214 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3DF4C31E-1ECB-33AF-7EC5-A692FFAC4D56} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 03:44:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T03:44:00.730 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T03:44:51.558 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T03:59:56.565 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T04:02:34.659 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T04:02:34.659 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T04:02:34.659 [Cloud] Queued cloud request. 2026-09-20T04:02:34.659 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T04:02:34.659 [Cloud] Dequeued cloud request. 2026-09-20T04:02:34.659 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T04:02:34.815 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{59AED18E-3418-3CE2-477F-DB2BD7F0ACAF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 04:02:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T04:02:35.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T04:12:54.650 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T04:12:54.650 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T04:12:54.650 [Cloud] Queued cloud request. 2026-09-20T04:12:54.650 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T04:12:54.650 [Cloud] Dequeued cloud request. 2026-09-20T04:12:54.650 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T04:12:54.791 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E9FFECC0-F4D9-BEBD-FF13-5A3652DD4369} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 04:12:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T04:12:55.306 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T04:15:01.572 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T04:30:06.579 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T04:45:11.586 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T04:50:15.073 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T04:50:15.073 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T04:50:15.073 [Cloud] Queued cloud request. 2026-09-20T04:50:15.073 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T04:50:15.073 [Cloud] Dequeued cloud request. 2026-09-20T04:50:15.073 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T04:50:15.230 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{128952CD-C8D7-F85E-FF9A-9693D56AF7C0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 04:50:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T04:50:15.730 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T04:57:42.062 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T04:57:42.062 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T04:57:42.062 [Cloud] Queued cloud request. 2026-09-20T04:57:42.062 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T04:57:42.062 [Cloud] Dequeued cloud request. 2026-09-20T04:57:42.062 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T04:57:42.202 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8CFEDE85-3168-41FF-6173-EE8F0235EA4D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 04:57:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T04:57:42.718 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T05:00:16.594 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T05:15:21.600 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T05:30:26.608 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T05:35:21.689 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T05:35:21.689 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T05:35:21.689 [Cloud] Queued cloud request. 2026-09-20T05:35:21.689 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T05:35:21.689 [Cloud] Dequeued cloud request. 2026-09-20T05:35:21.689 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T05:35:21.845 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{87FC1B54-4524-FFD7-C4C0-1BD9DEE2D333} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 05:35:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T05:35:22.345 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T05:39:38.128 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 21994, Count: 1527, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-20T05:39:38.128 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 6910, Count: 610, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-20T05:39:38.128 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 4669, Count: 436, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T05:39:38.128 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-20T05:39:38.128 ProcessImageName: AgentShellService.exe, Pid: 8084, TotalTime: 637, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 44% 2026-09-20T05:39:38.128 ProcessImageName: WmiPrvSE.exe, Pid: 2216, TotalTime: 538, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 10% 2026-09-20T05:39:38.128 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 438, Count: 33, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-20T05:39:38.128 ProcessImageName: WmiPrvSE.exe, Pid: 1496, TotalTime: 377, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-20T05:39:38.128 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T05:39:38.128 ProcessImageName: python.exe, Pid: 6660, TotalTime: 166, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-20T05:39:38.128 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-20T05:39:38.128 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-20T05:39:38.128 ProcessImageName: taskhostw.exe, Pid: 6232, TotalTime: 61, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-20T05:39:38.128 ProcessImageName: taskhostw.exe, Pid: 5132, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-20T05:39:38.128 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-20T05:39:38.128 ProcessImageName: cmd.exe, Pid: 7824, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-20T05:39:38.128 ProcessImageName: DeviceCensus.exe, Pid: 7756, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-20T05:39:38.128 ProcessImageName: tzsync.exe, Pid: 7768, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezones.xml, EstimatedImpact: 3% 2026-09-20T05:39:38.128 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-20T05:39:38.128 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-20T05:39:38.128 ProcessImageName: mysqldump.exe, Pid: 1096, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-20T05:39:38.128 ProcessImageName: ngentask.exe, Pid: 4024, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 8% 2026-09-20T05:39:38.128 ProcessImageName: powershell.exe, Pid: 2500, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4DD5.tmp, EstimatedImpact: 0% 2026-09-20T05:39:38.128 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-20T05:41:27.315 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T05:41:27.315 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T05:41:27.315 [Cloud] Queued cloud request. 2026-09-20T05:41:27.315 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T05:41:27.315 [Cloud] Dequeued cloud request. 2026-09-20T05:41:27.315 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T05:41:27.722 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A83C9012-3782-F957-786A-2E9360F2C059} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 05:41:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T05:41:28.222 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T05:45:31.614 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T05:56:55.634 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T05:56:55.634 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T05:56:55.634 [Cloud] Queued cloud request. 2026-09-20T05:56:55.634 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T05:56:55.634 [Cloud] Dequeued cloud request. 2026-09-20T05:56:55.634 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T05:56:55.822 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{082BE2F0-B7B2-A361-DE87-7CFFDDDF41B7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 05:56:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T05:56:56.337 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T06:00:36.622 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T06:05:45.608 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T06:05:45.608 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T06:05:45.608 [Cloud] Queued cloud request. 2026-09-20T06:05:45.608 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T06:05:45.608 [Cloud] Dequeued cloud request. 2026-09-20T06:05:45.608 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T06:05:45.795 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D11F1251-54E9-322D-DCD0-18F713E78727} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 06:05:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T06:05:46.311 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T06:06:03.342 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T06:06:03.342 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T06:06:03.342 [Cloud] Queued cloud request. 2026-09-20T06:06:03.342 [Cloud] Dequeued cloud request. 2026-09-20T06:06:03.342 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T06:06:03.342 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T06:06:03.436 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FAE535B0-5049-C35F-AA87-619E8A062934} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 06:06:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T06:06:03.936 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T06:06:06.452 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T06:06:06.452 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T06:06:06.452 [Cloud] Queued cloud request. 2026-09-20T06:06:06.452 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T06:06:06.452 [Cloud] Dequeued cloud request. 2026-09-20T06:06:06.452 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T06:06:06.780 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{516C985E-AB4E-14D1-3A91-8D7CE44F8757} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 06:06:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T06:06:07.280 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T06:06:46.342 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T06:06:46.342 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T06:06:46.342 [Cloud] Queued cloud request. 2026-09-20T06:06:46.342 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T06:06:46.342 [Cloud] Dequeued cloud request. 2026-09-20T06:06:46.342 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T06:06:46.420 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BA3E70C6-178A-5FF8-3135-8FBB2DFC54DB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 06:06:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T06:06:46.936 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T06:06:50.733 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T06:06:50.733 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T06:06:50.733 [Cloud] Queued cloud request. 2026-09-20T06:06:50.733 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T06:06:50.733 [Cloud] Dequeued cloud request. 2026-09-20T06:06:50.733 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T06:06:50.811 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E23D28B2-8BFC-472C-DE4A-8C092DDFE4BA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 06:06:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T06:06:51.327 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T06:07:17.717 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T06:07:17.717 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T06:07:17.717 [Cloud] Queued cloud request. 2026-09-20T06:07:17.717 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T06:07:17.717 [Cloud] Dequeued cloud request. 2026-09-20T06:07:17.717 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T06:07:26.047 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T06:07:26.047 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T06:07:26.047 [Cloud] Queued cloud request. 2026-09-20T06:07:26.047 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T06:07:26.047 [Cloud] Dequeued cloud request. 2026-09-20T06:07:26.047 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T06:07:27.734 [Cloud] End of cloud request. 2026-09-20T06:07:28.250 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T06:07:28.578 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D2E90233-74A5-A511-979E-D582385E4E10} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 06:07:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T06:07:29.078 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T06:07:48.470 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T06:07:48.470 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T06:07:48.470 [Cloud] Queued cloud request. 2026-09-20T06:07:48.470 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T06:07:48.470 [Cloud] Dequeued cloud request. 2026-09-20T06:07:48.470 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T06:07:48.563 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7757D711-8CA1-5160-9518-EA4ECE7CD7E0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 06:07:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T06:07:49.079 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T06:15:41.629 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T06:16:12.692 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T06:16:12.692 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T06:16:12.692 [Cloud] Queued cloud request. 2026-09-20T06:16:12.692 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T06:16:12.692 [Cloud] Dequeued cloud request. 2026-09-20T06:16:12.692 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T06:16:12.895 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DDA55600-992A-CDF2-77B1-DA4B122B5F02} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 06:16:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T06:16:13.395 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T06:30:46.635 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T06:32:21.682 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T06:32:21.682 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T06:32:21.682 [Cloud] Queued cloud request. 2026-09-20T06:32:21.682 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T06:32:21.729 [Cloud] Dequeued cloud request. 2026-09-20T06:32:21.729 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T06:32:21.885 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{99CAD85C-A036-D6DD-A13D-09EBAD7D3479} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 06:32:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T06:32:22.401 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T06:45:51.642 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T06:46:05.158 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T06:46:05.158 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T06:46:05.158 [Cloud] Queued cloud request. 2026-09-20T06:46:05.158 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T06:46:05.158 [Cloud] Dequeued cloud request. 2026-09-20T06:46:05.158 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T06:46:05.361 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7A637551-406F-A76E-0DF8-CEEA8435A9B1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 06:46:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T06:46:05.876 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T07:00:56.650 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T07:16:01.656 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T07:31:06.663 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T07:39:38.199 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 23443, Count: 1683, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-20T07:39:38.199 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 8967, Count: 810, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-20T07:39:38.199 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 4669, Count: 436, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T07:39:38.199 ProcessImageName: setup.exe, Pid: 7968, TotalTime: 2010, Count: 231, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\153.0.4234.32\Installer\msedge_7z.data, EstimatedImpact: 38% 2026-09-20T07:39:38.199 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-20T07:39:38.199 ProcessImageName: AgentShellService.exe, Pid: 8084, TotalTime: 637, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 44% 2026-09-20T07:39:38.199 ProcessImageName: WmiPrvSE.exe, Pid: 2216, TotalTime: 538, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 10% 2026-09-20T07:39:38.199 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 483, Count: 37, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-20T07:39:38.199 ProcessImageName: WmiPrvSE.exe, Pid: 1496, TotalTime: 377, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-20T07:39:38.199 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T07:39:38.199 ProcessImageName: python.exe, Pid: 6660, TotalTime: 166, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-20T07:39:38.199 ProcessImageName: MicrosoftEdge_X64_153.0.4234.48_153.0.4234.32.exe, Pid: 1632, TotalTime: 140, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E0F0336-3EB4-4EDE-92D0-6B35E5AD8574}\EDGEMITMP_99607.tmp\setup.exe, EstimatedImpact: 56% 2026-09-20T07:39:38.199 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-20T07:39:38.199 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 11, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-20T07:39:38.199 ProcessImageName: taskhostw.exe, Pid: 6232, TotalTime: 61, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-20T07:39:38.199 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-20T07:39:38.199 ProcessImageName: taskhostw.exe, Pid: 5132, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-20T07:39:38.199 ProcessImageName: cmd.exe, Pid: 7824, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-20T07:39:38.199 ProcessImageName: DeviceCensus.exe, Pid: 7756, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-20T07:39:38.199 ProcessImageName: tzsync.exe, Pid: 7768, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezones.xml, EstimatedImpact: 3% 2026-09-20T07:39:38.199 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-20T07:39:38.199 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-20T07:39:38.199 ProcessImageName: mysqldump.exe, Pid: 1096, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-20T07:39:38.199 ProcessImageName: ngentask.exe, Pid: 4024, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 8% 2026-09-20T07:39:38.199 ProcessImageName: powershell.exe, Pid: 2500, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4DD5.tmp, EstimatedImpact: 0% 2026-09-20T07:39:38.199 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-20T07:40:39.793 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #724595, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T07:40:41.606 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #724684, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T07:40:41.699 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #724687, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T07:40:42.762 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #724698, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T07:45:59.670 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T07:45:59.670 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T07:45:59.670 [Cloud] Queued cloud request. 2026-09-20T07:45:59.670 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T07:45:59.670 [Cloud] Dequeued cloud request. 2026-09-20T07:45:59.670 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T07:45:59.826 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DDE1B866-BA6E-BCA9-BFF4-D913DC2DB9F9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 07:45:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T07:46:00.342 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T07:46:11.670 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T07:46:24.201 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T07:46:24.201 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T07:46:24.201 [Cloud] Queued cloud request. 2026-09-20T07:46:24.201 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T07:46:24.201 [Cloud] Dequeued cloud request. 2026-09-20T07:46:24.201 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T07:46:24.279 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1C2FD1A3-3402-635C-6552-AA3CA18EF4BD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 07:46:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T07:46:24.779 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T07:46:33.482 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T07:46:33.482 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T07:46:33.482 [Cloud] Queued cloud request. 2026-09-20T07:46:33.482 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T07:46:33.482 [Cloud] Dequeued cloud request. 2026-09-20T07:46:33.482 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T07:46:33.576 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{85F83E8E-440C-8666-F1A5-2428C0D09AA2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 07:46:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T07:46:34.092 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T08:01:16.678 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T08:16:21.684 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T08:19:01.234 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1aeda-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #737372, FileId: 0x800000001e54d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T08:19:01.234 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1aeda-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #737371, FileId: 0x800000001e597, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T08:19:33.968 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1aedc-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #737562, FileId: 0x900000001e597, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T08:19:33.968 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1aedc-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #737563, FileId: 0x900000001e54d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T08:31:26.692 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T08:38:14.494 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T08:38:14.494 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T08:38:14.494 [Cloud] Queued cloud request. 2026-09-20T08:38:14.494 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T08:38:14.650 [Cloud] Dequeued cloud request. 2026-09-20T08:38:14.650 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T08:38:14.822 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BB3E57E8-A508-E8BD-60BB-592401541126} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 08:38:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T08:38:15.338 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T08:46:31.699 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T09:01:36.707 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T09:16:41.715 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T09:18:35.826 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T09:18:35.826 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T09:18:35.826 [Cloud] Queued cloud request. 2026-09-20T09:18:35.826 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T09:18:35.826 [Cloud] Dequeued cloud request. 2026-09-20T09:18:35.826 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T09:18:36.029 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{30F864F2-3131-B2D3-F565-C03D85F39C48} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 09:18:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T09:18:36.545 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T09:31:46.721 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T09:39:38.258 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 29138, Count: 2116, MaxTime: 375, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-20T09:39:38.258 ProcessImageName: setup.exe, Pid: 7968, TotalTime: 12330, Count: 685, MaxTime: 4703, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\153.0.4234.48\msedge.dll, EstimatedImpact: 18% 2026-09-20T09:39:38.258 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 10979, Count: 1009, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-20T09:39:38.258 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 4669, Count: 436, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T09:39:38.258 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-20T09:39:38.258 ProcessImageName: AgentShellService.exe, Pid: 8084, TotalTime: 637, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 44% 2026-09-20T09:39:38.258 ProcessImageName: WmiPrvSE.exe, Pid: 2216, TotalTime: 538, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 10% 2026-09-20T09:39:38.258 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 528, Count: 41, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-20T09:39:38.258 ProcessImageName: WmiPrvSE.exe, Pid: 1496, TotalTime: 377, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-20T09:39:38.258 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T09:39:38.258 ProcessImageName: python.exe, Pid: 6660, TotalTime: 166, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-20T09:39:38.258 ProcessImageName: MicrosoftEdge_X64_153.0.4234.48_153.0.4234.32.exe, Pid: 1632, TotalTime: 140, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E0F0336-3EB4-4EDE-92D0-6B35E5AD8574}\EDGEMITMP_99607.tmp\setup.exe, EstimatedImpact: 56% 2026-09-20T09:39:38.258 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-20T09:39:38.258 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 90, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-20T09:39:38.258 ProcessImageName: taskhostw.exe, Pid: 6232, TotalTime: 61, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-20T09:39:38.258 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-20T09:39:38.258 ProcessImageName: taskhostw.exe, Pid: 5132, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-20T09:39:38.258 ProcessImageName: cmd.exe, Pid: 7824, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-20T09:39:38.258 ProcessImageName: DeviceCensus.exe, Pid: 7756, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-20T09:39:38.258 ProcessImageName: tzsync.exe, Pid: 7768, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezones.xml, EstimatedImpact: 3% 2026-09-20T09:39:38.258 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-20T09:39:38.258 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-20T09:39:38.258 ProcessImageName: mysqldump.exe, Pid: 1096, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-20T09:39:38.258 ProcessImageName: ngentask.exe, Pid: 4024, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 8% 2026-09-20T09:39:38.258 ProcessImageName: powershell.exe, Pid: 2500, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4DD5.tmp, EstimatedImpact: 0% 2026-09-20T09:39:38.258 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-20T09:46:51.728 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T09:53:28.247 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T09:53:28.247 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T09:53:28.247 [Cloud] Queued cloud request. 2026-09-20T09:53:28.247 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T09:53:28.247 [Cloud] Dequeued cloud request. 2026-09-20T09:53:28.247 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T09:53:28.466 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{27F42CA3-C0F3-9433-7B21-236498A472B3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 09:53:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T09:53:28.966 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T09:58:29.799 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T09:58:29.799 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T09:58:29.799 [Cloud] Queued cloud request. 2026-09-20T09:58:29.799 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T09:58:29.799 [Cloud] Dequeued cloud request. 2026-09-20T09:58:29.799 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T09:58:29.971 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E520A7AC-55E0-C86A-D135-BC8FE06A5D0C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 09:58:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T09:58:30.486 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T10:01:56.736 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T10:17:01.743 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T10:26:00.280 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T10:26:00.280 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T10:26:00.280 [Cloud] Queued cloud request. 2026-09-20T10:26:00.280 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T10:26:00.280 [Cloud] Dequeued cloud request. 2026-09-20T10:26:00.280 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T10:26:00.468 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{48C2FA01-0B0E-0707-1063-EA29C3C4A108} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 10:26:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T10:26:00.983 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T10:32:06.751 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T10:44:32.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T10:44:32.445 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T10:44:32.445 [Cloud] Queued cloud request. 2026-09-20T10:44:32.445 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T10:44:32.445 [Cloud] Dequeued cloud request. 2026-09-20T10:44:32.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T10:44:32.633 [Cloud] End of cloud request. 2026-09-20T10:44:33.149 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T10:47:11.758 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T10:47:34.432 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T10:47:34.432 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T10:47:34.432 [Cloud] Queued cloud request. 2026-09-20T10:47:34.432 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T10:47:34.432 [Cloud] Dequeued cloud request. 2026-09-20T10:47:34.432 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T10:47:34.604 [Cloud] End of cloud request. 2026-09-20T10:47:35.119 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T10:51:06.308 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T10:51:06.308 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T10:51:06.308 [Cloud] Queued cloud request. 2026-09-20T10:51:06.308 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T10:51:06.308 [Cloud] Dequeued cloud request. 2026-09-20T10:51:06.308 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T10:51:06.495 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9C4BF902-16CD-09F0-5EE2-2D839BD51A41} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 10:51:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T10:51:06.995 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T10:52:55.308 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T10:52:55.308 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T10:52:55.308 [Cloud] Queued cloud request. 2026-09-20T10:52:55.308 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T10:52:55.308 [Cloud] Dequeued cloud request. 2026-09-20T10:52:55.308 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T10:52:55.479 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FD6CACC7-AFF8-F5FF-73C2-B56FC3B6961A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 10:52:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T10:52:55.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T11:02:16.766 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T11:02:51.876 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T11:02:51.876 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T11:02:51.876 [Cloud] Queued cloud request. 2026-09-20T11:02:51.876 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T11:02:51.876 [Cloud] Dequeued cloud request. 2026-09-20T11:02:51.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T11:02:52.031 [Cloud] End of cloud request. 2026-09-20T11:02:52.531 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T11:07:12.550 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T11:07:12.550 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T11:07:12.550 [Cloud] Queued cloud request. 2026-09-20T11:07:12.550 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T11:07:12.550 [Cloud] Dequeued cloud request. 2026-09-20T11:07:12.550 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{25380A75-C004-352E-8FB6-ED47594C88FF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 11:07:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T11:07:12.690 [Cloud] End of cloud request. 2026-09-20T11:07:13.190 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T11:17:14.774 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T11:17:14.774 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T11:17:14.774 [Cloud] Queued cloud request. 2026-09-20T11:17:14.774 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T11:17:14.774 [Cloud] Dequeued cloud request. 2026-09-20T11:17:14.774 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T11:17:14.977 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4D34C2D9-5753-DE80-E8B2-03991AE580EF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 11:17:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T11:17:15.493 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T11:17:21.774 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T11:21:31.401 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T11:21:31.401 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T11:21:31.401 [Cloud] Queued cloud request. 2026-09-20T11:21:31.401 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T11:21:31.401 [Cloud] Dequeued cloud request. 2026-09-20T11:21:31.401 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T11:21:31.572 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{549DFC4B-9A4B-C488-66A0-5302CAD73FE2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 11:21:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T11:21:32.088 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T11:32:26.780 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T11:39:38.332 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 33710, Count: 2507, MaxTime: 375, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-20T11:39:38.332 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 13100, Count: 1208, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-20T11:39:38.332 ProcessImageName: setup.exe, Pid: 7968, TotalTime: 12330, Count: 685, MaxTime: 4703, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\153.0.4234.48\msedge.dll, EstimatedImpact: 18% 2026-09-20T11:39:38.332 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 4669, Count: 436, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T11:39:38.332 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-20T11:39:38.332 ProcessImageName: AgentShellService.exe, Pid: 8084, TotalTime: 637, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 44% 2026-09-20T11:39:38.332 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 558, Count: 43, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-20T11:39:38.332 ProcessImageName: WmiPrvSE.exe, Pid: 2216, TotalTime: 538, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 10% 2026-09-20T11:39:38.332 ProcessImageName: WmiPrvSE.exe, Pid: 1496, TotalTime: 377, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-20T11:39:38.332 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T11:39:38.332 ProcessImageName: python.exe, Pid: 6660, TotalTime: 166, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-20T11:39:38.332 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 150, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-20T11:39:38.332 ProcessImageName: MicrosoftEdge_X64_153.0.4234.48_153.0.4234.32.exe, Pid: 1632, TotalTime: 140, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E0F0336-3EB4-4EDE-92D0-6B35E5AD8574}\EDGEMITMP_99607.tmp\setup.exe, EstimatedImpact: 56% 2026-09-20T11:39:38.332 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-20T11:39:38.332 ProcessImageName: taskhostw.exe, Pid: 6232, TotalTime: 61, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-20T11:39:38.332 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-20T11:39:38.332 ProcessImageName: taskhostw.exe, Pid: 5132, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-20T11:39:38.332 ProcessImageName: cmd.exe, Pid: 7824, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-20T11:39:38.332 ProcessImageName: DeviceCensus.exe, Pid: 7756, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-20T11:39:38.332 ProcessImageName: tzsync.exe, Pid: 7768, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezones.xml, EstimatedImpact: 3% 2026-09-20T11:39:38.332 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-20T11:39:38.332 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-20T11:39:38.332 ProcessImageName: mysqldump.exe, Pid: 1096, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-20T11:39:38.332 ProcessImageName: ngentask.exe, Pid: 4024, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 8% 2026-09-20T11:39:38.332 ProcessImageName: powershell.exe, Pid: 2500, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4DD5.tmp, EstimatedImpact: 0% 2026-09-20T11:39:38.332 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-20T11:47:31.790 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T11:50:29.759 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T11:50:29.759 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T11:50:29.759 [Cloud] Queued cloud request. 2026-09-20T11:50:29.759 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T11:50:29.759 [Cloud] Dequeued cloud request. 2026-09-20T11:50:29.759 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T11:50:29.915 [Cloud] End of cloud request. 2026-09-20T11:50:30.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T11:53:49.276 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T11:53:49.276 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T11:53:49.276 [Cloud] Queued cloud request. 2026-09-20T11:53:49.276 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T11:53:49.276 [Cloud] Dequeued cloud request. 2026-09-20T11:53:49.276 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T11:53:49.416 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A270E303-1953-9EB6-988F-2CCA565A5D63} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 11:53:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T11:53:49.932 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T11:54:33.496 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T11:54:33.496 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T11:54:33.496 [Cloud] Queued cloud request. 2026-09-20T11:54:33.496 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T11:54:33.496 [Cloud] Dequeued cloud request. 2026-09-20T11:54:33.496 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T11:54:33.574 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{32DB84F9-F308-4431-B183-B2FDC004C0B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 11:54:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T11:54:34.090 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T11:57:08.997 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T11:57:08.997 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T11:57:08.997 [Cloud] Queued cloud request. 2026-09-20T11:57:08.997 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T11:57:08.997 [Cloud] Dequeued cloud request. 2026-09-20T11:57:08.997 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T11:57:09.137 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D4388F3A-344B-3C24-A796-3EBC02680257} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 11:57:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T11:57:09.653 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:02:36.795 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T12:03:00.748 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:03:00.748 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:03:00.748 [Cloud] Queued cloud request. 2026-09-20T12:03:00.748 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:03:00.748 [Cloud] Dequeued cloud request. 2026-09-20T12:03:00.748 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:03:00.889 [Cloud] End of cloud request. 2026-09-20T12:03:01.405 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:05:05.939 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:05:05.939 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:05:05.939 [Cloud] Queued cloud request. 2026-09-20T12:05:05.939 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:05:05.939 [Cloud] Dequeued cloud request. 2026-09-20T12:05:05.939 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:05:06.080 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9C51AC8F-20F8-CA34-2543-AD7038CC8172} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 12:05:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T12:05:06.595 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:11:32.472 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:11:32.472 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:11:32.472 [Cloud] Queued cloud request. 2026-09-20T12:11:32.472 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:11:32.472 [Cloud] Dequeued cloud request. 2026-09-20T12:11:32.472 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:11:32.613 [Cloud] End of cloud request. 2026-09-20T12:11:33.113 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:12:31.128 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:12:31.128 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:12:31.128 [Cloud] Queued cloud request. 2026-09-20T12:12:31.128 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:12:31.128 [Cloud] Dequeued cloud request. 2026-09-20T12:12:31.128 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:12:31.207 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{406DC83C-E3FE-495C-A5A3-CB10999A1E74} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 12:12:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T12:12:31.722 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:14:34.037 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:14:34.037 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:14:34.037 [Cloud] Queued cloud request. 2026-09-20T12:14:34.037 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:14:34.037 [Cloud] Dequeued cloud request. 2026-09-20T12:14:34.037 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:14:34.194 [Cloud] End of cloud request. 2026-09-20T12:14:34.694 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:16:20.038 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:16:20.038 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:16:20.038 [Cloud] Queued cloud request. 2026-09-20T12:16:20.038 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:16:20.038 [Cloud] Dequeued cloud request. 2026-09-20T12:16:20.038 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:16:20.179 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5DC82215-69CC-B50C-F1E2-E2431572F6DC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 12:16:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T12:16:20.694 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:17:04.851 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:17:04.851 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:17:04.851 [Cloud] Queued cloud request. 2026-09-20T12:17:04.851 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:17:04.851 [Cloud] Dequeued cloud request. 2026-09-20T12:17:04.851 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:17:04.929 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2C89E438-8BD2-D665-1519-1D4E3292A1D7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 12:17:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T12:17:05.429 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:17:41.805 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T12:22:07.508 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:22:07.508 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:22:07.508 [Cloud] Queued cloud request. 2026-09-20T12:22:07.508 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:22:07.508 [Cloud] Dequeued cloud request. 2026-09-20T12:22:07.508 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:22:07.649 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F59FE57C-B40F-1035-548E-7D46709A15B6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 12:22:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T12:22:08.149 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:25:48.027 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:25:48.027 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:25:48.027 [Cloud] Queued cloud request. 2026-09-20T12:25:48.027 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:25:48.027 [Cloud] Dequeued cloud request. 2026-09-20T12:25:48.027 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:25:58.168 [Cloud] End of cloud request. 2026-09-20T12:25:58.668 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:29:36.154 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:29:36.154 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:29:36.154 [Cloud] Queued cloud request. 2026-09-20T12:29:36.154 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:29:36.154 [Cloud] Dequeued cloud request. 2026-09-20T12:29:36.154 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:29:36.326 [Cloud] End of cloud request. 2026-09-20T12:29:36.842 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:30:23.092 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:30:23.092 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:30:23.092 [Cloud] Queued cloud request. 2026-09-20T12:30:23.092 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:30:23.092 [Cloud] Dequeued cloud request. 2026-09-20T12:30:23.092 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:30:23.217 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D1EF197A-BFCF-7E4B-69EC-750FCA805C9A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 12:30:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T12:30:23.732 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:32:46.810 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T12:39:03.112 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:39:03.112 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:39:03.112 [Cloud] Queued cloud request. 2026-09-20T12:39:03.112 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:39:03.112 [Cloud] Dequeued cloud request. 2026-09-20T12:39:03.112 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:39:03.315 [Cloud] End of cloud request. 2026-09-20T12:39:03.831 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:47:51.820 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T12:52:13.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:52:13.445 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:52:13.445 [Cloud] Queued cloud request. 2026-09-20T12:52:13.445 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:52:13.445 [Cloud] Dequeued cloud request. 2026-09-20T12:52:13.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:52:13.586 [Cloud] End of cloud request. 2026-09-20T12:52:14.101 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:54:11.759 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:54:11.759 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:54:11.759 [Cloud] Queued cloud request. 2026-09-20T12:54:11.759 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:54:11.759 [Cloud] Dequeued cloud request. 2026-09-20T12:54:11.759 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:54:11.899 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B012CC28-8EE3-084D-6F59-59042283D059} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 12:54:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T12:54:12.399 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:54:29.134 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:54:29.134 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:54:29.134 [Cloud] Queued cloud request. 2026-09-20T12:54:29.134 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:54:29.134 [Cloud] Dequeued cloud request. 2026-09-20T12:54:29.134 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:54:29.212 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AEBDB14B-0CDD-B4B6-263E-C06845324069} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 12:54:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T12:54:29.728 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T12:55:53.587 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T12:55:53.587 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T12:55:53.587 [Cloud] Queued cloud request. 2026-09-20T12:55:53.587 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T12:55:53.587 [Cloud] Dequeued cloud request. 2026-09-20T12:55:53.587 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T12:55:53.728 [Cloud] End of cloud request. 2026-09-20T12:55:54.228 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T13:02:56.826 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T13:18:01.835 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{95378C8B-1F2E-C480-D904-EA738F1CC834} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-20-2026 13:23:13 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T13:23:14.163 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T13:23:14.163 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T13:23:14.163 [Cloud] Queued cloud request. 2026-09-20T13:23:14.163 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T13:23:14.163 [Cloud] Dequeued cloud request. 2026-09-20T13:23:14.163 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T13:23:14.179 [Cloud] SubmitReport(CMpBmSpyNetReportContext) 2026-09-20T13:23:14.179 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T13:23:14.179 [Cloud] Queued cloud request. 2026-09-20T13:23:14.179 [Cloud] Dequeued cloud request. 2026-09-20T13:23:14.194 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T13:23:14.351 [Cloud] End of cloud request. 2026-09-20T13:23:14.398 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-20T13:23:14.398 [Cloud] End of cloud request. 2026-09-20T13:23:14.851 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T13:25:47.477 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T13:25:47.477 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T13:25:47.477 [Cloud] Queued cloud request. 2026-09-20T13:25:47.477 [Cloud] Dequeued cloud request. 2026-09-20T13:25:47.477 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T13:25:47.477 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T13:25:47.680 [Cloud] End of cloud request. 2026-09-20T13:25:48.180 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T13:28:48.153 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T13:28:48.153 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T13:28:48.153 [Cloud] Queued cloud request. 2026-09-20T13:28:48.153 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T13:28:48.153 [Cloud] Dequeued cloud request. 2026-09-20T13:28:48.153 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T13:28:48.340 [Cloud] End of cloud request. 2026-09-20T13:28:48.856 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T13:33:06.841 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T13:35:16.123 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T13:35:16.123 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T13:35:16.123 [Cloud] Queued cloud request. 2026-09-20T13:35:16.123 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T13:35:16.123 [Cloud] Dequeued cloud request. 2026-09-20T13:35:16.123 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T13:35:16.326 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C5833ED3-F1E8-1AF4-460C-329964D18E9F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 13:35:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T13:35:16.842 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T13:39:38.392 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 280826, Count: 23041, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\_phpMyAdmin.new\js\vendor\codemirror\lib\codemirror.js, EstimatedImpact: 0% 2026-09-20T13:39:38.392 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 15162, Count: 1408, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-20T13:39:38.392 ProcessImageName: setup.exe, Pid: 7968, TotalTime: 12330, Count: 685, MaxTime: 4703, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\153.0.4234.48\msedge.dll, EstimatedImpact: 18% 2026-09-20T13:39:38.392 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 4669, Count: 436, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T13:39:38.392 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-20T13:39:38.392 ProcessImageName: AgentShellService.exe, Pid: 8084, TotalTime: 637, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 44% 2026-09-20T13:39:38.392 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 618, Count: 47, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-20T13:39:38.392 ProcessImageName: WmiPrvSE.exe, Pid: 2216, TotalTime: 538, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 10% 2026-09-20T13:39:38.392 ProcessImageName: WmiPrvSE.exe, Pid: 1496, TotalTime: 377, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-20T13:39:38.392 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T13:39:38.392 ProcessImageName: python.exe, Pid: 6660, TotalTime: 166, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-20T13:39:38.392 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 150, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-20T13:39:38.392 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 150, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-20T13:39:38.392 ProcessImageName: MicrosoftEdge_X64_153.0.4234.48_153.0.4234.32.exe, Pid: 1632, TotalTime: 140, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E0F0336-3EB4-4EDE-92D0-6B35E5AD8574}\EDGEMITMP_99607.tmp\setup.exe, EstimatedImpact: 56% 2026-09-20T13:39:38.392 ProcessImageName: taskhostw.exe, Pid: 6232, TotalTime: 61, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-20T13:39:38.392 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-20T13:39:38.392 ProcessImageName: taskhostw.exe, Pid: 5132, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-20T13:39:38.392 ProcessImageName: cmd.exe, Pid: 7824, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-20T13:39:38.392 ProcessImageName: DeviceCensus.exe, Pid: 7756, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-20T13:39:38.392 ProcessImageName: tzsync.exe, Pid: 7768, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezones.xml, EstimatedImpact: 3% 2026-09-20T13:39:38.392 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-20T13:39:38.392 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-20T13:39:38.392 ProcessImageName: mysqldump.exe, Pid: 1096, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-20T13:39:38.392 ProcessImageName: ngentask.exe, Pid: 4024, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 8% 2026-09-20T13:39:38.392 ProcessImageName: powershell.exe, Pid: 2500, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4DD5.tmp, EstimatedImpact: 0% 2026-09-20T13:39:38.392 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-20T13:42:31.142 Bm signature throttled:0x000135b39c9104ce 2026-09-20T13:46:00.676 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T13:46:00.676 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T13:46:00.676 [Cloud] Queued cloud request. 2026-09-20T13:46:00.676 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T13:46:00.894 [Cloud] Dequeued cloud request. 2026-09-20T13:46:00.894 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{AFA18C6D-10C7-ED51-456F-95A064C7BCE0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 13:46:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T13:46:01.066 [Cloud] End of cloud request. 2026-09-20T13:46:01.582 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e 2026-09-20T13:48:05.115 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7 2026-09-20T13:48:05.131 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T13:48:05.131 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T13:48:05.131 [Cloud] Queued cloud request. 2026-09-20T13:48:05.131 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T13:48:05.131 [Cloud] Dequeued cloud request. 2026-09-20T13:48:05.131 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T13:48:05.522 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-09-20T13:48:05.522 [Cloud] End of cloud request. 2026-09-20T13:48:06.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T13:48:11.850 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T13:52:57.553 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T13:52:57.553 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T13:52:57.553 [Cloud] Queued cloud request. 2026-09-20T13:52:57.553 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T13:52:57.553 [Cloud] Dequeued cloud request. 2026-09-20T13:52:57.553 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T13:52:57.694 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E49AE190-D3DF-F756-CE5B-716B457AB88F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 13:52:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T13:52:58.209 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T13:54:38.929 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T13:54:38.929 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T13:54:38.929 [Cloud] Queued cloud request. 2026-09-20T13:54:38.929 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T13:54:38.929 [Cloud] Dequeued cloud request. 2026-09-20T13:54:38.929 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T13:54:39.070 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A37F191D-C6A2-7C95-0EC9-BFB58450D390} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 13:54:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T13:54:39.586 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T14:03:16.855 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x56d96c17 2026-09-20T14:17:10.629 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpMyAdmin\tbl_changer.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x3329faf726b1 2026-09-20T14:18:21.865 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T14:19:53.068 Bm signature throttled:0x000135b39c9104ce 2026-09-20T14:24:46.883 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T14:24:46.883 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T14:24:46.883 [Cloud] Queued cloud request. 2026-09-20T14:24:46.883 [Cloud] Dequeued cloud request. 2026-09-20T14:24:46.883 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T14:24:46.883 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T14:24:47.102 [Cloud] End of cloud request. 2026-09-20T14:24:47.617 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T14:26:03.180 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b218-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #892364, FileId: 0x900000001fcdc, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T14:26:03.180 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b218-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #892365, FileId: 0x900000001fccc, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T14:26:45.180 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b26b-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #892954, FileId: 0xa00000001fccc, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T14:26:45.180 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b26b-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #892953, FileId: 0xa00000001fcdc, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T14:27:31.478 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T14:27:31.478 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T14:27:31.478 [Cloud] Queued cloud request. 2026-09-20T14:27:31.478 [Cloud] Dequeued cloud request. 2026-09-20T14:27:31.478 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T14:27:31.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{8EB4E6C9-1DDA-2B06-974C-13CE6CB3DC34} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 14:27:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T14:27:31.666 [Cloud] End of cloud request. 2026-09-20T14:27:32.181 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T14:29:15.323 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T14:29:15.323 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T14:29:15.323 [Cloud] Queued cloud request. 2026-09-20T14:29:15.323 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T14:29:15.323 [Cloud] Dequeued cloud request. 2026-09-20T14:29:15.323 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T14:29:15.511 [Cloud] End of cloud request. 2026-09-20T14:29:16.011 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T14:32:27.464 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T14:32:27.464 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T14:32:27.464 [Cloud] Queued cloud request. 2026-09-20T14:32:27.464 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T14:32:27.464 [Cloud] Dequeued cloud request. 2026-09-20T14:32:27.464 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T14:32:27.651 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BA4564CC-28CE-1CC6-9D6C-9240A36CBDA0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 14:32:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T14:32:28.167 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T14:33:26.870 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T14:39:56.968 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T14:39:56.968 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T14:39:56.968 [Cloud] Queued cloud request. 2026-09-20T14:39:56.968 [Cloud] Dequeued cloud request. 2026-09-20T14:39:56.968 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T14:39:56.968 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T14:39:57.140 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06FF52C3-154D-2C38-2297-3F996133B729} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 14:39:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T14:39:57.640 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T14:44:50.627 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T14:44:50.627 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T14:44:50.627 [Cloud] Queued cloud request. 2026-09-20T14:44:50.627 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T14:44:50.627 [Cloud] Dequeued cloud request. 2026-09-20T14:44:50.627 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T14:44:50.815 [Cloud] End of cloud request. 2026-09-20T14:44:51.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T14:48:31.879 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T14:54:13.256 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T14:54:13.256 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T14:54:13.256 [Cloud] Queued cloud request. 2026-09-20T14:54:13.256 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T14:54:13.256 [Cloud] Dequeued cloud request. 2026-09-20T14:54:13.256 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T14:54:13.459 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9194FDAB-F70F-341A-DC83-A2B589442A1B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 14:54:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T14:54:13.959 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T15:03:36.885 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T15:18:41.893 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T15:18:42.628 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T15:18:42.628 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T15:18:42.628 [Cloud] Queued cloud request. 2026-09-20T15:18:42.628 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T15:18:42.628 [Cloud] Dequeued cloud request. 2026-09-20T15:18:42.628 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T15:18:42.815 [Cloud] End of cloud request. 2026-09-20T15:18:43.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T15:18:48.862 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T15:18:48.862 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T15:18:48.862 [Cloud] Queued cloud request. 2026-09-20T15:18:48.862 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T15:18:49.050 [Cloud] Dequeued cloud request. 2026-09-20T15:18:49.284 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T15:18:49.347 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5073F802-E1E2-0CA2-C58D-D17EE2BAE277} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 15:18:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T15:18:49.847 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T15:20:06.847 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T15:20:06.847 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T15:20:06.847 [Cloud] Queued cloud request. 2026-09-20T15:20:06.847 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T15:20:06.847 [Cloud] Dequeued cloud request. 2026-09-20T15:20:06.847 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T15:20:07.034 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{86F7A837-DF19-F711-89AC-48C11E86B15B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 15:20:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T15:20:07.534 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T15:33:46.898 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T15:39:38.450 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 713605, Count: 62199, MaxTime: 1281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 1% 2026-09-20T15:39:38.450 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 17016, Count: 1607, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-20T15:39:38.450 ProcessImageName: setup.exe, Pid: 7968, TotalTime: 12330, Count: 685, MaxTime: 4703, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\153.0.4234.48\msedge.dll, EstimatedImpact: 18% 2026-09-20T15:39:38.450 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 4669, Count: 436, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T15:39:38.450 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-20T15:39:38.450 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 694, Count: 51, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-20T15:39:38.450 ProcessImageName: AgentShellService.exe, Pid: 8084, TotalTime: 637, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 44% 2026-09-20T15:39:38.450 ProcessImageName: WmiPrvSE.exe, Pid: 2216, TotalTime: 538, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 10% 2026-09-20T15:39:38.450 ProcessImageName: WmiPrvSE.exe, Pid: 1496, TotalTime: 377, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-20T15:39:38.450 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 195, Count: 78, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-20T15:39:38.450 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T15:39:38.450 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 180, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-20T15:39:38.450 ProcessImageName: python.exe, Pid: 6660, TotalTime: 166, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-20T15:39:38.450 ProcessImageName: MicrosoftEdge_X64_153.0.4234.48_153.0.4234.32.exe, Pid: 1632, TotalTime: 140, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E0F0336-3EB4-4EDE-92D0-6B35E5AD8574}\EDGEMITMP_99607.tmp\setup.exe, EstimatedImpact: 56% 2026-09-20T15:39:38.450 ProcessImageName: taskhostw.exe, Pid: 6232, TotalTime: 61, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-20T15:39:38.450 ProcessImageName: taskhostw.exe, Pid: 5132, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-20T15:39:38.450 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-20T15:39:38.450 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-20T15:39:38.450 ProcessImageName: cmd.exe, Pid: 7824, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-20T15:39:38.450 ProcessImageName: DeviceCensus.exe, Pid: 7756, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-20T15:39:38.450 ProcessImageName: tzsync.exe, Pid: 7768, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezones.xml, EstimatedImpact: 3% 2026-09-20T15:39:38.450 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-20T15:39:38.450 ProcessImageName: mysqldump.exe, Pid: 1096, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-20T15:39:38.450 ProcessImageName: ngentask.exe, Pid: 4024, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 8% 2026-09-20T15:39:38.450 ProcessImageName: powershell.exe, Pid: 2500, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4DD5.tmp, EstimatedImpact: 0% 2026-09-20T15:39:38.450 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-20T15:39:48.043 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T15:39:48.043 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T15:39:48.043 [Cloud] Queued cloud request. 2026-09-20T15:39:48.043 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T15:39:48.043 [Cloud] Dequeued cloud request. 2026-09-20T15:39:48.043 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T15:39:48.231 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2901C7F3-637B-A37B-30FB-90263E81564D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 15:39:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T15:39:48.747 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T15:44:54.420 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T15:44:54.420 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T15:44:54.420 [Cloud] Queued cloud request. 2026-09-20T15:44:54.420 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T15:44:54.623 [Cloud] Dequeued cloud request. 2026-09-20T15:44:54.779 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T15:44:54.951 [Cloud] End of cloud request. 2026-09-20T15:44:55.467 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T15:48:51.908 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T15:59:31.897 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T15:59:31.897 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T15:59:31.897 [Cloud] Queued cloud request. 2026-09-20T15:59:31.897 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T15:59:31.897 [Cloud] Dequeued cloud request. 2026-09-20T15:59:31.897 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T15:59:32.085 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FB9B8A07-2048-111A-B791-1985C02E79CF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 15:59:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T15:59:32.601 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T16:02:59.913 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b472-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #935365, FileId: 0xa000000020230, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T16:02:59.913 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b472-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #935364, FileId: 0xa000000020237, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T16:03:56.913 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T16:08:08.589 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T16:08:08.589 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T16:08:08.589 [Cloud] Queued cloud request. 2026-09-20T16:08:08.589 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T16:08:08.855 [Cloud] Dequeued cloud request. 2026-09-20T16:08:08.855 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T16:08:17.011 [Cloud] End of cloud request. 2026-09-20T16:08:17.511 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T16:12:29.136 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T16:12:29.136 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T16:12:29.136 [Cloud] Queued cloud request. 2026-09-20T16:12:29.136 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T16:12:29.136 [Cloud] Dequeued cloud request. 2026-09-20T16:12:29.136 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T16:12:39.230 [Cloud] End of cloud request. 2026-09-20T16:12:39.730 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T16:13:33.654 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T16:13:33.654 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T16:13:33.654 [Cloud] Queued cloud request. 2026-09-20T16:13:33.654 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T16:13:33.654 [Cloud] Dequeued cloud request. 2026-09-20T16:13:33.654 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T16:13:34.763 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FA6BABE6-6F7F-7DE3-BA4D-03E73B271789} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 16:13:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T16:13:35.263 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T16:18:08.625 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T16:18:08.625 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T16:18:08.625 [Cloud] Queued cloud request. 2026-09-20T16:18:08.625 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T16:18:08.625 [Cloud] Dequeued cloud request. 2026-09-20T16:18:08.625 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T16:18:08.766 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{837972D7-6E27-A36D-627E-C986EBC71E8A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 16:18:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T16:18:09.266 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T16:19:01.922 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T16:20:25.126 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T16:20:25.126 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T16:20:25.126 [Cloud] Queued cloud request. 2026-09-20T16:20:25.126 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T16:20:25.126 [Cloud] Dequeued cloud request. 2026-09-20T16:20:25.126 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T16:20:25.282 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D77000FD-E99C-8090-190B-1431D68179A7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 16:20:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T16:20:25.782 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T16:21:59.189 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T16:21:59.189 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T16:21:59.189 [Cloud] Queued cloud request. 2026-09-20T16:21:59.189 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T16:21:59.189 [Cloud] Dequeued cloud request. 2026-09-20T16:21:59.189 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T16:21:59.345 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{918B19C7-04B2-C648-2ABF-0EA42267EA29} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 16:21:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T16:21:59.845 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T16:23:56.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T16:23:56.657 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T16:23:56.657 [Cloud] Queued cloud request. 2026-09-20T16:23:56.657 [Cloud] Dequeued cloud request. 2026-09-20T16:23:56.657 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T16:23:56.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T16:23:56.798 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{93B4F981-2A7E-DBC9-3F58-EC2FB8A65815} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 16:23:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T16:23:57.314 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T16:34:06.927 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T16:42:49.853 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T16:42:49.853 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T16:42:49.853 [Cloud] Queued cloud request. 2026-09-20T16:42:49.853 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T16:42:49.853 [Cloud] Dequeued cloud request. 2026-09-20T16:42:49.853 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T16:42:50.041 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E33AE347-A00F-26C9-4474-D0F44AAD76C3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 16:42:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T16:42:50.541 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T16:45:38.528 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T16:45:38.528 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T16:45:38.528 [Cloud] Queued cloud request. 2026-09-20T16:45:38.528 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T16:45:38.528 [Cloud] Dequeued cloud request. 2026-09-20T16:45:38.528 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T16:45:38.700 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4CDCDEF0-DCC4-F1E9-2517-B9CA5872C65D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 16:45:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T16:45:39.200 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T16:49:11.936 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T16:50:36.187 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T16:50:36.187 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T16:50:36.187 [Cloud] Queued cloud request. 2026-09-20T16:50:36.187 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T16:50:36.187 [Cloud] Dequeued cloud request. 2026-09-20T16:50:36.187 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T16:50:36.374 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{17D44B4E-8EB3-AE93-94D9-1969A5B2EB3C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 16:50:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T16:50:36.874 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T16:54:52.687 Engine:Process 8108 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-20T16:54:52.687 Engine:Process 5552 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-20T16:54:52.687 Engine:Process 1628 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-20T16:54:52.687 Engine:Process 1628 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-20T16:54:52.687 Engine:Process 8108 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-20T16:54:52.687 Engine:Process 5552 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-20T16:54:52.702 Engine:Process 5552 will be fully monitored because of injection from C:\Program Files\Certbot\bin\certbot.exe 2026-09-20T16:54:52.702 Engine:Process 8108 will be fully monitored because of injection from C:\Program Files\Certbot\bin\certbot.exe 2026-09-20T16:54:52.702 Engine:Process 1628 will be fully monitored because of injection from C:\Program Files\Certbot\bin\certbot.exe 2026-09-20T16:54:52.702 Engine:Process 1628 will be fully monitored because of injection from C:\Program Files\Certbot\bin\certbot.exe 2026-09-20T16:54:52.702 Engine:Process 5552 will be fully monitored because of injection from C:\Program Files\Certbot\bin\certbot.exe 2026-09-20T16:54:52.702 Engine:Process 8108 will be fully monitored because of injection from C:\Program Files\Certbot\bin\certbot.exe 2026-09-20T16:54:52.702 Engine:Process 5552 will be fully monitored because of injection from C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2026-09-20T16:54:52.702 Engine:Process 1628 will be fully monitored because of injection from C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2026-09-20T16:54:52.702 Engine:Process 8108 will be fully monitored because of injection from C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2026-09-20T16:54:52.702 Engine:Process 5552 will be fully monitored because of injection from C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2026-09-20T16:54:52.702 Engine:Process 8108 will be fully monitored because of injection from C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2026-09-20T16:54:52.702 Engine:Process 1628 will be fully monitored because of injection from C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 2026-09-20T16:54:52.702 Engine:Process 5552 will be fully monitored because of injection from C:\Windows\System32\svchost.exe 2026-09-20T16:54:52.702 Engine:Process 5552 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-20T16:54:52.702 Engine:Process 5552 will be fully monitored because of injection from C:\Windows\System32\svchost.exe 2026-09-20T16:54:52.702 Engine:Process 1628 will be fully monitored because of injection from C:\Windows\System32\svchost.exe 2026-09-20T16:54:52.702 Engine:Process 5552 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-20T16:54:52.702 Engine:Process 1628 will be fully monitored because of injection from C:\Windows\System32\svchost.exe 2026-09-20T16:54:52.702 Engine:Process 1628 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-20T16:54:52.702 Engine:Process 1628 will be fully monitored because of injection from C:\Windows\System32\csrss.exe 2026-09-20T16:56:01.891 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T16:56:01.891 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T16:56:01.891 [Cloud] Queued cloud request. 2026-09-20T16:56:01.891 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T16:56:01.891 [Cloud] Dequeued cloud request. 2026-09-20T16:56:01.891 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T16:56:02.078 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F2B093CB-99F7-9955-8F75-6D37D85157D0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 16:56:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T16:56:02.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T17:04:16.943 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T17:06:20.740 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T17:06:20.740 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T17:06:20.740 [Cloud] Queued cloud request. 2026-09-20T17:06:20.740 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T17:06:20.740 [Cloud] Dequeued cloud request. 2026-09-20T17:06:20.740 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T17:06:20.928 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2AFB7C71-DE4B-CED3-A07F-2BC48E6C1CE0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 17:06:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T17:06:21.428 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T17:08:40.836 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T17:08:40.836 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T17:08:40.836 [Cloud] Queued cloud request. 2026-09-20T17:08:40.836 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T17:08:40.836 [Cloud] Dequeued cloud request. 2026-09-20T17:08:40.836 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T17:08:41.070 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F219D99-8709-B758-33AF-19D2504AEB15} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 17:08:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T17:08:41.586 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T17:18:40.027 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T17:18:40.027 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T17:18:40.027 [Cloud] Queued cloud request. 2026-09-20T17:18:40.027 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T17:18:40.027 [Cloud] Dequeued cloud request. 2026-09-20T17:18:40.027 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T17:18:40.215 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B71905F8-35DA-B916-A794-B609C142D1C0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 17:18:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T17:18:40.731 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T17:19:21.949 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T17:20:38.902 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T17:20:38.902 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T17:20:38.902 [Cloud] Queued cloud request. 2026-09-20T17:20:38.902 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T17:20:38.902 [Cloud] Dequeued cloud request. 2026-09-20T17:20:38.902 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T17:20:39.074 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4E4FFFED-A7FE-B5B8-650A-CC52C10C8BAB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 17:20:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T17:20:39.574 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T17:22:09.434 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T17:22:09.434 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T17:22:09.434 [Cloud] Queued cloud request. 2026-09-20T17:22:09.434 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T17:22:09.434 [Cloud] Dequeued cloud request. 2026-09-20T17:22:09.434 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T17:22:09.637 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CB00A369-AF7B-0CC2-35AA-542686005E4D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 17:22:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T17:22:10.152 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T17:22:51.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T17:22:51.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T17:22:51.387 [Cloud] Queued cloud request. 2026-09-20T17:22:51.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T17:22:51.387 [Cloud] Dequeued cloud request. 2026-09-20T17:22:51.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T17:22:51.731 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FB2C6637-6873-D604-4A8C-2D0E03F38EBE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 17:22:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T17:22:52.231 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T17:34:26.956 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T17:39:38.521 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 713605, Count: 62199, MaxTime: 1281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 1% 2026-09-20T17:39:38.521 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 19103, Count: 1807, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-20T17:39:38.521 ProcessImageName: setup.exe, Pid: 7968, TotalTime: 12330, Count: 685, MaxTime: 4703, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\153.0.4234.48\msedge.dll, EstimatedImpact: 18% 2026-09-20T17:39:38.521 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 4669, Count: 436, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T17:39:38.521 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-20T17:39:38.521 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 709, Count: 53, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-20T17:39:38.521 ProcessImageName: AgentShellService.exe, Pid: 8084, TotalTime: 637, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 44% 2026-09-20T17:39:38.521 ProcessImageName: WmiPrvSE.exe, Pid: 2216, TotalTime: 538, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 10% 2026-09-20T17:39:38.521 ProcessImageName: WmiPrvSE.exe, Pid: 1496, TotalTime: 377, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-20T17:39:38.521 ProcessImageName: powershell.exe, Pid: 7224, TotalTime: 246, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 22% 2026-09-20T17:39:38.521 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 210, Count: 80, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-20T17:39:38.521 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 19, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-20T17:39:38.521 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T17:39:38.521 ProcessImageName: python.exe, Pid: 6660, TotalTime: 166, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-20T17:39:38.521 ProcessImageName: MicrosoftEdge_X64_153.0.4234.48_153.0.4234.32.exe, Pid: 1632, TotalTime: 140, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E0F0336-3EB4-4EDE-92D0-6B35E5AD8574}\EDGEMITMP_99607.tmp\setup.exe, EstimatedImpact: 56% 2026-09-20T17:39:38.521 ProcessImageName: python.exe, Pid: 7948, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 5% 2026-09-20T17:39:38.521 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-20T17:39:38.521 ProcessImageName: taskhostw.exe, Pid: 6232, TotalTime: 61, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-20T17:39:38.521 ProcessImageName: taskhostw.exe, Pid: 5132, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-20T17:39:38.521 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-20T17:39:38.521 ProcessImageName: cmd.exe, Pid: 7824, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-20T17:39:38.521 ProcessImageName: DeviceCensus.exe, Pid: 7756, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-20T17:39:38.521 ProcessImageName: tzsync.exe, Pid: 7768, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezones.xml, EstimatedImpact: 3% 2026-09-20T17:39:38.521 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-20T17:39:38.521 ProcessImageName: mysqldump.exe, Pid: 1096, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-20T17:39:38.521 ProcessImageName: ngentask.exe, Pid: 4024, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 8% 2026-09-20T17:39:38.521 ProcessImageName: powershell.exe, Pid: 2500, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4DD5.tmp, EstimatedImpact: 0% 2026-09-20T17:39:38.521 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-20T17:48:00.760 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T17:48:00.760 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T17:48:00.760 [Cloud] Queued cloud request. 2026-09-20T17:48:00.760 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T17:48:00.760 [Cloud] Dequeued cloud request. 2026-09-20T17:48:00.760 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T17:48:00.916 [Cloud] End of cloud request. 2026-09-20T17:48:01.416 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T17:49:31.963 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T17:51:45.808 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T17:51:45.823 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T17:51:45.823 [Cloud] Queued cloud request. 2026-09-20T17:51:45.823 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T17:51:46.120 [Cloud] Dequeued cloud request. 2026-09-20T17:51:46.276 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T17:51:46.417 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0AB06B58-014B-78FA-DE00-939F4A02A686} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 17:51:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T17:51:46.933 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:04:36.968 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T18:06:45.471 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:06:45.471 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:06:45.471 [Cloud] Queued cloud request. 2026-09-20T18:06:45.471 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:06:45.471 [Cloud] Dequeued cloud request. 2026-09-20T18:06:45.471 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:06:45.643 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{929B1F9A-1C9E-53E5-7C05-35C8DC86F9A4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:06:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:06:46.158 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:07:49.222 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:07:49.222 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:07:49.222 [Cloud] Queued cloud request. 2026-09-20T18:07:49.222 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:07:49.222 [Cloud] Dequeued cloud request. 2026-09-20T18:07:49.222 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:07:49.362 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4C156C51-7AC2-43F6-4EA7-80B85022821E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:07:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:07:49.878 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:11:18.144 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:11:18.144 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:11:18.144 [Cloud] Queued cloud request. 2026-09-20T18:11:18.144 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:11:18.144 [Cloud] Dequeued cloud request. 2026-09-20T18:11:18.144 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:11:18.300 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{615FD8EB-7C3E-49EC-B11C-2B551046CC20} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:11:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:11:18.816 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:11:58.660 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:11:58.660 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:11:58.660 [Cloud] Queued cloud request. 2026-09-20T18:11:58.660 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:11:58.660 [Cloud] Dequeued cloud request. 2026-09-20T18:11:58.660 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:11:58.738 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8390FD5F-A115-18A2-F884-243E76137C30} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:11:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:11:59.254 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:12:07.269 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:12:07.269 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:12:07.269 [Cloud] Queued cloud request. 2026-09-20T18:12:07.269 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:12:07.269 [Cloud] Dequeued cloud request. 2026-09-20T18:12:07.269 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:12:07.347 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6108BE7F-A30C-A31C-1F25-2D4D69E32E70} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:12:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:12:07.863 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:14:21.629 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:14:21.629 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:14:21.629 [Cloud] Queued cloud request. 2026-09-20T18:14:21.629 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:14:21.629 [Cloud] Dequeued cloud request. 2026-09-20T18:14:21.629 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:14:21.800 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C2B31702-495B-9AE4-5EA1-0D9B770BCD93} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:14:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:14:22.300 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:19:41.977 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T18:20:07.946 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:20:07.946 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:20:07.946 [Cloud] Queued cloud request. 2026-09-20T18:20:07.946 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:20:07.946 [Cloud] Dequeued cloud request. 2026-09-20T18:20:07.946 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:20:08.133 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0CFB9E23-F45D-5BA7-A2B4-48C52A6300C0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:20:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:20:08.633 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:20:40.399 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:20:40.399 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:20:40.399 [Cloud] Queued cloud request. 2026-09-20T18:20:40.399 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:20:40.399 [Cloud] Dequeued cloud request. 2026-09-20T18:20:40.399 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:20:40.586 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5E5809B7-1D69-E98F-F41F-4A4549D865CC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:20:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:20:41.086 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:23:54.712 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:23:54.712 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:23:54.712 [Cloud] Queued cloud request. 2026-09-20T18:23:54.712 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:23:54.712 [Cloud] Dequeued cloud request. 2026-09-20T18:23:54.712 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:23:54.883 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BA6DD3A3-12EE-3F8F-2D7D-31522AA8CA20} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:23:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:23:55.383 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:24:10.680 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:24:10.680 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:24:10.680 [Cloud] Queued cloud request. 2026-09-20T18:24:10.680 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:24:10.680 [Cloud] Dequeued cloud request. 2026-09-20T18:24:10.680 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:24:10.758 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{01CEB272-5165-66E4-BB06-AEBCB47C889F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:24:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:24:11.258 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:24:32.602 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:24:32.602 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:24:32.602 [Cloud] Queued cloud request. 2026-09-20T18:24:32.602 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:24:32.602 [Cloud] Dequeued cloud request. 2026-09-20T18:24:32.602 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:24:32.696 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A8E8C8C9-1302-53AC-142B-149FEB8C0E6A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:24:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:24:33.196 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:25:01.415 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:25:01.415 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:25:01.415 [Cloud] Queued cloud request. 2026-09-20T18:25:01.415 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:25:01.415 [Cloud] Dequeued cloud request. 2026-09-20T18:25:01.415 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:25:01.493 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FF546796-EC65-A63A-2CB3-F8B71C496FF6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:25:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:25:02.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:34:26.405 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:34:26.405 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:34:26.405 [Cloud] Queued cloud request. 2026-09-20T18:34:26.405 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:34:26.405 [Cloud] Dequeued cloud request. 2026-09-20T18:34:26.405 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:34:26.546 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B26217E5-36F4-7949-40A1-F7A74401ED6C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:34:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:34:27.046 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:34:46.983 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T18:38:23.422 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:38:23.422 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:38:23.422 [Cloud] Queued cloud request. 2026-09-20T18:38:23.422 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:38:23.422 [Cloud] Dequeued cloud request. 2026-09-20T18:38:23.422 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:38:23.563 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{491995EF-CD2E-C08D-D067-0667A4065A58} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:38:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:38:24.063 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:40:01.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:40:01.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:40:01.297 [Cloud] Queued cloud request. 2026-09-20T18:40:01.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:40:01.297 [Cloud] Dequeued cloud request. 2026-09-20T18:40:01.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:40:01.454 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4BAB691F-F257-E8EA-3137-3232C74860E1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:40:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:40:01.954 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T18:49:51.990 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T18:57:55.853 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T18:57:55.853 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T18:57:55.853 [Cloud] Queued cloud request. 2026-09-20T18:57:55.853 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T18:57:55.853 [Cloud] Dequeued cloud request. 2026-09-20T18:57:55.853 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T18:57:56.040 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A02E5623-A62A-7A0B-F436-E53FF955E6E4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 18:57:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T18:57:56.556 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T19:02:53.620 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T19:02:53.620 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T19:02:53.620 [Cloud] Queued cloud request. 2026-09-20T19:02:53.620 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T19:02:53.667 [Cloud] Dequeued cloud request. 2026-09-20T19:02:53.667 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T19:03:03.808 [Cloud] End of cloud request. 2026-09-20T19:03:04.308 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T19:04:56.995 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T19:06:55.933 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T19:06:55.933 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T19:06:55.933 [Cloud] Queued cloud request. 2026-09-20T19:06:55.933 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T19:06:55.933 [Cloud] Dequeued cloud request. 2026-09-20T19:06:55.933 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T19:06:56.105 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A936FAE7-EC0E-023B-66AD-13DFA5D011AC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 19:06:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T19:06:56.605 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T19:20:02.002 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T19:21:25.002 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T19:21:25.002 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T19:21:25.002 [Cloud] Queued cloud request. 2026-09-20T19:21:25.002 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T19:21:25.002 [Cloud] Dequeued cloud request. 2026-09-20T19:21:25.002 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T19:21:25.174 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{33F14451-A792-FCEB-27E4-FA66B042A9AD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 19:21:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T19:21:25.690 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T19:23:17.895 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T19:23:17.895 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T19:23:17.895 [Cloud] Queued cloud request. 2026-09-20T19:23:17.895 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T19:23:17.895 [Cloud] Dequeued cloud request. 2026-09-20T19:23:17.895 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T19:23:18.035 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{28A0F36D-4680-0578-8196-12997DE020EE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 19:23:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T19:23:18.551 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T19:26:47.613 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T19:26:47.613 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T19:26:47.613 [Cloud] Queued cloud request. 2026-09-20T19:26:47.613 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T19:26:47.613 [Cloud] Dequeued cloud request. 2026-09-20T19:26:47.613 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T19:26:47.754 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{971C65C9-6D9C-A219-B087-DAE68CE83D22} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 19:26:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T19:26:48.254 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T19:27:51.912 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T19:27:51.912 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T19:27:51.912 [Cloud] Queued cloud request. 2026-09-20T19:27:51.912 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T19:27:51.912 [Cloud] Dequeued cloud request. 2026-09-20T19:27:51.912 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T19:27:52.053 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2BFCEFB9-6FED-DCD4-E2E2-2795376C10B9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 19:27:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T19:27:52.569 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T19:32:28.835 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T19:32:28.835 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T19:32:28.835 [Cloud] Queued cloud request. 2026-09-20T19:32:28.835 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T19:32:28.835 [Cloud] Dequeued cloud request. 2026-09-20T19:32:28.835 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T19:32:28.991 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5B794003-C1D3-0C69-BD28-E766142BCD4D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 19:32:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T19:32:29.491 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T19:35:07.009 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T19:39:12.011 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-20T19:39:12.042 Job Notification: New process added to job (1708) 2026-09-20T19:39:12.058 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-20T19:39:12.058 Aggressive catchup quick scan threshold: 660040852468 / 25920000000000 2026-09-20T19:39:12.058 Job Notification: New process added to job (5756) 2026-09-20T19:39:12.058 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:1708] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:5756]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-20T19:39:12.183 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-20T19:39:12.198 Job Notification: New process added to job (6448) 2026-09-20T19:39:12.223 Job Notification: New process added to job (2976) 2026-09-20T19:39:12.277 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:6448] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:2976]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-20T19:39:12.370 Job Notification: New process added to job (5808) 2026-09-20T19:39:12.402 Task(GetDeviceTicket -AccessKey 987B6558-8BB5-F415-D79D-9AD538FD7867 ) launched as network service 2026-09-20T19:39:12.573 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-20T19:39:12.573 [RTP] Duplicating the current plugin configuration object... 2026-09-20T19:39:12.573 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-20T19:39:12.573 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-20T19:39:12.573 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-20T19:39:12.573 [RTP] No config change detected. Not updating plugin configuration. 2026-09-20T19:39:12.573 [RTP] No config changes found. No configuration switch. 2026-09-20T19:39:12.573 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-20T19:39:13.027 Job Notification: Process exited from job (5808) 2026-09-20T19:39:13.183 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-20T19:39:13.183 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T19:39:13.183 [Cloud] Queued cloud request. 2026-09-20T19:39:13.183 [Cloud] Dequeued cloud request. 2026-09-20T19:39:13.183 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T19:39:13.308 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-20T19:39:13.308 [Cloud] End of cloud request. 2026-09-20T19:39:13.683 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T19:39:17.792 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T19:39:17.792 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T19:39:17.792 [Cloud] Queued cloud request. 2026-09-20T19:39:17.792 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T19:39:17.792 [Cloud] Dequeued cloud request. 2026-09-20T19:39:17.792 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T19:39:17.870 [Cloud] End of cloud request. 2026-09-20T19:39:18.386 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T19:39:27.105 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\E9A75389-6770-4FC1-8EAA-93F31E19B1AA1f44.1dd4937bdb7409c 2026-09-20T19:39:27.167 Verifying engine and signature files (source: 0) ... 2026-09-20T19:39:27.167 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8}\mpengine.dll] due to PPL. 2026-09-20T19:39:27.167 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8}\mpasbase.vdm]. File not in cache (0x1) 2026-09-20T19:39:28.089 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8}\mpasbase.vdm] 2026-09-20T19:39:28.089 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-20T19:39:28.105 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8}\mpasdlta.vdm] 2026-09-20T19:39:28.105 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8}\mpavbase.vdm]. File not in cache (0x1) 2026-09-20T19:39:28.527 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8}\mpavbase.vdm] 2026-09-20T19:39:28.527 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-20T19:39:28.542 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8}\mpavdlta.vdm] 2026-09-20T19:39:28.730 [Engine] IsHybridMode: 0 2026-09-20T19:39:28.730 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-20T19:39:28.745 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-7BF98FB3D72A82BB7703116D2343C6137A7D573F.bin): 0x00000002 2026-09-20T19:39:28.761 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-7BF98FB3D72A82BB7703116D2343C6137A7D573F.bin) 2026-09-20T19:39:28.761 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-20T19:39:28.761 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-20T19:39:28.761 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-20T19:39:28.761 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff 2026-09-20T19:39:38.589 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 713636, Count: 62200, MaxTime: 1281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 21304, Count: 2007, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: setup.exe, Pid: 7968, TotalTime: 12330, Count: 685, MaxTime: 4703, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\153.0.4234.48\msedge.dll, EstimatedImpact: 18% 2026-09-20T19:39:38.589 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 4669, Count: 436, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-20T19:39:38.589 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 801, Count: 59, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: AgentShellService.exe, Pid: 8084, TotalTime: 637, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 44% 2026-09-20T19:39:38.589 ProcessImageName: WmiPrvSE.exe, Pid: 2216, TotalTime: 538, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 10% 2026-09-20T19:39:38.589 ProcessImageName: WmiPrvSE.exe, Pid: 1496, TotalTime: 377, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-20T19:39:38.589 ProcessImageName: powershell.exe, Pid: 7224, TotalTime: 246, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 22% 2026-09-20T19:39:38.589 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 210, Count: 80, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 210, Count: 21, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T19:39:38.589 ProcessImageName: python.exe, Pid: 6660, TotalTime: 166, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-20T19:39:38.589 ProcessImageName: MicrosoftEdge_X64_153.0.4234.48_153.0.4234.32.exe, Pid: 1632, TotalTime: 140, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{5E0F0336-3EB4-4EDE-92D0-6B35E5AD8574}\EDGEMITMP_99607.tmp\setup.exe, EstimatedImpact: 56% 2026-09-20T19:39:38.589 ProcessImageName: python.exe, Pid: 7948, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 5% 2026-09-20T19:39:38.589 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 76, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: taskhostw.exe, Pid: 6232, TotalTime: 61, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-20T19:39:38.589 ProcessImageName: taskhostw.exe, Pid: 5132, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-20T19:39:38.589 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: cmd.exe, Pid: 7824, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: DeviceCensus.exe, Pid: 7756, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-20T19:39:38.589 ProcessImageName: tzsync.exe, Pid: 7768, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Globalization\Time Zone\timezones.xml, EstimatedImpact: 3% 2026-09-20T19:39:38.589 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: mysqldump.exe, Pid: 1096, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-20T19:39:38.589 ProcessImageName: ngentask.exe, Pid: 4024, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 8% 2026-09-20T19:39:38.589 ProcessImageName: powershell.exe, Pid: 2500, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4DD5.tmp, EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-20T19:39:38.589 ProcessImageName: svchost.exe, Pid: 2544, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0% IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-20T19:39:40.292 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-20T19:39:40.292 [AutoExclusion] Applied roles from cache. 2026-09-20T19:39:40.292 [AutoExclusion] Started roles monitoring. 2026-09-20T19:39:40.402 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF68AB020, lRefCount: 6, hr=0 2026-09-20T19:39:40.402 [Engine] New active engine 00007FFCF4ABB020 replacing engine 00007FFCF68AB020. Number of active engines: 2 2026-09-20T19:39:40.417 EngineInit:Global ASOC is enabled 2026-09-20T19:39:40.417 EngineInit:ASOO is enabled for developer volumes 2026-09-20T19:39:40.558 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-20T19:39:40.558 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.558 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-20T19:39:40.558 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-20T19:39:40.558 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-20T19:39:40.558 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.558 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.558 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.573 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-20T19:39:40.573 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.573 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-20T19:39:40.573 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.573 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.573 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.573 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.573 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.573 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.573 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.573 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-20T19:39:40.605 MpWriteUupSignatureVersion 1.459.308.0, hr = 0 2026-09-20T19:39:40.620 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-20T19:39:40.636 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-20T19:39:40.636 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-20T19:39:40.636 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-20T19:39:40.636 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-20T19:39:40.652 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-20T19:39:40.652 [Plugin] Initializing RTP plugin state... 2026-09-20T19:39:40.652 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-20T19:39:40.652 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎19‎-‎2026 21:39:38 Last Perf:‎09‎-‎19‎-‎2026 21:39:37 First RTP Scan:‎09‎-‎19‎-‎2026 21:39:38 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:15838 Misses:39505 BM Queue:0,144,0 Proc:0,34,0 File:0,144,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:1007050 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:211666676 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:35276 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:79088 TotalHits:487228 InstanceCacheInserts:13942 InstanceCacheUpdates:0 InstanceCacheDeletes:281 InstanceCacheHits:523 InstanceCacheMisses:62068 InstanceCacheOverflows:4946 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:5ms (9622/1672) Success: 1672, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-20T19:39:40.667 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8} 2026-09-20T19:39:40.667 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-20T19:39:40.667 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9FBB6A2D-9FCD-498C-B3F3-D9E6C60B07E0} removed 2026-09-20T19:39:40.667 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1}\mpasbase.vdm in use, hr=0x80070020 2026-09-20T19:39:40.667 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-20T19:39:40.667 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-20T19:39:40.667 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-20T19:39:40.667 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-20T19:39:40.667 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-20-2026 19:39:40 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-20-2026 19:39:40 2026-09-20T19:39:40.667 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-20T19:39:40.667 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-20T19:39:40.667 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-20T19:39:40.667 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-20T19:39:40.683 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T19:39:40.683 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-20T19:39:40.683 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-20T19:39:40.683 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-20T19:39:40.683 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-20T19:39:40.683 MdCoreSvc is supported in this platform and OS Signature updated on 09-20-2026 19:39:40 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.308.0 AV Signature Version: 1.459.308.0 ************************************************************ 2026-09-20T19:39:40.683 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-20T19:39:40.683 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\E9A75389-6770-4FC1-8EAA-93F31E19B1AA1f44.1dd4937bdb7409c 2026-09-20T19:39:40.714 Process scan (postsignatureupdatescan) started. 2026-09-20T19:39:40.745 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-20T19:39:40.745 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-20-2026 19:39:40 ************************************************************ 2026-09-20T19:39:41.023 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-20T19:39:41.023 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-20T19:39:41.023 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-20T19:39:41.023 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-20T19:39:41.023 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-20T19:39:41.042 [Engine] Engine 00007FFCF68AB020 no longer in use. Number of active engines: 1 2026-09-20T19:39:41.042 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-20T19:39:41.042 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-20T19:39:41.042 Job Notification: Process exited from job (6448) 2026-09-20T19:39:41.042 Job Notification: Process exited from job (2976) 2026-09-20T19:39:41.058 Job Notification: Process exited from job (1708) 2026-09-20T19:39:41.058 Job Notification: Process exited from job (5756) 2026-09-20T19:39:41.124 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-20T19:39:41.124 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-20T19:39:41.124 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-20T19:39:41.730 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 713636, Count: 62200, MaxTime: 1281, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 0% 2026-09-20T19:39:41.730 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 21304, Count: 2007, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-20T19:39:41.730 ProcessImageName: setup.exe, Pid: 7968, TotalTime: 12330, Count: 685, MaxTime: 4703, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\153.0.4234.48\msedge.dll, EstimatedImpact: 18% 2026-09-20T19:39:41.730 ProcessImageName: AgentShell.exe, Pid: 892, TotalTime: 4669, Count: 436, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T19:39:41.730 ProcessImageName: powershell.exe, Pid: 7452, TotalTime: 1652, Count: 105, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-20T19:39:41.730 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 801, Count: 59, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-20T19:39:41.730 ProcessImageName: AgentShellService.exe, Pid: 8084, TotalTime: 637, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 44% 2026-09-20T19:39:41.730 ProcessImageName: WmiPrvSE.exe, Pid: 2216, TotalTime: 538, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 10% 2026-09-20T19:39:41.730 ProcessImageName: WmiPrvSE.exe, Pid: 1496, TotalTime: 377, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-20T19:39:41.730 ProcessImageName: powershell.exe, Pid: 7224, TotalTime: 246, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 22% 2026-09-20T19:39:41.730 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 210, Count: 80, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1a0b7-0.MAI, EstimatedImpact: 0% 2026-09-20T19:39:41.730 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 210, Count: 21, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-20T19:39:41.730 ProcessImageName: WmiPrvSE.exe, Pid: 7476, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T19:39:41.730 ProcessImageName: python.exe, Pid: 6660, TotalTime: 166, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-20T19:39:41.792 [Engine] RSIG_UNLOADENGINE, 00007FFCF68AB020, err=0x0 2026-09-20T19:39:41.823 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D0749C83-077D-4F1C-B167-945489FDC2F1} removed 2026-09-20T19:39:55.683 Process scan (postsignatureupdatescan) completed. 2026-09-20T19:44:40.465 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-20T19:50:12.015 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T19:55:02.127 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T19:55:02.127 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T19:55:02.127 [Cloud] Queued cloud request. 2026-09-20T19:55:02.127 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T19:55:02.127 [Cloud] Dequeued cloud request. 2026-09-20T19:55:02.127 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T19:55:02.299 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0BF02204-ED95-DA47-83FB-4D40DFED00A9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 19:55:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T19:55:02.814 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e 2026-09-20T20:02:24.161 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7 2026-09-20T20:02:24.176 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T20:02:24.176 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T20:02:24.176 [Cloud] Queued cloud request. 2026-09-20T20:02:24.176 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T20:02:24.176 [Cloud] Dequeued cloud request. 2026-09-20T20:02:24.176 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T20:02:24.551 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-09-20T20:02:24.551 [Cloud] End of cloud request. 2026-09-20T20:02:25.161 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T20:02:32.739 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b804-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1015299, FileId: 0x5000000022427, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T20:02:32.739 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b804-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1015298, FileId: 0x5000000022428, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 BEGIN BM telemetry GUID:{66A07D15-1751-7AC6-CDB3-67C68E3D253F} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-20-2026 20:03:28 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T20:03:28.957 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T20:03:28.957 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T20:03:28.957 [Cloud] Queued cloud request. 2026-09-20T20:03:28.957 [Cloud] Dequeued cloud request. 2026-09-20T20:03:28.957 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T20:03:28.957 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T20:03:29.067 [Cloud] End of cloud request. 2026-09-20T20:03:29.567 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x56d96c17 2026-09-20T20:04:07.459 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T20:04:07.459 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T20:04:07.459 [Cloud] Queued cloud request. 2026-09-20T20:04:07.459 [Cloud] Dequeued cloud request. 2026-09-20T20:04:07.459 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T20:04:07.474 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T20:04:08.349 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpMyAdmin\tbl_changer.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x3329faf726b1 2026-09-20T20:04:08.584 [Cloud] End of cloud request. 2026-09-20T20:04:09.099 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T20:04:40.256 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1bd6a-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1020210, FileId: 0x6000000024582, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T20:04:40.256 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1bd6a-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1020211, FileId: 0x6000000024581, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-20T20:05:17.084 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T20:08:43.468 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T20:08:43.468 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T20:08:43.468 [Cloud] Queued cloud request. 2026-09-20T20:08:43.468 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T20:08:43.468 [Cloud] Dequeued cloud request. 2026-09-20T20:08:43.468 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T20:08:43.656 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{55773947-9A80-5707-6239-229F2A37044E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 20:08:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T20:08:44.156 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T20:10:40.979 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T20:10:40.979 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T20:10:40.979 [Cloud] Queued cloud request. 2026-09-20T20:10:40.979 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T20:10:40.979 [Cloud] Dequeued cloud request. 2026-09-20T20:10:40.979 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T20:10:41.150 [Cloud] End of cloud request. 2026-09-20T20:10:41.666 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T20:20:22.029 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T20:28:27.048 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T20:28:27.048 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T20:28:27.048 [Cloud] Queued cloud request. 2026-09-20T20:28:27.048 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T20:28:27.048 [Cloud] Dequeued cloud request. 2026-09-20T20:28:27.048 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T20:28:27.282 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C9E32EDA-BA61-0803-CB39-A781A9CFE7CA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 20:28:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T20:28:27.782 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T20:35:27.035 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T20:40:05.537 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T20:40:05.537 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T20:40:05.537 [Cloud] Queued cloud request. 2026-09-20T20:40:05.537 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T20:40:05.537 [Cloud] Dequeued cloud request. 2026-09-20T20:40:05.537 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{5D1F27CC-595C-973C-28D0-616CC596FE6B} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 20:40:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T20:40:15.662 [Cloud] End of cloud request. 2026-09-20T20:40:16.162 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T20:44:46.772 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T20:44:46.772 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T20:44:46.772 [Cloud] Queued cloud request. 2026-09-20T20:44:46.772 [Cloud] Dequeued cloud request. 2026-09-20T20:44:46.772 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T20:44:46.772 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T20:44:46.960 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0C05102C-C86F-90EC-00C1-9780AFD281E7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 20:44:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T20:44:47.475 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T20:50:15.839 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T20:50:15.839 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T20:50:15.839 [Cloud] Queued cloud request. 2026-09-20T20:50:15.839 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T20:50:15.839 [Cloud] Dequeued cloud request. 2026-09-20T20:50:15.839 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T20:50:16.026 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D475F116-95B1-CB51-5B0D-194C89E8D98B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 20:50:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T20:50:16.542 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T20:50:32.042 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T20:54:50.856 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T20:54:50.856 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T20:54:50.856 [Cloud] Queued cloud request. 2026-09-20T20:54:50.856 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T20:54:50.856 [Cloud] Dequeued cloud request. 2026-09-20T20:54:50.856 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T20:54:51.044 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A756CCBD-9C38-F090-D510-6CF9383AF7C5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 20:54:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T20:54:51.559 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:03:15.718 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:03:15.718 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:03:15.718 [Cloud] Queued cloud request. 2026-09-20T21:03:15.718 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:03:15.718 [Cloud] Dequeued cloud request. 2026-09-20T21:03:15.718 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:03:15.905 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5117AEB9-1B7F-CE45-E0F0-CFF73669C435} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 21:03:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T21:03:16.421 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:05:37.046 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T21:08:59.893 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:08:59.893 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:08:59.893 [Cloud] Queued cloud request. 2026-09-20T21:08:59.893 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:08:59.893 [Cloud] Dequeued cloud request. 2026-09-20T21:08:59.893 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:09:00.096 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AEF5B0CA-5F5E-A827-5535-4D64C7380FE5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 21:09:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T21:09:00.596 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:11:02.158 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:11:02.158 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:11:02.158 [Cloud] Queued cloud request. 2026-09-20T21:11:02.158 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:11:02.158 [Cloud] Dequeued cloud request. 2026-09-20T21:11:02.158 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:11:02.330 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B2A10044-8656-3FC2-AB94-E161031FF5CE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 21:11:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T21:11:02.846 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:12:59.736 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:12:59.736 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:12:59.736 [Cloud] Queued cloud request. 2026-09-20T21:12:59.736 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:12:59.736 [Cloud] Dequeued cloud request. 2026-09-20T21:12:59.736 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:12:59.908 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1A46CFC4-7EE3-192B-4727-B5D6EE1D3FDE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 21:12:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T21:13:00.408 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:20:42.055 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T21:20:57.336 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:20:57.336 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:20:57.336 [Cloud] Queued cloud request. 2026-09-20T21:20:57.336 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:20:57.336 [Cloud] Dequeued cloud request. 2026-09-20T21:20:57.336 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:20:57.493 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C1DF6974-5D85-8A11-5892-9EAFDAAE3854} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 21:20:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T21:20:58.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:21:00.555 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:21:00.555 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:21:00.555 [Cloud] Queued cloud request. 2026-09-20T21:21:00.555 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:21:00.555 [Cloud] Dequeued cloud request. 2026-09-20T21:21:00.555 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:21:00.649 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6912E8D6-A991-B918-CE74-E744D784038C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 21:21:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T21:21:01.149 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:28:16.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:28:16.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:28:16.387 [Cloud] Queued cloud request. 2026-09-20T21:28:16.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:28:16.574 [Cloud] Dequeued cloud request. 2026-09-20T21:28:16.574 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:28:16.699 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{15F523D8-F4C2-378A-6FC9-1B9EEAD5673A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 21:28:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T21:28:17.199 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:35:47.061 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T21:38:18.813 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:38:18.813 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:38:18.813 [Cloud] Queued cloud request. 2026-09-20T21:38:18.813 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:38:18.813 [Cloud] Dequeued cloud request. 2026-09-20T21:38:18.813 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:38:19.047 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C916A081-D331-13C2-ED42-D4B3238D6656} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 21:38:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T21:38:19.563 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:39:40.454 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 391005, Count: 35674, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 11% 2026-09-20T21:39:40.454 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 1947, Count: 200, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T21:39:40.454 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-20T21:39:40.454 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-20T21:39:40.454 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T21:39:40.454 ProcessImageName: taskhostw.exe, Pid: 7680, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-20T21:39:40.454 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-20T21:39:40.454 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-20T21:39:40.454 ProcessImageName: taskhostw.exe, Pid: 3032, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-20T21:39:40.454 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-20T21:45:54.972 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:45:54.972 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:45:54.972 [Cloud] Queued cloud request. 2026-09-20T21:45:54.972 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:45:54.972 [Cloud] Dequeued cloud request. 2026-09-20T21:45:54.972 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:45:55.113 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CB1658AD-C068-EB84-589F-94BF718A1934} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 21:45:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T21:45:55.628 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:46:56.050 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:46:56.050 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:46:56.050 [Cloud] Queued cloud request. 2026-09-20T21:46:56.050 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:46:56.050 [Cloud] Dequeued cloud request. 2026-09-20T21:46:56.050 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:46:56.191 [Cloud] End of cloud request. 2026-09-20T21:46:56.707 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:47:16.457 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:47:16.457 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:47:16.457 [Cloud] Queued cloud request. 2026-09-20T21:47:16.457 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:47:16.457 [Cloud] Dequeued cloud request. 2026-09-20T21:47:16.457 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:47:16.535 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A5B9D9FA-8FF1-6E89-FA71-8EC90FE0820A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 21:47:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T21:47:17.035 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:50:52.068 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T21:51:10.818 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:51:10.818 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:51:10.818 [Cloud] Queued cloud request. 2026-09-20T21:51:10.818 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:51:10.818 [Cloud] Dequeued cloud request. 2026-09-20T21:51:10.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:51:11.006 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A6AA1F41-7640-144F-6937-FB5E090359FB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 21:51:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T21:51:11.521 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T21:52:08.428 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T21:52:08.428 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T21:52:08.428 [Cloud] Queued cloud request. 2026-09-20T21:52:08.428 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T21:52:08.428 [Cloud] Dequeued cloud request. 2026-09-20T21:52:08.428 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T21:52:08.506 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D7A0280F-D415-DA42-48BF-B2166414E8EE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 21:52:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T21:52:09.021 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T22:01:16.400 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T22:01:16.400 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T22:01:16.400 [Cloud] Queued cloud request. 2026-09-20T22:01:16.400 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T22:01:16.400 [Cloud] Dequeued cloud request. 2026-09-20T22:01:16.400 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T22:01:16.837 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{70E04E8A-B863-AA1A-1B8F-EED7817E9CE4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 22:01:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T22:01:17.337 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T22:03:42.697 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T22:03:42.697 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T22:03:42.697 [Cloud] Queued cloud request. 2026-09-20T22:03:42.697 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T22:03:42.697 [Cloud] Dequeued cloud request. 2026-09-20T22:03:42.697 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T22:03:42.853 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6C3B2D7A-0FE1-9565-4556-B88084A5F862} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 22:03:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T22:03:43.353 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T22:05:57.074 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T22:10:11.185 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T22:10:11.185 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T22:10:11.185 [Cloud] Queued cloud request. 2026-09-20T22:10:11.185 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T22:10:11.185 [Cloud] Dequeued cloud request. 2026-09-20T22:10:11.185 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T22:10:11.326 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8A6467B-EB22-77FF-BEBD-7BD7F80C36BA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 22:10:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T22:10:11.842 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T22:21:02.081 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T22:23:36.909 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T22:23:36.909 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T22:23:36.909 [Cloud] Queued cloud request. 2026-09-20T22:23:36.909 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T22:23:36.909 [Cloud] Dequeued cloud request. 2026-09-20T22:23:36.909 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T22:23:37.066 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{19EBB509-C6E4-843B-3639-0BA0A34A1B60} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 22:23:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T22:23:37.566 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T22:36:07.087 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T22:40:24.448 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T22:40:24.448 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T22:40:24.448 [Cloud] Queued cloud request. 2026-09-20T22:40:24.448 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T22:40:24.448 [Cloud] Dequeued cloud request. 2026-09-20T22:40:24.448 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T22:40:24.651 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{21DD37F0-2ED5-AF40-3410-D407E42D87DC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 22:40:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T22:40:25.151 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T22:43:36.247 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T22:43:36.247 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T22:43:36.247 [Cloud] Queued cloud request. 2026-09-20T22:43:36.247 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T22:43:36.247 [Cloud] Dequeued cloud request. 2026-09-20T22:43:36.247 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T22:43:36.419 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7FB00680-C872-F936-5A94-25FC3D613F83} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 22:43:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T22:43:36.919 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T22:51:12.094 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T23:06:17.101 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T23:16:12.448 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:16:12.448 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:16:12.448 [Cloud] Queued cloud request. 2026-09-20T23:16:12.448 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:16:12.448 [Cloud] Dequeued cloud request. 2026-09-20T23:16:12.448 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:16:12.651 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{92967FCC-1EEE-209B-9070-FCCB42B5815B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 23:16:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T23:16:13.151 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:21:22.107 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T23:21:49.248 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:21:49.248 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:21:49.248 [Cloud] Queued cloud request. 2026-09-20T23:21:49.248 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:21:49.248 [Cloud] Dequeued cloud request. 2026-09-20T23:21:49.248 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:21:49.466 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A86E15BB-155E-1D5A-4431-84A5A13B2FC9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 23:21:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T23:21:49.966 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:24:17.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:24:17.904 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:24:17.904 [Cloud] Queued cloud request. 2026-09-20T23:24:17.904 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:24:17.904 [Cloud] Dequeued cloud request. 2026-09-20T23:24:17.904 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:24:18.076 [Cloud] End of cloud request. 2026-09-20T23:24:18.576 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:25:13.279 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:25:13.279 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:25:13.279 [Cloud] Queued cloud request. 2026-09-20T23:25:13.279 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:25:13.279 [Cloud] Dequeued cloud request. 2026-09-20T23:25:13.279 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:25:13.373 [Cloud] End of cloud request. 2026-09-20T23:25:13.888 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:27:18.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:27:18.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:27:18.297 [Cloud] Queued cloud request. 2026-09-20T23:27:18.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:27:18.297 [Cloud] Dequeued cloud request. 2026-09-20T23:27:18.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:27:18.453 [Cloud] End of cloud request. 2026-09-20T23:27:18.953 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:27:33.422 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:27:33.422 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:27:33.422 [Cloud] Queued cloud request. 2026-09-20T23:27:33.422 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:27:33.422 [Cloud] Dequeued cloud request. 2026-09-20T23:27:33.422 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:27:33.500 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6FFD018C-CE56-44B2-0710-FF345EC9FF96} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 23:27:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T23:27:34.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:28:12.048 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:28:12.048 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:28:12.048 [Cloud] Queued cloud request. 2026-09-20T23:28:12.048 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:28:12.048 [Cloud] Dequeued cloud request. 2026-09-20T23:28:12.048 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:28:12.126 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5F0DB15B-21BA-A49A-8348-4A9F5A705059} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 23:28:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T23:28:12.641 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:28:14.345 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:28:14.345 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:28:14.345 [Cloud] Queued cloud request. 2026-09-20T23:28:14.345 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:28:14.345 [Cloud] Dequeued cloud request. 2026-09-20T23:28:14.345 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:28:14.454 [Cloud] End of cloud request. 2026-09-20T23:28:14.954 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:36:27.114 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T23:37:23.692 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:37:23.692 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:37:23.692 [Cloud] Queued cloud request. 2026-09-20T23:37:23.692 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:37:23.880 [Cloud] Dequeued cloud request. 2026-09-20T23:37:23.880 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:37:24.067 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9E53E924-4141-5473-1E6F-3667D0EE2D89} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 23:37:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T23:37:24.583 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:39:40.521 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 391782, Count: 35712, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 2% 2026-09-20T23:39:40.521 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 3956, Count: 400, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-20T23:39:40.521 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-20T23:39:40.521 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-20T23:39:40.521 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-20T23:39:40.521 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-20T23:39:40.521 ProcessImageName: taskhostw.exe, Pid: 7680, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-20T23:39:40.521 ProcessImageName: taskhostw.exe, Pid: 5900, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 6% 2026-09-20T23:39:40.521 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-20T23:39:40.521 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-20T23:39:40.521 ProcessImageName: taskhostw.exe, Pid: 3032, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-20T23:39:40.521 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-20T23:40:34.302 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:40:34.302 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:40:34.302 [Cloud] Queued cloud request. 2026-09-20T23:40:34.302 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:40:34.302 [Cloud] Dequeued cloud request. 2026-09-20T23:40:34.302 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:40:34.943 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EC028E5B-EE5E-E3A5-86C9-7F544FB83F0C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 23:40:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T23:40:35.443 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:42:19.036 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:42:19.036 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:42:19.036 [Cloud] Queued cloud request. 2026-09-20T23:42:19.036 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:42:19.036 [Cloud] Dequeued cloud request. 2026-09-20T23:42:19.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:42:19.161 [Cloud] End of cloud request. 2026-09-20T23:42:19.661 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:43:15.521 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:43:15.521 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:43:15.521 [Cloud] Queued cloud request. 2026-09-20T23:43:15.521 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:43:15.521 [Cloud] Dequeued cloud request. 2026-09-20T23:43:15.521 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:43:15.599 [Cloud] End of cloud request. 2026-09-20T23:43:16.114 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:51:32.120 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-20T23:53:14.370 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:53:14.370 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:53:14.370 [Cloud] Queued cloud request. 2026-09-20T23:53:14.370 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:53:14.370 [Cloud] Dequeued cloud request. 2026-09-20T23:53:14.370 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:53:14.557 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{13F801D4-3F52-F176-3130-201A42494151} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 23:53:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T23:53:15.073 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-20T23:53:16.651 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-20T23:53:16.651 [Cloud] Start of cloud request. Passive mode: 0 2026-09-20T23:53:16.651 [Cloud] Queued cloud request. 2026-09-20T23:53:16.651 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-20T23:53:16.651 [Cloud] Dequeued cloud request. 2026-09-20T23:53:16.651 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-20T23:53:16.729 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0F2350A2-F50A-A68D-D66D-4CD40E5D45FB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-20-2026 23:53:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-20T23:53:17.245 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:06:37.125 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T00:08:51.284 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:08:51.284 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:08:51.284 [Cloud] Queued cloud request. 2026-09-21T00:08:51.284 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:08:51.455 [Cloud] Dequeued cloud request. 2026-09-21T00:08:51.455 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:08:51.596 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{82CF3060-A87C-AE28-4929-894F2B9CA859} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 00:08:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T00:08:52.112 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:12:29.238 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:12:29.238 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:12:29.238 [Cloud] Queued cloud request. 2026-09-21T00:12:29.238 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:12:29.238 [Cloud] Dequeued cloud request. 2026-09-21T00:12:29.238 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:12:29.379 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{69FD886A-5B66-674A-511A-2FA156895B12} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 00:12:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T00:12:29.879 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:12:57.254 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:12:57.254 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:12:57.254 [Cloud] Queued cloud request. 2026-09-21T00:12:57.254 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:12:57.254 [Cloud] Dequeued cloud request. 2026-09-21T00:12:57.254 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:13:07.270 [Cloud] End of cloud request. 2026-09-21T00:13:07.785 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:14:08.364 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:14:08.364 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:14:08.364 [Cloud] Queued cloud request. 2026-09-21T00:14:08.364 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:14:08.364 [Cloud] Dequeued cloud request. 2026-09-21T00:14:08.364 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:14:08.505 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ADB3A7E8-0173-9868-87B6-74037B6FAA5E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 00:14:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T00:14:09.020 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:16:05.708 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:16:05.708 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:16:05.708 [Cloud] Queued cloud request. 2026-09-21T00:16:05.708 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:16:05.708 [Cloud] Dequeued cloud request. 2026-09-21T00:16:05.708 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:16:05.849 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A5F3CFC7-3F5D-EFA4-424F-7691934D132F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 00:16:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T00:16:06.364 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:21:42.132 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T00:21:51.554 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:21:51.554 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:21:51.554 [Cloud] Queued cloud request. 2026-09-21T00:21:51.554 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:21:51.725 [Cloud] Dequeued cloud request. 2026-09-21T00:21:51.725 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:21:51.866 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6D08F06E-2D09-C05C-D0A8-85E26345EEDC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 00:21:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T00:21:52.366 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:23:52.617 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:23:52.617 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:23:52.617 [Cloud] Queued cloud request. 2026-09-21T00:23:52.617 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:23:52.617 [Cloud] Dequeued cloud request. 2026-09-21T00:23:52.617 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:23:52.757 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{30A04987-1B43-98F8-B3DC-66920AF8B2DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 00:23:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T00:23:53.257 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:29:24.777 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:29:24.777 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:29:24.777 [Cloud] Queued cloud request. 2026-09-21T00:29:24.777 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:29:24.777 [Cloud] Dequeued cloud request. 2026-09-21T00:29:24.777 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:29:24.917 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A20B401D-BDDE-0B2A-9971-7AB3530AA98C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 00:29:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T00:29:25.433 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:30:13.417 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:30:13.417 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:30:13.417 [Cloud] Queued cloud request. 2026-09-21T00:30:13.417 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:30:13.417 [Cloud] Dequeued cloud request. 2026-09-21T00:30:13.417 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:30:13.496 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F5E8EA56-962F-94C7-B949-B57DFEB2D69E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 00:30:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T00:30:13.996 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:36:47.139 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T00:42:19.438 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:42:19.438 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:42:19.438 [Cloud] Queued cloud request. 2026-09-21T00:42:19.438 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:42:19.438 [Cloud] Dequeued cloud request. 2026-09-21T00:42:19.438 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:42:19.625 [Cloud] End of cloud request. 2026-09-21T00:42:20.125 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:45:33.766 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:45:33.766 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:45:33.766 [Cloud] Queued cloud request. 2026-09-21T00:45:33.766 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:45:33.766 [Cloud] Dequeued cloud request. 2026-09-21T00:45:33.766 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:45:34.000 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F10C6C52-02BF-AF09-2461-B25CF526DB2A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 00:45:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T00:45:34.516 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:49:11.113 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:49:11.113 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:49:11.113 [Cloud] Queued cloud request. 2026-09-21T00:49:11.113 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:49:11.113 [Cloud] Dequeued cloud request. 2026-09-21T00:49:11.113 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:49:11.285 [Cloud] End of cloud request. 2026-09-21T00:49:11.785 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:51:52.145 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T00:52:11.661 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:52:11.661 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:52:11.661 [Cloud] Queued cloud request. 2026-09-21T00:52:11.661 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:52:11.661 [Cloud] Dequeued cloud request. 2026-09-21T00:52:11.661 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:52:11.849 [Cloud] End of cloud request. 2026-09-21T00:52:12.349 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T00:59:52.789 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T00:59:52.789 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T00:59:52.789 [Cloud] Queued cloud request. 2026-09-21T00:59:52.789 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T00:59:52.789 [Cloud] Dequeued cloud request. 2026-09-21T00:59:52.946 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T00:59:53.086 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9AE476C8-5E98-9FDF-8F0D-CAE5FEDDE4CC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 00:59:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T00:59:53.602 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:00:01.336 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138325, FileId: 0xd00000002dd99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.336 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138326, FileId: 0x1900000002dc66, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.352 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138334, FileId: 0x1b00000002dc66, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.352 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138335, FileId: 0xf00000002dd99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.367 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138341, FileId: 0x1d00000002dc66, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.367 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138340, FileId: 0x1100000002dd99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.383 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138346, FileId: 0x1300000002dd99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.383 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138347, FileId: 0x1f00000002dc66, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.399 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138353, FileId: 0x2100000002dc66, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.399 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138352, FileId: 0x1500000002dd99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.414 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138359, FileId: 0x2300000002dc66, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.414 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138358, FileId: 0x1700000002dd99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.430 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138364, FileId: 0x1900000002dd99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.430 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138365, FileId: 0x2500000002dc66, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.430 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138370, FileId: 0x1b00000002dd99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.430 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138371, FileId: 0x2700000002dc66, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.446 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138377, FileId: 0x2900000002dc66, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.446 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138376, FileId: 0x1d00000002dd99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.461 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138382, FileId: 0x1f00000002dd99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.461 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138383, FileId: 0x2b00000002dc66, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.477 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138389, FileId: 0x2d00000002dc66, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.477 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138388, FileId: 0x2100000002dd99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.477 [RTP] [Mini-filter] Unsuccessful scan status(#28): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138395, FileId: 0x2f00000002dc66, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:00:01.477 [RTP] [Mini-filter] Unsuccessful scan status(#27): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1c1ae-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1138394, FileId: 0x2300000002dd99, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-21T01:01:32.727 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:01:32.727 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:01:32.727 [Cloud] Queued cloud request. 2026-09-21T01:01:32.727 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:01:32.727 [Cloud] Dequeued cloud request. 2026-09-21T01:01:32.727 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:01:32.899 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{82B60904-8B87-F08D-6171-D8BCD0F74E25} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:01:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:01:33.414 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:03:54.463 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:03:54.463 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:03:54.463 [Cloud] Queued cloud request. 2026-09-21T01:03:54.463 [Cloud] Dequeued cloud request. 2026-09-21T01:03:54.463 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:03:54.463 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:04:03.917 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:04:03.917 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:04:03.917 [Cloud] Queued cloud request. 2026-09-21T01:04:03.917 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:04:03.917 [Cloud] Dequeued cloud request. 2026-09-21T01:04:04.073 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:04:04.213 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3AFAAE71-C663-A35A-623B-9D4902DB48F6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:04:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:04:04.557 [Cloud] End of cloud request. 2026-09-21T01:04:04.729 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:04:43.276 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:04:43.276 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:04:43.276 [Cloud] Queued cloud request. 2026-09-21T01:04:43.276 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:04:43.276 [Cloud] Dequeued cloud request. 2026-09-21T01:04:43.276 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:04:43.354 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6AEEE2E0-4B8A-07CF-56EE-03CE4C12F11E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:04:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:04:43.854 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:06:57.151 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T01:06:58.511 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:06:58.511 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:06:58.511 [Cloud] Queued cloud request. 2026-09-21T01:06:58.511 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:06:58.511 [Cloud] Dequeued cloud request. 2026-09-21T01:06:58.511 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:06:58.917 [Cloud] End of cloud request. 2026-09-21T01:06:59.417 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:08:55.512 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:08:55.512 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:08:55.512 [Cloud] Queued cloud request. 2026-09-21T01:08:55.512 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:08:55.512 [Cloud] Dequeued cloud request. 2026-09-21T01:08:55.512 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:08:55.653 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3A9ABCA2-90B1-5154-69A1-D483B9730E57} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:08:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:08:56.153 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:12:55.873 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:12:55.873 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:12:55.873 [Cloud] Queued cloud request. 2026-09-21T01:12:55.873 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:12:55.873 [Cloud] Dequeued cloud request. 2026-09-21T01:12:55.873 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:12:56.030 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6125B0B3-38B6-3528-B366-0AE6EA8EBA48} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:12:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:12:56.530 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:14:39.077 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:14:39.077 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:14:39.077 [Cloud] Queued cloud request. 2026-09-21T01:14:39.077 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:14:39.077 [Cloud] Dequeued cloud request. 2026-09-21T01:14:39.077 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:14:39.217 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{90C609F9-5BE8-C4F5-33E2-D380302AE5E0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:14:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:14:39.717 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:14:44.795 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:14:44.795 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:14:44.795 [Cloud] Queued cloud request. 2026-09-21T01:14:44.795 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:14:44.795 [Cloud] Dequeued cloud request. 2026-09-21T01:14:44.795 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:14:44.873 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1C1CBB81-EA5C-4B6F-5F7D-71957E919296} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:14:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:14:45.389 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:17:57.673 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:17:57.673 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:17:57.673 [Cloud] Queued cloud request. 2026-09-21T01:17:57.673 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:17:57.673 [Cloud] Dequeued cloud request. 2026-09-21T01:17:57.673 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:17:57.860 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7C1A3041-D109-4B85-F089-4F17EDE2AD6F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:17:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:17:58.360 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:19:08.017 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:759FB601-A3F3-4AFE-B012-389FB48EC85C, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-21T01:19:08.017 Scheduled scan with Id 759FB601-A3F3-4AFE-B012-389FB48EC85C configured CPU priority: normal (LowCpuPriority: 0) 2026-09-21T01:19:08.017 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-21T01:19:08.017 [SFC] System file cache build is not needed (already completed) 2026-09-21T01:19:20.017 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:19:20.017 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:19:20.017 [Cloud] Queued cloud request. 2026-09-21T01:19:20.017 [Cloud] Dequeued cloud request. 2026-09-21T01:19:20.017 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:19:20.017 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:19:20.157 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8F648233-0ABA-7F23-A978-9EFBB8B155F7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:19:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:19:20.657 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:19:30.798 Engine:Triggered AR EMS scan 2026-09-21T01:19:30.798 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.830 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.830 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.845 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.845 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.861 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.876 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.876 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.892 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.892 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.892 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.892 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.908 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.908 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.908 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.923 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.923 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.939 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.939 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.939 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.955 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.955 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.955 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.955 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.955 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.970 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.986 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:30.986 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.001 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.001 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.001 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.001 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.017 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.017 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.033 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.033 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.048 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.048 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.048 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.064 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.064 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.064 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.080 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.080 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.095 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.095 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.095 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.111 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.111 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.126 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.126 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.142 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.142 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.158 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.158 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.158 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.173 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.173 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.189 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.205 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:19:31.205 Engine:EMS scan for process: svchost pid: 6484, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-21T01:20:09.471 QuickScan:ScanID:759FB601-A3F3-4AFE-B012-389FB48EC85C: Quick scan finished with error 0 2026-09-21T01:20:09.986 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-21T01:20:09.986 [RTP] Duplicating the current plugin configuration object... 2026-09-21T01:20:09.986 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-21T01:20:09.986 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-21T01:20:09.986 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-21T01:20:09.986 [RTP] No config change detected. Not updating plugin configuration. 2026-09-21T01:20:09.986 [RTP] No config changes found. No configuration switch. 2026-09-21T01:20:09.986 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-21T01:22:02.158 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T01:28:27.833 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:28:27.833 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:28:27.833 [Cloud] Queued cloud request. 2026-09-21T01:28:27.833 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:28:27.833 [Cloud] Dequeued cloud request. 2026-09-21T01:28:27.833 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:28:28.021 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C58D31E8-2996-DDA0-BF19-551A27C6D3D0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:28:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:28:28.521 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:32:31.162 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:32:31.162 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:32:31.162 [Cloud] Queued cloud request. 2026-09-21T01:32:31.162 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:32:31.162 [Cloud] Dequeued cloud request. 2026-09-21T01:32:31.162 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:32:31.365 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E15C6194-45DC-20E1-2199-E338B5F70D7A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:32:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:32:31.865 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:33:12.147 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:33:12.147 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:33:12.147 [Cloud] Queued cloud request. 2026-09-21T01:33:12.147 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:33:12.147 [Cloud] Dequeued cloud request. 2026-09-21T01:33:12.147 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:33:12.241 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E2D4FAB-5283-F1C1-CF9E-C4DBE231EA5B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:33:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:33:12.741 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:37:07.164 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T01:39:40.588 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 391995, Count: 35727, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 1% 2026-09-21T01:39:40.588 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 4243, Count: 430, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T01:39:40.588 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 2617, Count: 209, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-21T01:39:40.588 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-21T01:39:40.588 ProcessImageName: AgentShellService.exe, Pid: 4816, TotalTime: 791, Count: 24, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 48% 2026-09-21T01:39:40.588 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-21T01:39:40.588 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 316, Count: 27, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-21T01:39:40.588 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T01:39:40.588 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-21T01:39:40.588 ProcessImageName: WmiPrvSE.exe, Pid: 8044, TotalTime: 106, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 1% 2026-09-21T01:39:40.588 ProcessImageName: taskhostw.exe, Pid: 7680, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-21T01:39:40.588 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T01:39:40.588 ProcessImageName: taskhostw.exe, Pid: 5900, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 6% 2026-09-21T01:39:40.588 ProcessImageName: taskhostw.exe, Pid: 3032, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-21T01:39:40.588 ProcessImageName: powershell.exe, Pid: 6596, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-21T01:39:40.588 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-21T01:39:40.588 ProcessImageName: mysqldump.exe, Pid: 6644, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-21T01:39:40.588 ProcessImageName: cmd.exe, Pid: 1664, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-21T01:43:13.947 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:43:13.947 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:43:13.947 [Cloud] Queued cloud request. 2026-09-21T01:43:13.947 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:43:13.947 [Cloud] Dequeued cloud request. 2026-09-21T01:43:13.947 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:43:14.135 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C3B19F9-56AF-4D56-D0EA-07059B62F336} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:43:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:43:14.635 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:44:26.885 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:44:26.885 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:44:26.885 [Cloud] Queued cloud request. 2026-09-21T01:44:26.885 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:44:26.885 [Cloud] Dequeued cloud request. 2026-09-21T01:44:26.885 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:44:27.072 [Cloud] End of cloud request. 2026-09-21T01:44:27.588 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:48:40.967 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T01:48:40.967 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T01:48:40.967 [Cloud] Queued cloud request. 2026-09-21T01:48:40.967 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T01:48:40.967 [Cloud] Dequeued cloud request. 2026-09-21T01:48:40.967 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T01:48:41.170 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FDD20019-26EE-4FD9-6894-69F3891145E6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 01:48:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T01:48:41.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T01:52:12.170 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T02:03:45.254 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T02:03:45.254 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T02:03:45.254 [Cloud] Queued cloud request. 2026-09-21T02:03:45.254 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T02:03:45.254 [Cloud] Dequeued cloud request. 2026-09-21T02:03:45.254 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T02:03:45.442 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7C562361-CF4A-9475-8B43-E52A5914BB13} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 02:03:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T02:03:45.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T02:05:50.662 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T02:05:50.662 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T02:05:50.662 [Cloud] Queued cloud request. 2026-09-21T02:05:50.662 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T02:05:50.662 [Cloud] Dequeued cloud request. 2026-09-21T02:05:50.662 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T02:05:50.849 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E2F64F46-E492-B061-9CB2-4B70C0A18D78} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 02:05:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T02:05:51.349 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T02:07:17.177 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T02:08:48.163 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T02:08:48.163 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T02:08:48.163 [Cloud] Queued cloud request. 2026-09-21T02:08:48.163 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T02:08:48.163 [Cloud] Dequeued cloud request. 2026-09-21T02:08:48.163 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T02:08:48.335 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2CF4B0CA-113A-6D02-8DAC-F5E7077C3BF9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 02:08:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T02:08:48.850 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T02:09:02.944 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T02:09:02.944 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T02:09:02.944 [Cloud] Queued cloud request. 2026-09-21T02:09:02.944 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T02:09:02.944 [Cloud] Dequeued cloud request. 2026-09-21T02:09:02.944 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T02:09:03.397 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D351E6EF-99A0-709E-DAEA-96D319E703AC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 02:09:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T02:09:03.897 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T02:19:10.073 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T02:19:10.073 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T02:19:10.073 [Cloud] Queued cloud request. 2026-09-21T02:19:10.073 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T02:19:10.073 [Cloud] Dequeued cloud request. 2026-09-21T02:19:10.073 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T02:19:10.229 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{69DC724E-77DB-27A9-E480-8BD657071A12} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 02:19:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T02:19:10.729 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T02:22:22.184 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T02:31:46.203 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T02:31:46.203 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T02:31:46.203 [Cloud] Queued cloud request. 2026-09-21T02:31:46.203 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T02:31:46.203 [Cloud] Dequeued cloud request. 2026-09-21T02:31:46.203 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T02:31:46.406 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B3F161A6-0644-5028-975C-A7AF529F8347} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 02:31:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T02:31:46.906 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T02:33:04.781 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T02:33:04.781 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T02:33:04.781 [Cloud] Queued cloud request. 2026-09-21T02:33:04.781 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T02:33:04.781 [Cloud] Dequeued cloud request. 2026-09-21T02:33:04.781 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T02:33:04.968 [Cloud] End of cloud request. 2026-09-21T02:33:05.453 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T02:37:27.191 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T02:49:25.508 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T02:49:25.508 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T02:49:25.508 [Cloud] Queued cloud request. 2026-09-21T02:49:25.508 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T02:49:25.508 [Cloud] Dequeued cloud request. 2026-09-21T02:49:25.508 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T02:49:25.664 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6ECA168E-98F4-C65A-7268-10E10F07C791} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 02:49:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T02:49:26.164 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T02:49:48.867 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T02:49:48.867 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T02:49:48.867 [Cloud] Queued cloud request. 2026-09-21T02:49:48.867 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T02:49:48.867 [Cloud] Dequeued cloud request. 2026-09-21T02:49:48.867 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T02:49:48.945 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{44D02E6F-B437-D528-9BDC-0550B7D679FE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 02:49:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T02:49:49.445 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T02:50:32.008 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T02:50:32.008 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T02:50:32.008 [Cloud] Queued cloud request. 2026-09-21T02:50:32.008 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T02:50:32.008 [Cloud] Dequeued cloud request. 2026-09-21T02:50:32.008 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T02:50:32.117 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A8A3DDCB-AE59-BC49-AD45-E416E39E3A4F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 02:50:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T02:50:32.633 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T02:50:53.649 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T02:50:53.649 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T02:50:53.649 [Cloud] Queued cloud request. 2026-09-21T02:50:53.649 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T02:50:53.649 [Cloud] Dequeued cloud request. 2026-09-21T02:50:53.649 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T02:50:53.727 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F51EFAE-73A1-BBEC-E79D-95B538C5B45E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 02:50:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T02:50:54.243 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T02:52:32.197 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T02:56:46.275 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T02:56:46.275 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T02:56:46.275 [Cloud] Queued cloud request. 2026-09-21T02:56:46.275 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T02:56:46.447 [Cloud] Dequeued cloud request. 2026-09-21T02:56:46.447 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T02:56:46.587 [Cloud] End of cloud request. 2026-09-21T02:56:47.087 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:04:32.202 [AutoPurge] Cleanup Routine tasks have started. 2026-09-21T03:04:32.202 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-21T03:04:32.202 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-21T03:04:32.202 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-21T03:04:32.202 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-21T03:04:32.202 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-21T03:04:32.233 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-21T03:04:32.233 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-21T03:04:32.233 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 2, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-21-2026 03:04:32 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-21-2026 03:04:32 2026-09-21T03:04:32.233 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-21T03:04:32.233 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-21T03:04:32.233 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-21T03:04:32.233 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-21T03:04:32.233 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-21T03:04:32.233 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-21T03:04:32.249 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-21T03:04:32.530 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-21T03:04:32.530 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-21T03:04:32.561 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-21T03:04:32.561 [AutoPurge] Removing expired default signature package ... 2026-09-21T03:04:32.889 Job Notification: New process added to job (8032) 2026-09-21T03:04:33.764 Job Notification: Process exited from job (8032) 2026-09-21T03:04:33.858 [AutoPurge] Verification Routine tasks have ended. 2026-09-21T03:05:00.983 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T03:05:00.983 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T03:05:00.983 [Cloud] Queued cloud request. 2026-09-21T03:05:00.983 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T03:05:00.983 [Cloud] Dequeued cloud request. 2026-09-21T03:05:00.983 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T03:05:00.983 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-21T03:05:01.499 [Cloud] End of cloud request. 2026-09-21T03:05:01.999 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-21T03:05:02.030 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:05:02.030 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-21T03:05:02.030 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-21T03:05:02.030 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-21T03:05:02.030 [RTP] Duplicating the current plugin configuration object... 2026-09-21T03:05:02.030 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-21T03:05:02.030 [RTP] Updating plugin configuration due to recent config changes (0x22) ... 2026-09-21T03:05:02.030 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-21T03:05:02.030 [RTP] No config change detected. Not updating plugin configuration. 2026-09-21T03:05:02.030 [RTP] No config changes found. No configuration switch. 2026-09-21T03:05:02.030 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x22, Changed: 0 2026-09-21T03:05:02.030 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:05:02.030 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-21T03:05:02.030 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-21T03:05:02.030 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-21T03:05:02.030 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-21T03:05:02.030 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-21T03:05:02.030 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-21T03:05:02.030 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-21T03:05:02.030 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-21T03:05:02.030 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:05:02.030 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-21T03:05:02.030 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-21T03:05:02.030 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-21T03:05:02.030 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-21T03:05:02.030 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-21T03:05:02.030 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-21T03:05:02.030 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-21T03:05:02.030 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-21T03:05:02.030 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-21T03:05:02.030 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:05:02.030 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:05:04.608 [RTP] Duplicating the current plugin configuration object... 2026-09-21T03:05:04.608 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-21T03:05:04.608 [RTP] Updating plugin configuration due to recent config changes (0x41c) ... 2026-09-21T03:05:04.608 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-21T03:05:04.608 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x41c, Changed: 0x218 2026-09-21T03:05:57.218 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T03:05:57.218 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T03:05:57.218 [Cloud] Queued cloud request. 2026-09-21T03:05:57.218 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T03:05:57.437 [Cloud] Dequeued cloud request. 2026-09-21T03:05:57.437 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T03:05:57.515 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EA8EC258-394D-DEDA-5B9C-298D5600F1A4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 03:05:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T03:05:58.015 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:07:37.203 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T03:09:04.282 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T03:09:04.282 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T03:09:04.282 [Cloud] Queued cloud request. 2026-09-21T03:09:04.282 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T03:09:04.282 [Cloud] Dequeued cloud request. 2026-09-21T03:09:04.282 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T03:09:14.423 [Cloud] End of cloud request. 2026-09-21T03:09:14.923 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:13:15.768 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T03:13:15.768 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T03:13:15.768 [Cloud] Queued cloud request. 2026-09-21T03:13:15.768 [Cloud] Dequeued cloud request. 2026-09-21T03:13:15.768 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T03:13:15.768 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T03:13:20.924 [Cloud] End of cloud request. 2026-09-21T03:13:21.440 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:22:42.208 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T03:26:02.617 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T03:26:02.617 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T03:26:02.617 [Cloud] Queued cloud request. 2026-09-21T03:26:02.617 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T03:26:02.617 [Cloud] Dequeued cloud request. 2026-09-21T03:26:02.617 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T03:26:02.820 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{91EB76BC-C690-E205-34FB-F10DA9D486D6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 03:26:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T03:26:03.320 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:30:44.885 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T03:30:44.885 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T03:30:44.885 [Cloud] Queued cloud request. 2026-09-21T03:30:44.885 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T03:30:44.885 [Cloud] Dequeued cloud request. 2026-09-21T03:30:44.885 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T03:30:45.088 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{545C75DE-BBBE-680C-FBE7-C57A607507BB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 03:30:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T03:30:45.588 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:32:12.135 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T03:32:12.135 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T03:32:12.135 [Cloud] Queued cloud request. 2026-09-21T03:32:12.135 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T03:32:12.135 [Cloud] Dequeued cloud request. 2026-09-21T03:32:12.135 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T03:32:12.323 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6B9F6C1B-6A91-1761-8A6C-C840A6853DB2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 03:32:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T03:32:12.823 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:37:47.216 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T03:39:07.498 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T03:39:07.498 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T03:39:07.498 [Cloud] Queued cloud request. 2026-09-21T03:39:07.498 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T03:39:07.498 [Cloud] Dequeued cloud request. 2026-09-21T03:39:07.498 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T03:39:07.654 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DCC1DEE1-675C-AFF4-DC76-D7280D001D98} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 03:39:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T03:39:08.154 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:39:40.654 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 396125, Count: 36001, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 1% 2026-09-21T03:39:40.654 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 4703, Count: 403, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-21T03:39:40.654 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 4243, Count: 430, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T03:39:40.654 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-21T03:39:40.654 ProcessImageName: AgentShellService.exe, Pid: 4816, TotalTime: 791, Count: 24, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 48% 2026-09-21T03:39:40.654 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-21T03:39:40.654 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 406, Count: 33, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-21T03:39:40.654 ProcessImageName: WmiPrvSE.exe, Pid: 6668, TotalTime: 285, Count: 32, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-21T03:39:40.654 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T03:39:40.654 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-21T03:39:40.654 ProcessImageName: WmiPrvSE.exe, Pid: 8044, TotalTime: 106, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 1% 2026-09-21T03:39:40.654 ProcessImageName: taskhostw.exe, Pid: 7680, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-21T03:39:40.654 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 90, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T03:39:40.654 ProcessImageName: taskhostw.exe, Pid: 5900, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 6% 2026-09-21T03:39:40.654 ProcessImageName: DeviceCensus.exe, Pid: 3032, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-21T03:39:40.654 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-21T03:39:40.654 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-21T03:39:40.654 ProcessImageName: taskhostw.exe, Pid: 3032, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-21T03:39:40.654 ProcessImageName: powershell.exe, Pid: 6596, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-21T03:39:40.654 ProcessImageName: mysqldump.exe, Pid: 6644, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-21T03:39:40.654 ProcessImageName: cmd.exe, Pid: 1664, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-21T03:46:30.423 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T03:46:30.423 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T03:46:30.423 [Cloud] Queued cloud request. 2026-09-21T03:46:30.423 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T03:46:30.423 [Cloud] Dequeued cloud request. 2026-09-21T03:46:30.423 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T03:46:30.657 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{61C1D041-0E5A-BDE5-28CA-C9842AD700FB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 03:46:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T03:46:31.173 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:49:55.956 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T03:49:55.956 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T03:49:55.956 [Cloud] Queued cloud request. 2026-09-21T03:49:55.956 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T03:49:55.956 [Cloud] Dequeued cloud request. 2026-09-21T03:49:55.956 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T03:49:56.096 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{878FBCB8-95E0-DB9C-ED7B-D379DB048078} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 03:49:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T03:49:56.612 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T03:52:52.222 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T03:56:08.003 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T03:56:08.003 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T03:56:08.003 [Cloud] Queued cloud request. 2026-09-21T03:56:08.003 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T03:56:08.003 [Cloud] Dequeued cloud request. 2026-09-21T03:56:08.003 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T03:56:08.144 [Cloud] End of cloud request. 2026-09-21T03:56:08.644 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T04:03:32.133 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T04:03:32.133 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T04:03:32.133 [Cloud] Queued cloud request. 2026-09-21T04:03:32.133 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T04:03:32.133 [Cloud] Dequeued cloud request. 2026-09-21T04:03:32.133 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T04:03:32.289 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A25920BC-E117-87E9-86A5-D1AFAE451B3E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 04:03:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T04:03:32.805 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T04:05:58.368 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T04:05:58.368 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T04:05:58.368 [Cloud] Queued cloud request. 2026-09-21T04:05:58.368 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T04:05:58.368 [Cloud] Dequeued cloud request. 2026-09-21T04:05:58.368 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T04:05:58.524 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{714F0225-398B-6380-E36B-F0D6C443A53D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 04:05:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T04:05:59.024 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T04:07:57.229 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T04:23:02.235 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T04:38:07.242 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T04:38:33.726 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T04:38:33.726 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T04:38:33.726 [Cloud] Queued cloud request. 2026-09-21T04:38:33.726 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T04:38:33.726 [Cloud] Dequeued cloud request. 2026-09-21T04:38:33.726 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T04:38:33.898 [Cloud] End of cloud request. 2026-09-21T04:38:34.398 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T04:39:42.523 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T04:39:42.523 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T04:39:42.523 [Cloud] Queued cloud request. 2026-09-21T04:39:42.523 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T04:39:42.523 [Cloud] Dequeued cloud request. 2026-09-21T04:39:42.695 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T04:39:42.851 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AE3D5C20-FF38-0787-A4A7-813F612FC119} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 04:39:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T04:39:43.351 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T04:41:50.117 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T04:41:50.117 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T04:41:50.117 [Cloud] Queued cloud request. 2026-09-21T04:41:50.117 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T04:41:50.117 [Cloud] Dequeued cloud request. 2026-09-21T04:41:50.117 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T04:41:50.258 [Cloud] End of cloud request. 2026-09-21T04:41:50.758 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T04:53:12.248 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T04:57:27.999 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T04:57:27.999 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T04:57:27.999 [Cloud] Queued cloud request. 2026-09-21T04:57:27.999 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T04:57:27.999 [Cloud] Dequeued cloud request. 2026-09-21T04:57:27.999 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T04:57:28.187 [Cloud] End of cloud request. 2026-09-21T04:57:28.687 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T05:05:41.159 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T05:05:41.159 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T05:05:41.159 [Cloud] Queued cloud request. 2026-09-21T05:05:41.159 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T05:05:41.159 [Cloud] Dequeued cloud request. 2026-09-21T05:05:41.159 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T05:05:41.362 [Cloud] End of cloud request. 2026-09-21T05:05:41.862 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T05:08:17.255 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T05:23:22.259 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T05:33:15.545 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T05:33:15.545 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T05:33:15.545 [Cloud] Queued cloud request. 2026-09-21T05:33:15.545 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T05:33:15.545 [Cloud] Dequeued cloud request. 2026-09-21T05:33:15.545 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T05:33:15.716 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F2DA785-6191-0554-50F8-E1D88E98F6FA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 05:33:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T05:33:16.216 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T05:38:27.267 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T05:39:40.721 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 399365, Count: 36271, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 1% 2026-09-21T05:39:40.721 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 6730, Count: 590, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-21T05:39:40.721 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 4243, Count: 430, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T05:39:40.721 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-21T05:39:40.721 ProcessImageName: AgentShellService.exe, Pid: 4816, TotalTime: 791, Count: 24, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 48% 2026-09-21T05:39:40.721 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-21T05:39:40.721 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 406, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-21T05:39:40.721 ProcessImageName: WmiPrvSE.exe, Pid: 6668, TotalTime: 285, Count: 32, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-21T05:39:40.721 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T05:39:40.721 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-21T05:39:40.721 ProcessImageName: WmiPrvSE.exe, Pid: 8044, TotalTime: 106, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 1% 2026-09-21T05:39:40.721 ProcessImageName: taskhostw.exe, Pid: 7680, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-21T05:39:40.721 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 90, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T05:39:40.721 ProcessImageName: taskhostw.exe, Pid: 5900, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 6% 2026-09-21T05:39:40.721 ProcessImageName: DeviceCensus.exe, Pid: 3032, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-21T05:39:40.721 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-21T05:39:40.721 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-21T05:39:40.721 ProcessImageName: taskhostw.exe, Pid: 3032, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-21T05:39:40.721 ProcessImageName: powershell.exe, Pid: 6596, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-21T05:39:40.721 ProcessImageName: mysqldump.exe, Pid: 6644, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-21T05:39:40.721 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-21T05:39:40.721 ProcessImageName: cmd.exe, Pid: 1664, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-21T05:45:38.801 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T05:45:38.801 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T05:45:38.801 [Cloud] Queued cloud request. 2026-09-21T05:45:38.801 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T05:45:38.801 [Cloud] Dequeued cloud request. 2026-09-21T05:45:38.801 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T05:45:38.989 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F00CA1AF-2DB4-4578-9C13-E2D4C2F603CB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 05:45:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T05:45:39.489 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T05:53:32.272 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T05:57:30.759 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T05:57:30.759 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T05:57:30.759 [Cloud] Queued cloud request. 2026-09-21T05:57:30.759 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T05:57:30.759 [Cloud] Dequeued cloud request. 2026-09-21T05:57:30.759 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T05:57:30.947 [Cloud] End of cloud request. 2026-09-21T05:57:31.463 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T05:58:44.370 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T05:58:44.370 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T05:58:44.370 [Cloud] Queued cloud request. 2026-09-21T05:58:44.370 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T05:58:44.370 [Cloud] Dequeued cloud request. 2026-09-21T05:58:44.370 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T05:58:44.557 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8F5FEEB-21FF-81E6-4F35-AA28BD7AA70B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 05:58:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T05:58:45.057 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T06:08:37.280 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T06:14:25.892 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T06:14:25.892 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T06:14:25.892 [Cloud] Queued cloud request. 2026-09-21T06:14:25.892 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T06:14:25.892 [Cloud] Dequeued cloud request. 2026-09-21T06:14:25.892 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T06:14:35.986 [Cloud] End of cloud request. 2026-09-21T06:14:36.501 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T06:16:50.596 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T06:16:50.596 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T06:16:50.596 [Cloud] Queued cloud request. 2026-09-21T06:16:50.596 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T06:16:50.596 [Cloud] Dequeued cloud request. 2026-09-21T06:16:50.596 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T06:16:50.768 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{14B497B4-682A-44E5-8DF7-AD9779B9E3A9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 06:16:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T06:16:51.268 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T06:23:42.286 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T06:24:20.864 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T06:24:20.864 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T06:24:20.864 [Cloud] Queued cloud request. 2026-09-21T06:24:20.864 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T06:24:20.864 [Cloud] Dequeued cloud request. 2026-09-21T06:24:20.864 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T06:24:23.786 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{60B92EC6-58DF-FB79-4279-8D1C79C3EEA9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 06:24:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T06:24:24.286 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T06:38:04.262 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T06:38:04.262 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T06:38:04.262 [Cloud] Queued cloud request. 2026-09-21T06:38:04.262 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T06:38:04.262 [Cloud] Dequeued cloud request. 2026-09-21T06:38:04.262 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T06:38:04.465 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{91EF9D13-5045-69E1-77FD-FB917397ADD3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 06:38:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T06:38:04.965 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T06:38:47.293 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T06:43:54.076 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T06:43:54.076 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T06:43:54.076 [Cloud] Queued cloud request. 2026-09-21T06:43:54.076 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T06:43:54.076 [Cloud] Dequeued cloud request. 2026-09-21T06:43:54.076 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T06:43:54.638 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{57F63718-8804-32B8-FD45-79749423A36E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 06:43:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T06:43:55.138 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T06:44:23.311 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T06:44:23.311 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T06:44:23.311 [Cloud] Queued cloud request. 2026-09-21T06:44:23.311 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T06:44:23.311 [Cloud] Dequeued cloud request. 2026-09-21T06:44:23.311 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T06:44:23.655 [Cloud] End of cloud request. 2026-09-21T06:44:24.170 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T06:53:52.298 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T06:57:59.880 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T06:57:59.880 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T06:57:59.880 [Cloud] Queued cloud request. 2026-09-21T06:57:59.880 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T06:57:59.880 [Cloud] Dequeued cloud request. 2026-09-21T06:57:59.880 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T06:58:00.083 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{583C31E5-219A-EFFC-6016-1D1ADB439DF2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 06:58:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T06:58:00.598 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T07:08:57.306 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T07:14:11.761 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T07:14:11.761 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T07:14:11.761 [Cloud] Queued cloud request. 2026-09-21T07:14:11.761 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T07:14:11.761 [Cloud] Dequeued cloud request. 2026-09-21T07:14:11.761 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T07:14:11.949 [Cloud] End of cloud request. 2026-09-21T07:14:12.449 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T07:20:08.561 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T07:20:08.561 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T07:20:08.561 [Cloud] Queued cloud request. 2026-09-21T07:20:08.561 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T07:20:08.561 [Cloud] Dequeued cloud request. 2026-09-21T07:20:08.561 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T07:20:08.811 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7EB82EFC-D8DC-69DE-C6BF-EE1415636B5A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 07:20:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T07:20:09.326 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T07:24:02.311 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T07:25:28.859 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T07:25:28.859 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T07:25:28.859 [Cloud] Queued cloud request. 2026-09-21T07:25:28.859 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T07:25:29.015 [Cloud] Dequeued cloud request. 2026-09-21T07:25:29.172 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T07:25:29.515 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{07898B88-41CF-92ED-3075-4F9FE03F1436} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 07:25:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T07:25:29.531 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T07:25:29.531 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T07:25:29.531 [Cloud] Queued cloud request. 2026-09-21T07:25:29.531 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T07:25:29.531 [Cloud] Dequeued cloud request. 2026-09-21T07:25:29.531 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T07:25:29.750 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B8D85235-4424-8143-B57F-15524BEA05B3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 07:25:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T07:25:30.031 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T07:39:07.319 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T07:39:09.772 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T07:39:09.772 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T07:39:09.772 [Cloud] Queued cloud request. 2026-09-21T07:39:09.772 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T07:39:09.772 [Cloud] Dequeued cloud request. 2026-09-21T07:39:09.772 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T07:39:09.975 [Cloud] End of cloud request. 2026-09-21T07:39:10.459 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T07:39:40.772 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 402090, Count: 36442, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 0% 2026-09-21T07:39:40.772 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 8708, Count: 764, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-21T07:39:40.772 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 4243, Count: 430, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T07:39:40.772 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-21T07:39:40.772 ProcessImageName: AgentShellService.exe, Pid: 4816, TotalTime: 791, Count: 24, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 48% 2026-09-21T07:39:40.772 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-21T07:39:40.772 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 496, Count: 41, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-21T07:39:40.772 ProcessImageName: WmiPrvSE.exe, Pid: 6668, TotalTime: 285, Count: 32, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-21T07:39:40.772 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T07:39:40.772 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-21T07:39:40.772 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 120, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T07:39:40.772 ProcessImageName: WmiPrvSE.exe, Pid: 8044, TotalTime: 106, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 1% 2026-09-21T07:39:40.772 ProcessImageName: taskhostw.exe, Pid: 7680, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-21T07:39:40.772 ProcessImageName: taskhostw.exe, Pid: 5900, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 6% 2026-09-21T07:39:40.772 ProcessImageName: DeviceCensus.exe, Pid: 3032, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-21T07:39:40.772 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-21T07:39:40.772 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-21T07:39:40.772 ProcessImageName: taskhostw.exe, Pid: 3032, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-21T07:39:40.772 ProcessImageName: powershell.exe, Pid: 6596, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-21T07:39:40.772 ProcessImageName: mysqldump.exe, Pid: 6644, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-21T07:39:40.772 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-21T07:39:40.772 ProcessImageName: cmd.exe, Pid: 1664, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-21T07:45:45.290 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T07:45:45.290 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T07:45:45.290 [Cloud] Queued cloud request. 2026-09-21T07:45:45.290 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T07:45:45.290 [Cloud] Dequeued cloud request. 2026-09-21T07:45:45.290 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T07:45:45.493 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D9C52608-C7F2-9C6E-9622-264F341E9AED} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 07:45:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T07:45:46.009 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T07:54:12.325 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T08:09:17.332 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T08:12:37.629 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T08:12:37.629 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T08:12:37.629 [Cloud] Queued cloud request. 2026-09-21T08:12:37.629 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T08:12:37.629 [Cloud] Dequeued cloud request. 2026-09-21T08:12:37.629 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T08:12:37.879 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{78AC8CAE-68AF-B9AC-3A51-331332ECBE13} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 08:12:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T08:12:38.395 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T08:23:56.244 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T08:23:56.244 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T08:23:56.244 [Cloud] Queued cloud request. 2026-09-21T08:23:56.244 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T08:23:56.244 [Cloud] Dequeued cloud request. 2026-09-21T08:23:56.244 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{131D2BC0-135F-5944-6782-DD65D4B62DE6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 08:23:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T08:23:56.462 [Cloud] End of cloud request. 2026-09-21T08:23:56.962 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T08:24:22.337 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T08:39:27.345 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T08:44:47.800 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T08:44:47.800 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T08:44:47.800 [Cloud] Queued cloud request. 2026-09-21T08:44:47.800 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T08:44:47.800 [Cloud] Dequeued cloud request. 2026-09-21T08:44:47.800 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T08:44:47.956 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{15D4AAA7-5992-56E1-6E87-A6D0BAA07872} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 08:44:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T08:44:48.456 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T08:45:45.597 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T08:45:45.597 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T08:45:45.597 [Cloud] Queued cloud request. 2026-09-21T08:45:45.597 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T08:45:45.597 [Cloud] Dequeued cloud request. 2026-09-21T08:45:45.597 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T08:45:45.675 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8BCCA158-14F7-A1A5-7B32-2EDA305CF8C3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 08:45:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T08:45:46.175 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T08:49:04.896 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T08:49:04.896 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T08:49:04.896 [Cloud] Queued cloud request. 2026-09-21T08:49:04.896 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T08:49:05.084 [Cloud] Dequeued cloud request. 2026-09-21T08:49:05.240 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T08:49:05.380 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C1DFCEF6-21D8-80AA-302B-39E90CC31F79} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 08:49:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T08:49:05.880 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T08:53:51.882 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T08:53:51.882 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T08:53:51.882 [Cloud] Queued cloud request. 2026-09-21T08:53:51.882 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T08:53:51.882 [Cloud] Dequeued cloud request. 2026-09-21T08:53:51.882 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T08:53:52.054 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{59DA8094-6853-BEFC-DC7D-0667E95C4B66} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 08:53:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T08:53:52.554 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T08:54:32.351 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T09:01:13.400 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T09:01:13.400 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T09:01:13.400 [Cloud] Queued cloud request. 2026-09-21T09:01:13.400 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T09:01:13.400 [Cloud] Dequeued cloud request. 2026-09-21T09:01:13.400 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T09:01:13.603 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9621AB50-AE4A-846E-7BF7-08A3D31ED6E8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 09:01:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T09:01:14.103 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T09:04:14.495 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T09:04:14.495 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T09:04:14.495 [Cloud] Queued cloud request. 2026-09-21T09:04:14.495 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T09:04:14.495 [Cloud] Dequeued cloud request. 2026-09-21T09:04:14.495 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T09:04:14.667 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{773155F1-497D-3226-DA49-BEED4B046B53} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 09:04:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T09:04:15.182 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T09:07:17.826 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T09:07:17.826 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T09:07:17.826 [Cloud] Queued cloud request. 2026-09-21T09:07:17.826 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T09:07:17.826 [Cloud] Dequeued cloud request. 2026-09-21T09:07:17.826 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T09:07:17.982 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3B9D5964-C83F-FC85-60C8-28BCBA1DBF32} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 09:07:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T09:07:18.498 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T09:09:15.920 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T09:09:15.920 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T09:09:15.920 [Cloud] Queued cloud request. 2026-09-21T09:09:15.920 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T09:09:16.092 [Cloud] Dequeued cloud request. 2026-09-21T09:09:16.092 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T09:09:16.280 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B75C54B9-B08B-1114-C326-3B0D586FC146} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 09:09:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T09:09:16.795 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T09:09:37.358 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T09:15:15.593 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T09:15:15.593 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T09:15:15.593 [Cloud] Queued cloud request. 2026-09-21T09:15:15.593 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T09:15:15.593 [Cloud] Dequeued cloud request. 2026-09-21T09:15:15.593 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T09:15:25.749 [Cloud] End of cloud request. 2026-09-21T09:15:26.249 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T09:17:49.268 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T09:17:49.268 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T09:17:49.268 [Cloud] Queued cloud request. 2026-09-21T09:17:49.268 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T09:17:49.268 [Cloud] Dequeued cloud request. 2026-09-21T09:17:49.268 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T09:17:49.471 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{58C258C1-1A11-51C9-1C99-4F17E8C540AC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 09:17:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T09:17:49.987 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T09:24:42.364 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T09:27:45.444 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T09:27:45.444 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T09:27:45.444 [Cloud] Queued cloud request. 2026-09-21T09:27:45.444 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T09:27:45.444 [Cloud] Dequeued cloud request. 2026-09-21T09:27:45.444 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T09:27:45.600 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4FAE53E6-A604-0B0F-5012-9966D673B803} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 09:27:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T09:27:46.116 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T09:31:18.257 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T09:31:18.257 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T09:31:18.257 [Cloud] Queued cloud request. 2026-09-21T09:31:18.257 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T09:31:18.257 [Cloud] Dequeued cloud request. 2026-09-21T09:31:18.257 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T09:31:18.429 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DCF2F5D6-2AF5-2549-12AD-EE4E5FFE8962} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 09:31:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T09:31:18.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T09:33:45.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T09:33:45.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T09:33:45.304 [Cloud] Queued cloud request. 2026-09-21T09:33:45.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T09:33:45.304 [Cloud] Dequeued cloud request. 2026-09-21T09:33:45.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T09:33:45.508 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{175A23F9-986E-5A1E-C924-D82F1E91959C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 09:33:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T09:33:46.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T09:39:40.840 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 403046, Count: 36471, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 0% 2026-09-21T09:39:40.840 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 10813, Count: 933, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-21T09:39:40.840 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 4243, Count: 430, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T09:39:40.840 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-21T09:39:40.840 ProcessImageName: AgentShellService.exe, Pid: 4816, TotalTime: 791, Count: 24, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 48% 2026-09-21T09:39:40.840 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-21T09:39:40.840 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 541, Count: 45, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-21T09:39:40.840 ProcessImageName: WmiPrvSE.exe, Pid: 6668, TotalTime: 285, Count: 32, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-21T09:39:40.840 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T09:39:40.840 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 135, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-21T09:39:40.840 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 135, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T09:39:40.840 ProcessImageName: WmiPrvSE.exe, Pid: 8044, TotalTime: 106, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 1% 2026-09-21T09:39:40.840 ProcessImageName: taskhostw.exe, Pid: 7680, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-21T09:39:40.840 ProcessImageName: taskhostw.exe, Pid: 5900, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 6% 2026-09-21T09:39:40.840 ProcessImageName: DeviceCensus.exe, Pid: 3032, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-21T09:39:40.840 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-21T09:39:40.840 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-21T09:39:40.840 ProcessImageName: taskhostw.exe, Pid: 3032, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-21T09:39:40.840 ProcessImageName: powershell.exe, Pid: 6596, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-21T09:39:40.840 ProcessImageName: mysqldump.exe, Pid: 6644, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-21T09:39:40.840 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-21T09:39:40.840 ProcessImageName: cmd.exe, Pid: 1664, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-21T09:39:47.371 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T09:47:28.344 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T09:47:28.344 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T09:47:28.344 [Cloud] Queued cloud request. 2026-09-21T09:47:28.344 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T09:47:28.344 [Cloud] Dequeued cloud request. 2026-09-21T09:47:28.344 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T09:47:28.500 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C7217E99-94DE-BDA3-3073-8DED00946546} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 09:47:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T09:47:29.000 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T09:50:47.547 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T09:50:47.547 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T09:50:47.547 [Cloud] Queued cloud request. 2026-09-21T09:50:47.547 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T09:50:47.547 [Cloud] Dequeued cloud request. 2026-09-21T09:50:47.547 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T09:50:47.703 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E5F0EE2E-8091-449E-D2C9-A468A36E1C00} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 09:50:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T09:50:48.203 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T09:54:52.377 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T10:06:03.726 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T10:06:03.726 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T10:06:03.726 [Cloud] Queued cloud request. 2026-09-21T10:06:03.726 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T10:06:03.898 [Cloud] Dequeued cloud request. 2026-09-21T10:06:03.898 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T10:06:04.085 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{40D01BFC-46CF-965A-30C4-3C6CBCF65071} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 10:06:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T10:06:04.585 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T10:09:57.384 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T10:25:02.390 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T10:26:03.109 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T10:26:03.109 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T10:26:03.109 [Cloud] Queued cloud request. 2026-09-21T10:26:03.109 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T10:26:03.109 [Cloud] Dequeued cloud request. 2026-09-21T10:26:03.109 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T10:26:03.281 [Cloud] End of cloud request. 2026-09-21T10:26:03.781 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T10:29:04.846 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T10:29:04.846 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T10:29:04.846 [Cloud] Queued cloud request. 2026-09-21T10:29:04.846 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T10:29:04.846 [Cloud] Dequeued cloud request. 2026-09-21T10:29:04.846 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T10:29:05.096 [Cloud] End of cloud request. 2026-09-21T10:29:05.596 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T10:35:06.630 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T10:35:06.630 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T10:35:06.630 [Cloud] Queued cloud request. 2026-09-21T10:35:06.630 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T10:35:06.630 [Cloud] Dequeued cloud request. 2026-09-21T10:35:06.630 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T10:35:16.739 [Cloud] End of cloud request. 2026-09-21T10:35:17.255 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T10:37:44.412 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T10:37:44.412 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T10:37:44.412 [Cloud] Queued cloud request. 2026-09-21T10:37:44.412 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T10:37:44.412 [Cloud] Dequeued cloud request. 2026-09-21T10:37:44.412 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T10:37:44.568 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{493FCE73-5049-EB5D-48A2-9C74D63053D3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 10:37:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T10:37:45.068 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T10:38:21.647 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T10:38:21.647 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T10:38:21.647 [Cloud] Queued cloud request. 2026-09-21T10:38:21.647 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T10:38:21.647 [Cloud] Dequeued cloud request. 2026-09-21T10:38:21.647 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T10:38:21.756 [Cloud] End of cloud request. 2026-09-21T10:38:22.256 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T10:40:07.397 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T10:42:21.928 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T10:42:21.928 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T10:42:21.928 [Cloud] Queued cloud request. 2026-09-21T10:42:21.928 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T10:42:21.928 [Cloud] Dequeued cloud request. 2026-09-21T10:42:21.928 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T10:42:22.084 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8E418E4-F765-B2A6-AFB1-72EB8A04799F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 10:42:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T10:42:22.584 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T10:55:12.404 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T11:00:37.218 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T11:00:37.218 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T11:00:37.218 [Cloud] Queued cloud request. 2026-09-21T11:00:37.218 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T11:00:37.218 [Cloud] Dequeued cloud request. 2026-09-21T11:00:37.218 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T11:00:37.390 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EDDC572A-76A0-B623-38A4-028C11612476} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 11:00:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T11:00:37.906 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T11:10:17.410 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T11:13:16.785 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T11:13:16.785 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T11:13:16.785 [Cloud] Queued cloud request. 2026-09-21T11:13:16.785 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T11:13:16.988 [Cloud] Dequeued cloud request. 2026-09-21T11:13:16.988 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T11:13:17.285 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A1932795-1949-011B-4E1A-E3F79E739CA0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 11:13:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T11:13:17.801 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T11:25:22.417 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T11:30:17.841 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T11:30:17.841 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T11:30:17.841 [Cloud] Queued cloud request. 2026-09-21T11:30:17.841 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T11:30:17.841 [Cloud] Dequeued cloud request. 2026-09-21T11:30:17.841 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T11:30:18.294 [Cloud] End of cloud request. 2026-09-21T11:30:18.794 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T11:39:40.893 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 407067, Count: 36756, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 0% 2026-09-21T11:39:40.893 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 12714, Count: 1112, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-21T11:39:40.893 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 4243, Count: 430, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T11:39:40.893 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-21T11:39:40.893 ProcessImageName: AgentShellService.exe, Pid: 4816, TotalTime: 791, Count: 24, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 48% 2026-09-21T11:39:40.893 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 633, Count: 49, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-21T11:39:40.893 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-21T11:39:40.893 ProcessImageName: WmiPrvSE.exe, Pid: 6668, TotalTime: 285, Count: 32, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-21T11:39:40.893 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T11:39:40.893 ProcessImageName: powershell.exe, Pid: 2360, TotalTime: 232, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 21% 2026-09-21T11:39:40.893 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 165, Count: 70, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-21T11:39:40.893 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 150, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T11:39:40.893 ProcessImageName: python.exe, Pid: 7872, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-21T11:39:40.893 ProcessImageName: WmiPrvSE.exe, Pid: 8044, TotalTime: 106, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 1% 2026-09-21T11:39:40.893 ProcessImageName: taskhostw.exe, Pid: 7680, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-21T11:39:40.893 ProcessImageName: taskhostw.exe, Pid: 5900, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 6% 2026-09-21T11:39:40.893 ProcessImageName: DeviceCensus.exe, Pid: 3032, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-21T11:39:40.893 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-21T11:39:40.893 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-21T11:39:40.893 ProcessImageName: taskhostw.exe, Pid: 3032, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-21T11:39:40.893 ProcessImageName: powershell.exe, Pid: 6596, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-21T11:39:40.893 ProcessImageName: mysqldump.exe, Pid: 6644, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-21T11:39:40.893 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-21T11:39:40.893 ProcessImageName: cmd.exe, Pid: 1664, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-21T11:40:27.424 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T11:46:11.271 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T11:46:11.271 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T11:46:11.271 [Cloud] Queued cloud request. 2026-09-21T11:46:11.271 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T11:46:11.271 [Cloud] Dequeued cloud request. 2026-09-21T11:46:11.271 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T11:46:11.506 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0581AC97-83AD-3BC9-CE55-197B60A1C530} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 11:46:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T11:46:12.006 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{E9812E8D-01CC-ECF2-E669-02F64ED3F6AA} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-21-2026 11:50:37 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T11:50:38.929 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T11:50:38.929 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T11:50:38.929 [Cloud] Queued cloud request. 2026-09-21T11:50:38.929 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T11:50:38.929 [Cloud] Dequeued cloud request. 2026-09-21T11:50:38.929 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T11:50:39.335 [Cloud] End of cloud request. 2026-09-21T11:50:39.835 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T11:55:32.430 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T11:57:42.761 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T11:57:42.761 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T11:57:42.761 [Cloud] Queued cloud request. 2026-09-21T11:57:42.761 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T11:57:42.761 [Cloud] Dequeued cloud request. 2026-09-21T11:57:42.761 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T11:57:42.948 [Cloud] End of cloud request. 2026-09-21T11:57:43.464 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T12:06:58.468 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T12:06:58.468 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T12:06:58.468 [Cloud] Queued cloud request. 2026-09-21T12:06:58.468 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T12:06:58.468 [Cloud] Dequeued cloud request. 2026-09-21T12:06:58.468 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T12:06:58.718 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{13CE62F3-B245-2297-DD19-C66D26B2820B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 12:06:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T12:06:59.233 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T12:10:37.438 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T12:12:51.830 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T12:12:51.830 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T12:12:51.830 [Cloud] Queued cloud request. 2026-09-21T12:12:51.830 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T12:12:51.830 [Cloud] Dequeued cloud request. 2026-09-21T12:12:51.830 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T12:12:52.033 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{20E43F19-6C0C-4C66-1822-2EE569E0EC45} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 12:12:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T12:12:52.549 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T12:20:40.099 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T12:20:40.099 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T12:20:40.099 [Cloud] Queued cloud request. 2026-09-21T12:20:40.099 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T12:20:40.099 [Cloud] Dequeued cloud request. 2026-09-21T12:20:40.099 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T12:20:40.677 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0761DB8F-918D-3D5B-F297-100F2E565AA3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 12:20:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T12:20:41.193 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T12:25:42.445 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T12:29:42.369 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T12:29:42.369 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T12:29:42.369 [Cloud] Queued cloud request. 2026-09-21T12:29:42.369 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T12:29:42.369 [Cloud] Dequeued cloud request. 2026-09-21T12:29:42.369 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T12:29:42.619 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{915894BB-593C-84EC-57A2-B444ADE0DB9E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 12:29:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T12:29:43.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T12:31:26.166 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T12:31:26.166 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T12:31:26.166 [Cloud] Queued cloud request. 2026-09-21T12:31:26.166 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T12:31:26.166 [Cloud] Dequeued cloud request. 2026-09-21T12:31:26.166 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T12:31:27.057 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{588BFE50-C9DF-23C4-F36D-16CEA3CE463D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 12:31:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T12:31:27.572 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T12:35:06.434 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T12:35:06.434 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T12:35:06.434 [Cloud] Queued cloud request. 2026-09-21T12:35:06.434 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T12:35:06.434 [Cloud] Dequeued cloud request. 2026-09-21T12:35:06.434 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T12:35:06.637 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E9EAE21E-0BB2-4D9F-F476-0656A8C81E25} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 12:35:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T12:35:07.137 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T12:40:47.452 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T12:48:24.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T12:48:24.097 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T12:48:24.097 [Cloud] Queued cloud request. 2026-09-21T12:48:24.097 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T12:48:24.097 [Cloud] Dequeued cloud request. 2026-09-21T12:48:24.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T12:48:24.269 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F72C82F1-7A13-181E-FB31-C4BE21BAFF72} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 12:48:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T12:48:24.785 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T12:54:52.599 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T12:54:52.599 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T12:54:52.599 [Cloud] Queued cloud request. 2026-09-21T12:54:52.599 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T12:54:52.599 [Cloud] Dequeued cloud request. 2026-09-21T12:54:52.599 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T12:54:52.771 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F478AC91-D0AD-127F-F4B5-EC660482C7C0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 12:54:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T12:54:53.271 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T12:55:52.459 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T12:57:19.444 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T12:57:19.444 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T12:57:19.444 [Cloud] Queued cloud request. 2026-09-21T12:57:19.444 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T12:57:19.444 [Cloud] Dequeued cloud request. 2026-09-21T12:57:19.444 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T12:57:19.850 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0BE30B34-0D26-F07A-030A-2737122042C5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 12:57:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T12:57:20.350 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T13:10:57.466 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T13:26:02.473 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T13:39:40.949 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 409592, Count: 36916, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 0% 2026-09-21T13:39:40.949 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 14930, Count: 1289, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-21T13:39:40.949 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 4243, Count: 430, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T13:39:40.949 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-21T13:39:40.949 ProcessImageName: AgentShellService.exe, Pid: 4816, TotalTime: 791, Count: 24, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 48% 2026-09-21T13:39:40.949 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 693, Count: 54, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-21T13:39:40.949 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-21T13:39:40.949 ProcessImageName: WmiPrvSE.exe, Pid: 6668, TotalTime: 285, Count: 32, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-21T13:39:40.949 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T13:39:40.949 ProcessImageName: powershell.exe, Pid: 2360, TotalTime: 232, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 21% 2026-09-21T13:39:40.949 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 210, Count: 76, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-21T13:39:40.949 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 180, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T13:39:40.949 ProcessImageName: python.exe, Pid: 7872, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-21T13:39:40.949 ProcessImageName: WmiPrvSE.exe, Pid: 8044, TotalTime: 106, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 1% 2026-09-21T13:39:40.949 ProcessImageName: taskhostw.exe, Pid: 7680, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-21T13:39:40.949 ProcessImageName: taskhostw.exe, Pid: 5900, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 6% 2026-09-21T13:39:40.949 ProcessImageName: DeviceCensus.exe, Pid: 3032, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-21T13:39:40.949 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-21T13:39:40.949 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-21T13:39:40.949 ProcessImageName: taskhostw.exe, Pid: 3032, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-21T13:39:40.949 ProcessImageName: powershell.exe, Pid: 6596, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-21T13:39:40.949 ProcessImageName: mysqldump.exe, Pid: 6644, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-21T13:39:40.949 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-21T13:39:40.949 ProcessImageName: cmd.exe, Pid: 1664, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-21T13:41:07.480 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T13:54:28.174 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T13:54:28.174 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T13:54:28.174 [Cloud] Queued cloud request. 2026-09-21T13:54:28.174 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T13:54:28.174 [Cloud] Dequeued cloud request. 2026-09-21T13:54:28.174 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T13:54:28.362 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7115A3D8-016D-68F5-56F6-DD8699B82278} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 13:54:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T13:54:28.877 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T13:56:12.488 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T14:09:57.291 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T14:09:57.291 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T14:09:57.291 [Cloud] Queued cloud request. 2026-09-21T14:09:57.291 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T14:09:57.494 [Cloud] Dequeued cloud request. 2026-09-21T14:09:57.650 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T14:09:57.807 [Cloud] End of cloud request. 2026-09-21T14:09:58.307 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T14:11:17.494 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T14:12:58.463 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T14:12:58.463 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T14:12:58.463 [Cloud] Queued cloud request. 2026-09-21T14:12:58.463 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T14:12:58.463 [Cloud] Dequeued cloud request. 2026-09-21T14:12:58.463 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T14:12:58.619 [Cloud] End of cloud request. 2026-09-21T14:12:59.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T14:26:22.502 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T14:27:59.394 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T14:27:59.394 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T14:27:59.394 [Cloud] Queued cloud request. 2026-09-21T14:27:59.394 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T14:27:59.394 [Cloud] Dequeued cloud request. 2026-09-21T14:27:59.394 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T14:27:59.535 [Cloud] End of cloud request. 2026-09-21T14:28:00.050 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T14:28:35.332 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T14:28:35.332 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T14:28:35.332 [Cloud] Queued cloud request. 2026-09-21T14:28:35.332 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T14:28:35.332 [Cloud] Dequeued cloud request. 2026-09-21T14:28:35.332 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T14:28:35.425 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0DA43E8F-25B7-7586-BB50-3C17400D2E3B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 14:28:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T14:28:35.926 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T14:41:27.508 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T14:41:59.930 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T14:41:59.930 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T14:41:59.930 [Cloud] Queued cloud request. 2026-09-21T14:41:59.930 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T14:41:59.930 [Cloud] Dequeued cloud request. 2026-09-21T14:41:59.930 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T14:42:00.399 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{903E2B21-5FDF-40D3-E36D-B948735A0DBF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 14:42:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T14:42:00.899 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T14:49:03.091 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T14:49:03.091 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T14:49:03.091 [Cloud] Queued cloud request. 2026-09-21T14:49:03.091 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T14:49:03.091 [Cloud] Dequeued cloud request. 2026-09-21T14:49:03.091 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T14:49:03.279 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F4639E54-263B-D363-A1CE-8F172F8DF387} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 14:49:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T14:49:03.794 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T14:56:32.515 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T14:58:20.722 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T14:58:20.722 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T14:58:20.722 [Cloud] Queued cloud request. 2026-09-21T14:58:20.722 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T14:58:20.878 [Cloud] Dequeued cloud request. 2026-09-21T14:58:20.878 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T14:58:31.003 [Cloud] End of cloud request. 2026-09-21T14:58:31.519 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T15:11:37.522 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T15:13:24.131 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T15:13:24.131 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T15:13:24.131 [Cloud] Queued cloud request. 2026-09-21T15:13:24.131 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T15:13:24.131 [Cloud] Dequeued cloud request. 2026-09-21T15:13:24.131 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T15:13:24.319 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{67652A04-98CA-C382-77A1-A043C51472D0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 15:13:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T15:13:24.819 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T15:23:20.778 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T15:23:20.778 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T15:23:20.778 [Cloud] Queued cloud request. 2026-09-21T15:23:20.778 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T15:23:20.778 [Cloud] Dequeued cloud request. 2026-09-21T15:23:20.778 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T15:23:20.997 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06B555E3-E343-ED22-A613-FE1BEC9148F3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 15:23:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T15:23:21.497 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T15:26:24.716 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T15:26:24.716 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T15:26:24.716 [Cloud] Queued cloud request. 2026-09-21T15:26:24.716 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T15:26:24.716 [Cloud] Dequeued cloud request. 2026-09-21T15:26:24.716 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T15:26:24.904 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{032FB245-6B5D-09BA-D2A2-2E3B681A9A6C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 15:26:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T15:26:25.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T15:26:42.529 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T15:28:00.234 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T15:28:00.234 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T15:28:00.234 [Cloud] Queued cloud request. 2026-09-21T15:28:00.234 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T15:28:00.234 [Cloud] Dequeued cloud request. 2026-09-21T15:28:00.234 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T15:28:00.437 [Cloud] End of cloud request. 2026-09-21T15:28:00.953 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T15:29:20.359 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T15:29:20.359 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T15:29:20.359 [Cloud] Queued cloud request. 2026-09-21T15:29:20.359 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T15:29:20.562 [Cloud] Dequeued cloud request. 2026-09-21T15:29:20.562 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T15:29:20.734 [Cloud] End of cloud request. 2026-09-21T15:29:21.234 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T15:39:41.020 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 410206, Count: 36950, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 0% 2026-09-21T15:39:41.020 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 17020, Count: 1459, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-21T15:39:41.020 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 4243, Count: 430, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T15:39:41.020 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-21T15:39:41.020 ProcessImageName: AgentShellService.exe, Pid: 4816, TotalTime: 791, Count: 24, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 48% 2026-09-21T15:39:41.020 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 753, Count: 58, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-21T15:39:41.020 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-21T15:39:41.020 ProcessImageName: WmiPrvSE.exe, Pid: 6668, TotalTime: 285, Count: 32, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-21T15:39:41.020 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T15:39:41.020 ProcessImageName: powershell.exe, Pid: 2360, TotalTime: 232, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 21% 2026-09-21T15:39:41.020 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 210, Count: 76, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-21T15:39:41.020 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 19, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T15:39:41.020 ProcessImageName: python.exe, Pid: 7872, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-21T15:39:41.020 ProcessImageName: WmiPrvSE.exe, Pid: 8044, TotalTime: 106, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 1% 2026-09-21T15:39:41.020 ProcessImageName: taskhostw.exe, Pid: 7680, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-21T15:39:41.020 ProcessImageName: taskhostw.exe, Pid: 5900, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 6% 2026-09-21T15:39:41.020 ProcessImageName: DeviceCensus.exe, Pid: 3032, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-21T15:39:41.020 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-21T15:39:41.020 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-21T15:39:41.020 ProcessImageName: taskhostw.exe, Pid: 3032, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-21T15:39:41.020 ProcessImageName: powershell.exe, Pid: 6596, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-21T15:39:41.020 ProcessImageName: mysqldump.exe, Pid: 6644, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-21T15:39:41.020 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-21T15:39:41.020 ProcessImageName: cmd.exe, Pid: 1664, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-21T15:41:47.536 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T15:47:46.040 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T15:47:46.040 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T15:47:46.040 [Cloud] Queued cloud request. 2026-09-21T15:47:46.040 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T15:47:46.040 [Cloud] Dequeued cloud request. 2026-09-21T15:47:46.040 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T15:47:46.618 [Cloud] End of cloud request. 2026-09-21T15:47:47.118 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T15:47:50.134 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T15:47:50.134 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T15:47:50.134 [Cloud] Queued cloud request. 2026-09-21T15:47:50.134 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T15:47:50.134 [Cloud] Dequeued cloud request. 2026-09-21T15:47:50.134 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T15:47:50.212 [Cloud] End of cloud request. 2026-09-21T15:47:50.728 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T15:56:52.544 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T16:03:20.998 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T16:03:20.998 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T16:03:20.998 [Cloud] Queued cloud request. 2026-09-21T16:03:20.998 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T16:03:21.170 [Cloud] Dequeued cloud request. 2026-09-21T16:03:21.170 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T16:03:21.451 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E36F45CB-F2F5-F3AF-C320-5FBFF8BB308B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 16:03:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T16:03:21.967 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T16:11:57.550 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T16:13:51.675 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T16:13:51.675 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T16:13:51.675 [Cloud] Queued cloud request. 2026-09-21T16:13:51.675 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T16:13:51.675 [Cloud] Dequeued cloud request. 2026-09-21T16:13:51.675 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T16:13:51.862 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6EE124DB-F586-C108-5961-CFA8BF7465E6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 16:13:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T16:13:52.378 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T16:14:15.628 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T16:14:15.628 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T16:14:15.628 [Cloud] Queued cloud request. 2026-09-21T16:14:15.628 [Cloud] Dequeued cloud request. 2026-09-21T16:14:15.628 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T16:14:15.628 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T16:14:15.706 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{40BCAA0A-76A1-B6DA-7DCE-9D2E29272272} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 16:14:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T16:14:16.206 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T16:27:02.557 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T16:41:21.703 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T16:41:21.703 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T16:41:21.703 [Cloud] Queued cloud request. 2026-09-21T16:41:21.703 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T16:41:21.891 [Cloud] Dequeued cloud request. 2026-09-21T16:41:21.891 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T16:41:22.078 [Cloud] End of cloud request. 2026-09-21T16:41:22.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T16:42:07.564 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T16:44:23.143 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T16:44:23.143 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T16:44:23.143 [Cloud] Queued cloud request. 2026-09-21T16:44:23.143 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T16:44:23.143 [Cloud] Dequeued cloud request. 2026-09-21T16:44:23.143 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T16:44:23.330 [Cloud] End of cloud request. 2026-09-21T16:44:23.830 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T16:55:46.555 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T16:55:46.555 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T16:55:46.555 [Cloud] Queued cloud request. 2026-09-21T16:55:46.555 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T16:55:46.555 [Cloud] Dequeued cloud request. 2026-09-21T16:55:46.555 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T16:55:46.711 [Cloud] End of cloud request. 2026-09-21T16:55:47.226 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T16:56:35.117 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T16:56:35.117 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T16:56:35.117 [Cloud] Queued cloud request. 2026-09-21T16:56:35.117 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T16:56:35.117 [Cloud] Dequeued cloud request. 2026-09-21T16:56:35.117 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T16:56:35.195 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1D50E8AB-2690-70F0-6664-F97D8DFEB87A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 16:56:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T16:56:35.711 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T16:57:12.571 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T16:59:23.978 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T16:59:23.978 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T16:59:23.978 [Cloud] Queued cloud request. 2026-09-21T16:59:23.978 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T16:59:23.978 [Cloud] Dequeued cloud request. 2026-09-21T16:59:23.978 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T16:59:24.165 [Cloud] End of cloud request. 2026-09-21T16:59:24.681 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T17:01:42.276 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T17:01:42.276 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T17:01:42.276 [Cloud] Queued cloud request. 2026-09-21T17:01:42.276 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T17:01:42.276 [Cloud] Dequeued cloud request. 2026-09-21T17:01:42.276 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T17:01:42.432 [Cloud] End of cloud request. 2026-09-21T17:01:42.948 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T17:12:17.576 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T17:16:20.251 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T17:16:20.251 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T17:16:20.251 [Cloud] Queued cloud request. 2026-09-21T17:16:20.251 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T17:16:20.251 [Cloud] Dequeued cloud request. 2026-09-21T17:16:20.251 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T17:16:20.454 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{98E0C683-903B-544C-4178-31EA04E9E580} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 17:16:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T17:16:20.954 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T17:19:20.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T17:19:20.643 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T17:19:20.643 [Cloud] Queued cloud request. 2026-09-21T17:19:20.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T17:19:20.643 [Cloud] Dequeued cloud request. 2026-09-21T17:19:20.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T17:19:23.205 [Cloud] End of cloud request. 2026-09-21T17:19:23.705 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T17:27:22.583 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T17:39:41.074 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 411568, Count: 36981, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 0% 2026-09-21T17:39:41.074 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 19174, Count: 1635, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-21T17:39:41.074 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 4243, Count: 430, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T17:39:41.074 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-21T17:39:41.074 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 813, Count: 62, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-21T17:39:41.074 ProcessImageName: AgentShellService.exe, Pid: 4816, TotalTime: 791, Count: 24, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 48% 2026-09-21T17:39:41.074 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-21T17:39:41.074 ProcessImageName: WmiPrvSE.exe, Pid: 6668, TotalTime: 285, Count: 32, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-21T17:39:41.074 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T17:39:41.074 ProcessImageName: powershell.exe, Pid: 2360, TotalTime: 232, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 21% 2026-09-21T17:39:41.074 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 225, Count: 78, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-21T17:39:41.074 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 210, Count: 20, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T17:39:41.074 ProcessImageName: python.exe, Pid: 7872, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-21T17:39:41.074 ProcessImageName: WmiPrvSE.exe, Pid: 8044, TotalTime: 106, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 1% 2026-09-21T17:39:41.074 ProcessImageName: taskhostw.exe, Pid: 7680, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-21T17:39:41.074 ProcessImageName: taskhostw.exe, Pid: 5900, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 6% 2026-09-21T17:39:41.074 ProcessImageName: DeviceCensus.exe, Pid: 3032, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-21T17:39:41.074 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-21T17:39:41.074 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-21T17:39:41.074 ProcessImageName: taskhostw.exe, Pid: 3032, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-21T17:39:41.074 ProcessImageName: powershell.exe, Pid: 6596, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-21T17:39:41.074 ProcessImageName: mysqldump.exe, Pid: 6644, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-21T17:39:41.074 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-21T17:39:41.074 ProcessImageName: cmd.exe, Pid: 1664, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-21T17:41:48.840 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T17:41:48.840 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T17:41:48.840 [Cloud] Queued cloud request. 2026-09-21T17:41:48.840 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T17:41:48.840 [Cloud] Dequeued cloud request. 2026-09-21T17:41:48.840 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T17:41:49.074 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CE215B67-0AE2-0ABE-BB58-87C116090A04} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 17:41:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T17:41:49.574 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T17:42:27.590 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T17:51:59.220 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T17:51:59.220 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T17:51:59.220 [Cloud] Queued cloud request. 2026-09-21T17:51:59.220 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T17:51:59.376 [Cloud] Dequeued cloud request. 2026-09-21T17:51:59.532 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T17:51:59.735 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{77A77237-1B21-7FFF-9892-9D039C95A500} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 17:51:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T17:52:00.235 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T17:57:32.597 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T18:12:37.602 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T18:17:08.918 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T18:17:08.918 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T18:17:08.918 [Cloud] Queued cloud request. 2026-09-21T18:17:08.918 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T18:17:08.918 [Cloud] Dequeued cloud request. 2026-09-21T18:17:08.918 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T18:17:09.121 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{14BC9ABD-6815-DA26-DE17-29835B2386FC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 18:17:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T18:17:09.621 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T18:23:15.437 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T18:23:15.437 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T18:23:15.437 [Cloud] Queued cloud request. 2026-09-21T18:23:15.437 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T18:23:15.437 [Cloud] Dequeued cloud request. 2026-09-21T18:23:15.437 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T18:23:15.624 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{56498FF9-FF05-9003-17F5-F60A018FADC1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 18:23:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T18:23:16.124 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T18:24:16.484 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T18:24:16.484 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T18:24:16.484 [Cloud] Queued cloud request. 2026-09-21T18:24:16.484 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T18:24:16.484 [Cloud] Dequeued cloud request. 2026-09-21T18:24:16.484 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T18:24:16.671 [Cloud] End of cloud request. 2026-09-21T18:24:17.171 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T18:27:11.484 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T18:27:11.484 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T18:27:11.484 [Cloud] Queued cloud request. 2026-09-21T18:27:11.484 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T18:27:11.702 [Cloud] Dequeued cloud request. 2026-09-21T18:27:11.702 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T18:27:11.984 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FB70BF68-FC22-8C0F-786D-7AEB628480E4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 18:27:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T18:27:12.499 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T18:27:42.611 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T18:42:47.616 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T18:44:11.196 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T18:44:11.196 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T18:44:11.196 [Cloud] Queued cloud request. 2026-09-21T18:44:11.196 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T18:44:11.196 [Cloud] Dequeued cloud request. 2026-09-21T18:44:11.196 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T18:44:11.368 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EA41272A-8852-7F5C-546B-E077DB1250C7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 18:44:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T18:44:11.868 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T18:53:52.714 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T18:53:52.714 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T18:53:52.714 [Cloud] Queued cloud request. 2026-09-21T18:53:52.714 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T18:53:52.714 [Cloud] Dequeued cloud request. 2026-09-21T18:53:52.714 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T18:53:52.855 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8D078BC-6C95-310E-8022-F52A3071C71C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 18:53:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T18:53:53.355 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T18:57:52.624 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T19:03:55.016 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T19:03:55.016 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T19:03:55.016 [Cloud] Queued cloud request. 2026-09-21T19:03:55.016 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T19:03:55.016 [Cloud] Dequeued cloud request. 2026-09-21T19:03:55.016 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T19:03:55.172 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C65917A4-4586-058E-1249-EDF120D69213} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 19:03:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T19:03:55.672 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T19:12:57.629 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T19:17:46.196 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T19:17:46.196 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T19:17:46.196 [Cloud] Queued cloud request. 2026-09-21T19:17:46.196 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T19:17:46.196 [Cloud] Dequeued cloud request. 2026-09-21T19:17:46.196 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T19:17:46.352 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2A5D147C-E575-CEC2-F05E-763628B6E3B4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 19:17:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T19:17:46.867 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T19:19:24.430 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T19:19:24.430 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T19:19:24.430 [Cloud] Queued cloud request. 2026-09-21T19:19:24.430 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T19:19:24.430 [Cloud] Dequeued cloud request. 2026-09-21T19:19:24.430 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T19:19:34.508 [Cloud] End of cloud request. 2026-09-21T19:19:35.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T19:20:06.914 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T19:20:06.914 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T19:20:06.914 [Cloud] Queued cloud request. 2026-09-21T19:20:06.914 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T19:20:06.914 [Cloud] Dequeued cloud request. 2026-09-21T19:20:06.914 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T19:20:06.993 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EFC61EAF-419D-2739-C4D9-810FEC330C3E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 19:20:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T19:20:07.508 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T19:28:02.638 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T19:39:12.642 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-21T19:39:12.674 Job Notification: New process added to job (4964) 2026-09-21T19:39:12.674 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-21T19:39:12.674 Job Notification: New process added to job (3080) 2026-09-21T19:39:12.689 Aggressive catchup quick scan threshold: 660046734589 / 25920000000000 2026-09-21T19:39:12.689 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:4964] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:3080]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-21T19:39:12.830 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-21T19:39:12.830 Job Notification: New process added to job (6484) 2026-09-21T19:39:12.846 Job Notification: New process added to job (4160) 2026-09-21T19:39:12.908 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:6484] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:4160]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-21T19:39:13.026 Job Notification: New process added to job (568) 2026-09-21T19:39:13.049 Task(GetDeviceTicket -AccessKey F9E8FD9F-D8F6-109D-B34A-D6542B06F139 ) launched as network service 2026-09-21T19:39:13.205 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-21T19:39:13.226 [RTP] Duplicating the current plugin configuration object... 2026-09-21T19:39:13.226 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-21T19:39:13.226 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-21T19:39:13.226 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-21T19:39:13.226 [RTP] No config change detected. Not updating plugin configuration. 2026-09-21T19:39:13.226 [RTP] No config changes found. No configuration switch. 2026-09-21T19:39:13.226 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-21T19:39:13.736 Job Notification: Process exited from job (568) 2026-09-21T19:39:13.892 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-21T19:39:13.892 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T19:39:13.892 [Cloud] Queued cloud request. 2026-09-21T19:39:13.892 [Cloud] Dequeued cloud request. 2026-09-21T19:39:13.892 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T19:39:14.049 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-21T19:39:14.049 [Cloud] End of cloud request. 2026-09-21T19:39:14.408 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T19:39:28.142 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\5864AF39-EC28-49FD-8246-20E00B1B54FC1c3c.1dd4a00e8afc77c 2026-09-21T19:39:28.221 Verifying engine and signature files (source: 0) ... 2026-09-21T19:39:28.221 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C}\mpengine.dll] due to PPL. 2026-09-21T19:39:28.221 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C}\mpasbase.vdm]. File not in cache (0x1) 2026-09-21T19:39:29.189 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C}\mpasbase.vdm] 2026-09-21T19:39:29.189 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-21T19:39:29.205 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C}\mpasdlta.vdm] 2026-09-21T19:39:29.205 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C}\mpavbase.vdm]. File not in cache (0x1) 2026-09-21T19:39:29.705 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C}\mpavbase.vdm] 2026-09-21T19:39:29.705 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-21T19:39:29.721 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C}\mpavdlta.vdm] 2026-09-21T19:39:29.924 [Engine] IsHybridMode: 0 2026-09-21T19:39:29.924 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-21T19:39:29.924 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-B9A83C79E2B6287AC476D000603B8BA6FAF4F13F.bin): 0x00000002 2026-09-21T19:39:29.924 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-B9A83C79E2B6287AC476D000603B8BA6FAF4F13F.bin) 2026-09-21T19:39:29.924 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-21T19:39:29.924 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-21T19:39:29.924 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-21T19:39:29.924 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff 2026-09-21T19:39:41.143 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 412391, Count: 37028, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 0% 2026-09-21T19:39:41.143 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 21231, Count: 1807, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-21T19:39:41.143 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 4243, Count: 430, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T19:39:41.143 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-21T19:39:41.143 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 904, Count: 69, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-21T19:39:41.143 ProcessImageName: AgentShellService.exe, Pid: 4816, TotalTime: 791, Count: 24, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 48% 2026-09-21T19:39:41.143 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-21T19:39:41.143 ProcessImageName: WmiPrvSE.exe, Pid: 6668, TotalTime: 285, Count: 32, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-21T19:39:41.143 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T19:39:41.143 ProcessImageName: powershell.exe, Pid: 2360, TotalTime: 232, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 21% 2026-09-21T19:39:41.143 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 225, Count: 78, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-21T19:39:41.143 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 225, Count: 21, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T19:39:41.143 ProcessImageName: python.exe, Pid: 7872, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-21T19:39:41.143 ProcessImageName: WmiPrvSE.exe, Pid: 8044, TotalTime: 106, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 1% 2026-09-21T19:39:41.143 ProcessImageName: taskhostw.exe, Pid: 7680, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-21T19:39:41.143 ProcessImageName: taskhostw.exe, Pid: 5900, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 6% 2026-09-21T19:39:41.143 ProcessImageName: DeviceCensus.exe, Pid: 3032, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-21T19:39:41.143 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-21T19:39:41.143 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-21T19:39:41.143 ProcessImageName: taskhostw.exe, Pid: 3032, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-21T19:39:41.143 ProcessImageName: powershell.exe, Pid: 6596, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-21T19:39:41.143 ProcessImageName: mysqldump.exe, Pid: 6644, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 11% 2026-09-21T19:39:41.143 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-21T19:39:41.143 ProcessImageName: cmd.exe, Pid: 1664, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-21T19:39:42.533 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-21T19:39:42.533 [AutoExclusion] Applied roles from cache. 2026-09-21T19:39:42.533 [AutoExclusion] Started roles monitoring. 2026-09-21T19:39:42.674 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF4ABB020, lRefCount: 6, hr=0 2026-09-21T19:39:42.674 [Engine] New active engine 00007FFCF68AB020 replacing engine 00007FFCF4ABB020. Number of active engines: 2 2026-09-21T19:39:42.689 EngineInit:Global ASOC is enabled 2026-09-21T19:39:42.689 EngineInit:ASOO is enabled for developer volumes 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.830 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-21T19:39:42.861 MpWriteUupSignatureVersion 1.459.324.0, hr = 0 2026-09-21T19:39:42.861 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-21T19:39:42.893 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-21T19:39:42.893 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-21T19:39:42.893 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-21T19:39:42.893 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-21T19:39:42.908 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-21T19:39:42.908 [Plugin] Initializing RTP plugin state... 2026-09-21T19:39:42.908 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-21T19:39:42.908 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎20‎-‎2026 21:39:41 Last Perf:‎09‎-‎20‎-‎2026 21:39:40 First RTP Scan:‎09‎-‎20‎-‎2026 21:39:41 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:9042 Misses:23261 BM Queue:0,228,0 Proc:0,82,0 File:0,226,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:1508912 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:346585992 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:7133 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:119204 TotalHits:809167 InstanceCacheInserts:30257 InstanceCacheUpdates:0 InstanceCacheDeletes:16665 InstanceCacheHits:637 InstanceCacheMisses:87782 InstanceCacheOverflows:12907 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:5ms (9111/1573) Success: 1573, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-21T19:39:42.908 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C} 2026-09-21T19:39:42.908 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BD6A165E-B98D-4DB5-8588-09948CFD4EAE} removed 2026-09-21T19:39:42.908 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8}\mpasbase.vdm in use, hr=0x80070020 2026-09-21T19:39:42.924 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-21T19:39:42.924 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-21T19:39:42.924 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-21T19:39:42.924 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-21T19:39:42.924 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-21T19:39:42.924 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-21-2026 19:39:42 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-21-2026 19:39:42 2026-09-21T19:39:42.924 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-21T19:39:42.924 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-21T19:39:42.924 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-21T19:39:42.924 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-21T19:39:42.924 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T19:39:42.924 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-21T19:39:42.924 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-21T19:39:42.924 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-21T19:39:42.924 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-21T19:39:42.924 MdCoreSvc is supported in this platform and OS Signature updated on 09-21-2026 19:39:42 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.324.0 AV Signature Version: 1.459.324.0 ************************************************************ 2026-09-21T19:39:42.939 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-21T19:39:42.939 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\5864AF39-EC28-49FD-8246-20E00B1B54FC1c3c.1dd4a00e8afc77c 2026-09-21T19:39:42.971 Process scan (postsignatureupdatescan) started. 2026-09-21T19:39:43.002 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-21T19:39:43.002 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-21-2026 19:39:43 ************************************************************ 2026-09-21T19:39:43.325 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-21T19:39:43.325 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-21T19:39:43.325 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-21T19:39:43.325 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-21T19:39:43.325 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-21T19:39:43.330 Job Notification: Process exited from job (6484) 2026-09-21T19:39:43.330 Job Notification: Process exited from job (4160) 2026-09-21T19:39:43.346 [Engine] Engine 00007FFCF4ABB020 no longer in use. Number of active engines: 1 2026-09-21T19:39:43.346 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-21T19:39:43.346 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-21T19:39:43.377 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-21T19:39:43.377 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-21T19:39:43.377 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-21T19:39:43.830 Job Notification: Process exited from job (4964) 2026-09-21T19:39:43.830 Job Notification: Process exited from job (3080) 2026-09-21T19:39:43.955 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 412391, Count: 37028, MaxTime: 1468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 0% 2026-09-21T19:39:43.955 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 21231, Count: 1807, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-21T19:39:43.955 ProcessImageName: AgentShell.exe, Pid: 6760, TotalTime: 4243, Count: 430, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T19:39:43.955 ProcessImageName: powershell.exe, Pid: 5568, TotalTime: 1524, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 27% 2026-09-21T19:39:43.955 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 904, Count: 69, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-21T19:39:43.955 ProcessImageName: AgentShellService.exe, Pid: 4816, TotalTime: 791, Count: 24, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 48% 2026-09-21T19:39:43.955 ProcessImageName: WmiPrvSE.exe, Pid: 6512, TotalTime: 556, Count: 15, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 68% 2026-09-21T19:39:43.955 ProcessImageName: WmiPrvSE.exe, Pid: 6668, TotalTime: 285, Count: 32, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\INF\rdpbus.inf, EstimatedImpact: 35% 2026-09-21T19:39:43.955 ProcessImageName: WmiPrvSE.exe, Pid: 7204, TotalTime: 233, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T19:39:43.955 ProcessImageName: powershell.exe, Pid: 2360, TotalTime: 232, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 21% 2026-09-21T19:39:43.955 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 225, Count: 78, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1b7ee-1.MAI, EstimatedImpact: 0% 2026-09-21T19:39:43.955 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 225, Count: 21, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T19:39:43.955 ProcessImageName: python.exe, Pid: 7872, TotalTime: 120, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-21T19:39:43.955 ProcessImageName: WmiPrvSE.exe, Pid: 8044, TotalTime: 106, Count: 12, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 1% 2026-09-21T19:39:44.033 [Engine] RSIG_UNLOADENGINE, 00007FFCF4ABB020, err=0x0 2026-09-21T19:39:44.064 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DBF911BD-8562-4959-83FC-B69F666D7CA8} removed 2026-09-21T19:39:57.502 Process scan (postsignatureupdatescan) completed. 2026-09-21T19:43:07.643 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T19:44:42.721 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-21T19:49:47.599 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T19:49:47.599 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T19:49:47.599 [Cloud] Queued cloud request. 2026-09-21T19:49:47.599 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T19:49:47.599 [Cloud] Dequeued cloud request. 2026-09-21T19:49:47.599 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T19:49:47.787 [Cloud] End of cloud request. 2026-09-21T19:49:48.303 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T19:52:49.724 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T19:52:49.724 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T19:52:49.724 [Cloud] Queued cloud request. 2026-09-21T19:52:49.724 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T19:52:49.724 [Cloud] Dequeued cloud request. 2026-09-21T19:52:49.724 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T19:52:49.912 [Cloud] End of cloud request. 2026-09-21T19:52:50.428 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T19:55:10.695 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T19:55:10.695 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T19:55:10.695 [Cloud] Queued cloud request. 2026-09-21T19:55:10.695 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T19:55:10.695 [Cloud] Dequeued cloud request. 2026-09-21T19:55:10.695 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T19:55:10.929 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8A539252-C1FC-F238-1E93-17317B97B7C1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 19:55:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T19:55:11.445 [NRI] Successfully updated NIS service with platform settings for enforcement level Log IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-21T19:55:12.039 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T19:55:12.086 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-21T19:55:12.086 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-21T19:55:12.086 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-21T19:55:12.101 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T19:55:12.101 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-21T19:55:12.101 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-21T19:55:12.101 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-21T19:55:12.101 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-21T19:55:12.101 MdCoreSvc is supported in this platform and OS 2026-09-21T19:55:12.539 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-21T19:55:12.539 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-21T19:55:12.539 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-21T19:57:15.195 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T19:57:15.195 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T19:57:15.195 [Cloud] Queued cloud request. 2026-09-21T19:57:15.195 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T19:57:15.195 [Cloud] Dequeued cloud request. 2026-09-21T19:57:15.195 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T19:57:15.382 [Cloud] End of cloud request. 2026-09-21T19:57:15.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T19:58:12.651 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T20:03:10.511 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T20:03:10.511 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T20:03:10.511 [Cloud] Queued cloud request. 2026-09-21T20:03:10.511 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T20:03:10.511 [Cloud] Dequeued cloud request. 2026-09-21T20:03:10.511 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T20:03:10.698 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C25249F8-D8B4-8165-7D23-149A686C7D9E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 20:03:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T20:03:11.198 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T20:07:50.046 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T20:07:50.046 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T20:07:50.046 [Cloud] Queued cloud request. 2026-09-21T20:07:50.046 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T20:07:50.249 [Cloud] Dequeued cloud request. 2026-09-21T20:07:50.249 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T20:07:50.421 [Cloud] End of cloud request. 2026-09-21T20:07:50.921 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T20:13:17.655 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T20:17:21.674 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T20:17:21.674 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T20:17:21.674 [Cloud] Queued cloud request. 2026-09-21T20:17:21.674 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T20:17:21.674 [Cloud] Dequeued cloud request. 2026-09-21T20:17:21.674 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T20:17:21.831 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{368C97D8-C177-C211-3248-EA3D3EBD175F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 20:17:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T20:17:22.346 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T20:25:38.786 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T20:25:38.786 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T20:25:38.786 [Cloud] Queued cloud request. 2026-09-21T20:25:38.786 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T20:25:38.943 [Cloud] Dequeued cloud request. 2026-09-21T20:25:38.943 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T20:25:39.083 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4F060F1E-2D62-A0A9-E1E8-6237195B5D63} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 20:25:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T20:25:39.599 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T20:28:22.664 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T20:30:18.039 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T20:30:18.039 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T20:30:18.039 [Cloud] Queued cloud request. 2026-09-21T20:30:18.039 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T20:30:18.289 [Cloud] Dequeued cloud request. 2026-09-21T20:30:18.289 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T20:30:18.508 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B84965B7-007A-C34C-98BC-3B7A5E6024CC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 20:30:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T20:30:19.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T20:37:07.401 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T20:37:07.401 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T20:37:07.401 [Cloud] Queued cloud request. 2026-09-21T20:37:07.401 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T20:37:07.401 [Cloud] Dequeued cloud request. 2026-09-21T20:37:07.401 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T20:37:07.589 [Cloud] End of cloud request. 2026-09-21T20:37:08.089 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T20:40:08.106 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T20:40:08.106 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T20:40:08.106 [Cloud] Queued cloud request. 2026-09-21T20:40:08.106 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T20:40:08.106 [Cloud] Dequeued cloud request. 2026-09-21T20:40:08.106 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T20:40:08.309 [Cloud] End of cloud request. 2026-09-21T20:40:08.809 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T20:43:27.670 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T20:50:11.127 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T20:50:11.127 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T20:50:11.127 [Cloud] Queued cloud request. 2026-09-21T20:50:11.127 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T20:50:11.127 [Cloud] Dequeued cloud request. 2026-09-21T20:50:11.127 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T20:50:11.346 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3520FF96-5C30-CFB0-3ACB-38207CA451D3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 20:50:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T20:50:11.861 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T20:58:32.677 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T21:03:13.054 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T21:03:13.054 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T21:03:13.054 [Cloud] Queued cloud request. 2026-09-21T21:03:13.054 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T21:03:13.054 [Cloud] Dequeued cloud request. 2026-09-21T21:03:13.054 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T21:03:13.382 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8A9949D8-FCE6-608F-CA5C-5939BA9BD3AF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 21:03:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T21:03:13.882 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T21:07:51.149 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T21:07:51.149 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T21:07:51.149 [Cloud] Queued cloud request. 2026-09-21T21:07:51.149 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T21:07:51.149 [Cloud] Dequeued cloud request. 2026-09-21T21:07:51.149 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{02853821-9825-3D8B-DBB4-ECBBC91614A0} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 21:07:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T21:07:58.915 [Cloud] End of cloud request. 2026-09-21T21:07:59.430 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T21:13:23.493 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T21:13:23.493 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T21:13:23.493 [Cloud] Queued cloud request. 2026-09-21T21:13:23.493 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T21:13:23.711 [Cloud] Dequeued cloud request. 2026-09-21T21:13:23.711 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T21:13:23.899 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C8A38729-0024-318B-E71B-D950138C8848} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 21:13:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T21:13:24.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T21:13:37.680 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T21:15:03.071 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T21:15:03.071 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T21:15:03.071 [Cloud] Queued cloud request. 2026-09-21T21:15:03.071 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T21:15:03.071 [Cloud] Dequeued cloud request. 2026-09-21T21:15:03.071 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T21:15:03.227 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CF9E8AD1-1183-4B76-855F-69CC9E6C27C4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 21:15:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T21:15:03.727 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T21:28:42.690 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T21:39:42.742 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2407, Count: 160, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\misc.php, EstimatedImpact: 0% 2026-09-21T21:39:42.742 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 2199, Count: 187, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T21:39:42.742 ProcessImageName: powershell.exe, Pid: 7380, TotalTime: 1353, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-21T21:39:42.742 ProcessImageName: powershell.exe, Pid: 3172, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-21T21:39:42.742 ProcessImageName: WmiPrvSE.exe, Pid: 7068, TotalTime: 248, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T21:39:42.742 ProcessImageName: python.exe, Pid: 6972, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-21T21:39:42.742 ProcessImageName: taskhostw.exe, Pid: 5396, TotalTime: 108, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-21T21:39:42.742 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 105, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-21T21:39:42.742 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T21:39:42.742 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-21T21:39:42.742 ProcessImageName: ngentask.exe, Pid: 7296, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-21T21:43:47.697 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T21:48:10.027 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T21:48:10.027 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T21:48:10.027 [Cloud] Queued cloud request. 2026-09-21T21:48:10.027 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T21:48:10.027 [Cloud] Dequeued cloud request. 2026-09-21T21:48:10.027 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T21:48:10.215 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4BEBE072-9FEB-CD21-E611-09D7C605D203} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 21:48:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T21:48:10.715 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T21:48:42.059 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T21:48:42.059 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T21:48:42.059 [Cloud] Queued cloud request. 2026-09-21T21:48:42.059 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T21:48:42.059 [Cloud] Dequeued cloud request. 2026-09-21T21:48:42.059 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T21:48:42.137 [Cloud] End of cloud request. 2026-09-21T21:48:42.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T21:51:34.715 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T21:51:34.715 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T21:51:34.715 [Cloud] Queued cloud request. 2026-09-21T21:51:34.715 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T21:51:34.715 [Cloud] Dequeued cloud request. 2026-09-21T21:51:34.715 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T21:51:34.903 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5C0EDFE8-EF30-A8E1-1DF6-996B0F4E913F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 21:51:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T21:51:35.403 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T21:55:28.795 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T21:55:28.795 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T21:55:28.795 [Cloud] Queued cloud request. 2026-09-21T21:55:28.795 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T21:55:28.795 [Cloud] Dequeued cloud request. 2026-09-21T21:55:28.795 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T21:55:28.983 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E1029B7D-CA32-8168-0879-CCEBA1B1997A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 21:55:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T21:55:29.498 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T21:56:11.421 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T21:56:11.421 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T21:56:11.421 [Cloud] Queued cloud request. 2026-09-21T21:56:11.421 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T21:56:11.421 [Cloud] Dequeued cloud request. 2026-09-21T21:56:11.421 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T21:56:11.499 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E4BFD1B1-38E3-F87E-1BF3-7CE25493DC78} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 21:56:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T21:56:11.999 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T21:58:52.703 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T22:13:57.708 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T22:17:33.430 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T22:17:33.430 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T22:17:33.430 [Cloud] Queued cloud request. 2026-09-21T22:17:33.430 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T22:17:33.430 [Cloud] Dequeued cloud request. 2026-09-21T22:17:33.430 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T22:17:33.571 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D5AF81C2-0061-9AB5-422F-302DFC7E6685} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 22:17:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T22:17:34.071 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T22:21:18.696 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T22:21:18.696 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T22:21:18.696 [Cloud] Queued cloud request. 2026-09-21T22:21:18.696 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T22:21:18.696 [Cloud] Dequeued cloud request. 2026-09-21T22:21:18.696 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T22:21:19.306 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D148F447-B722-ABF6-D73E-E6EB0B6EAF24} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 22:21:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T22:21:19.821 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T22:29:02.716 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T22:44:07.723 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T22:48:00.037 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T22:48:00.037 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T22:48:00.037 [Cloud] Queued cloud request. 2026-09-21T22:48:00.037 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T22:48:00.037 [Cloud] Dequeued cloud request. 2026-09-21T22:48:00.037 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T22:48:00.240 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4A694C1F-A5E4-638B-95C9-7D46FDF93A3B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 22:48:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T22:48:00.740 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T22:50:00.287 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T22:50:00.287 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T22:50:00.287 [Cloud] Queued cloud request. 2026-09-21T22:50:00.287 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T22:50:00.287 [Cloud] Dequeued cloud request. 2026-09-21T22:50:00.287 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T22:50:00.475 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{31674C13-DE5D-2C3C-FD6C-53127308B4BA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 22:50:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T22:50:00.975 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T22:51:20.382 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T22:51:20.382 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T22:51:20.382 [Cloud] Queued cloud request. 2026-09-21T22:51:20.382 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T22:51:20.382 [Cloud] Dequeued cloud request. 2026-09-21T22:51:20.382 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T22:51:20.569 [Cloud] End of cloud request. 2026-09-21T22:51:21.085 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T22:55:43.757 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T22:55:43.757 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T22:55:43.757 [Cloud] Queued cloud request. 2026-09-21T22:55:43.757 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T22:55:43.757 [Cloud] Dequeued cloud request. 2026-09-21T22:55:43.757 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T22:55:53.882 [Cloud] End of cloud request. 2026-09-21T22:55:54.382 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T22:59:12.729 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T23:14:17.735 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T23:14:23.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T23:14:23.657 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T23:14:23.657 [Cloud] Queued cloud request. 2026-09-21T23:14:23.657 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T23:14:23.657 [Cloud] Dequeued cloud request. 2026-09-21T23:14:23.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T23:14:23.845 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{30060A07-A9E9-FE31-4859-898D0A266290} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 23:14:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T23:14:24.345 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T23:20:19.769 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T23:20:19.769 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T23:20:19.769 [Cloud] Queued cloud request. 2026-09-21T23:20:19.769 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T23:20:19.769 [Cloud] Dequeued cloud request. 2026-09-21T23:20:19.769 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T23:20:19.956 [Cloud] End of cloud request. 2026-09-21T23:20:20.456 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T23:23:21.583 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T23:23:21.583 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T23:23:21.583 [Cloud] Queued cloud request. 2026-09-21T23:23:21.583 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T23:23:21.755 [Cloud] Dequeued cloud request. 2026-09-21T23:23:21.755 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T23:23:21.927 [Cloud] End of cloud request. 2026-09-21T23:23:22.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T23:29:22.742 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T23:32:19.351 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T23:32:19.351 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T23:32:19.351 [Cloud] Queued cloud request. 2026-09-21T23:32:19.351 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T23:32:19.586 [Cloud] Dequeued cloud request. 2026-09-21T23:32:19.586 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T23:32:19.789 [Cloud] End of cloud request. 2026-09-21T23:32:20.304 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T23:33:36.976 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T23:33:36.976 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T23:33:36.976 [Cloud] Queued cloud request. 2026-09-21T23:33:36.976 [Cloud] Dequeued cloud request. 2026-09-21T23:33:36.976 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T23:33:36.976 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T23:33:37.164 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{571D714D-EDF7-D7CE-B06F-9561F7E18CFB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 23:33:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T23:33:37.679 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T23:37:25.136 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T23:37:25.136 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T23:37:25.136 [Cloud] Queued cloud request. 2026-09-21T23:37:25.136 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T23:37:25.136 [Cloud] Dequeued cloud request. 2026-09-21T23:37:25.136 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T23:37:25.323 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AEDFC75A-E697-C07D-6772-9F601A55B298} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 23:37:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T23:37:25.823 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T23:38:22.699 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T23:38:22.699 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T23:38:22.699 [Cloud] Queued cloud request. 2026-09-21T23:38:22.699 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T23:38:22.699 [Cloud] Dequeued cloud request. 2026-09-21T23:38:22.871 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T23:38:22.949 [Cloud] End of cloud request. 2026-09-21T23:38:23.465 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T23:39:42.793 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 4525, Count: 369, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-21T23:39:42.793 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 3216, Count: 197, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\misc.php, EstimatedImpact: 0% 2026-09-21T23:39:42.793 ProcessImageName: powershell.exe, Pid: 7380, TotalTime: 1353, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-21T23:39:42.793 ProcessImageName: powershell.exe, Pid: 3172, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-21T23:39:42.793 ProcessImageName: WmiPrvSE.exe, Pid: 7068, TotalTime: 248, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-21T23:39:42.793 ProcessImageName: python.exe, Pid: 6972, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-21T23:39:42.793 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-21T23:39:42.793 ProcessImageName: taskhostw.exe, Pid: 5396, TotalTime: 108, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-21T23:39:42.793 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-21T23:39:42.793 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-21T23:39:42.793 ProcessImageName: ngentask.exe, Pid: 7296, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-21T23:40:49.996 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T23:40:49.996 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T23:40:49.996 [Cloud] Queued cloud request. 2026-09-21T23:40:49.996 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T23:40:49.996 [Cloud] Dequeued cloud request. 2026-09-21T23:40:49.996 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T23:40:50.183 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{00A7EFFC-E68E-4B9B-9422-0262C1285670} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 23:40:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T23:40:50.699 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T23:44:27.748 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-21T23:53:26.298 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-21T23:53:26.298 [Cloud] Start of cloud request. Passive mode: 0 2026-09-21T23:53:26.298 [Cloud] Queued cloud request. 2026-09-21T23:53:26.298 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-21T23:53:26.455 [Cloud] Dequeued cloud request. 2026-09-21T23:53:26.455 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-21T23:53:26.627 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0BA1F867-47D9-FCB2-0A65-BA92C842E6C6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-21-2026 23:53:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-21T23:53:27.127 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-21T23:59:32.754 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T00:08:39.899 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T00:08:39.899 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T00:08:39.899 [Cloud] Queued cloud request. 2026-09-22T00:08:39.899 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T00:08:39.899 [Cloud] Dequeued cloud request. 2026-09-22T00:08:39.899 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T00:08:40.055 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3053B0A0-B435-66DD-6F87-4D4DCBC3A78D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 00:08:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T00:08:40.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T00:14:21.636 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T00:14:21.636 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T00:14:21.636 [Cloud] Queued cloud request. 2026-09-22T00:14:21.636 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T00:14:21.636 [Cloud] Dequeued cloud request. 2026-09-22T00:14:21.636 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T00:14:21.807 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D483C82E-218D-7E53-680C-955CF23E1B2E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 00:14:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T00:14:22.307 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T00:14:37.761 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T00:18:43.091 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T00:18:43.091 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T00:18:43.091 [Cloud] Queued cloud request. 2026-09-22T00:18:43.091 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T00:18:43.091 [Cloud] Dequeued cloud request. 2026-09-22T00:18:43.091 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T00:18:43.232 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FF90CC9E-E768-821C-2214-2B2E555DBF6E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 00:18:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T00:18:43.747 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T00:29:06.002 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T00:29:06.002 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T00:29:06.002 [Cloud] Queued cloud request. 2026-09-22T00:29:06.002 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T00:29:06.002 [Cloud] Dequeued cloud request. 2026-09-22T00:29:06.002 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T00:29:06.158 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{02815FFF-7CD7-6E13-F632-355884B456D1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 00:29:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T00:29:06.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T00:29:42.767 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T00:35:35.566 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T00:35:35.566 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T00:35:35.566 [Cloud] Queued cloud request. 2026-09-22T00:35:35.566 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T00:35:35.566 [Cloud] Dequeued cloud request. 2026-09-22T00:35:35.566 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T00:35:35.722 [Cloud] End of cloud request. 2026-09-22T00:35:36.222 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T00:44:47.772 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T00:46:20.196 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T00:46:20.196 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T00:46:20.196 [Cloud] Queued cloud request. 2026-09-22T00:46:20.196 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T00:46:20.196 [Cloud] Dequeued cloud request. 2026-09-22T00:46:20.196 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T00:46:30.290 [Cloud] End of cloud request. 2026-09-22T00:46:30.790 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T00:48:29.744 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T00:48:29.744 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T00:48:29.744 [Cloud] Queued cloud request. 2026-09-22T00:48:29.744 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T00:48:29.744 [Cloud] Dequeued cloud request. 2026-09-22T00:48:29.744 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T00:48:29.885 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{262640E8-515A-2864-4174-70C06D0476F8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 00:48:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T00:48:30.385 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T00:55:47.464 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T00:55:47.464 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T00:55:47.464 [Cloud] Queued cloud request. 2026-09-22T00:55:47.464 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T00:55:47.464 [Cloud] Dequeued cloud request. 2026-09-22T00:55:47.464 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T00:55:47.620 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{695E49E6-032C-9F7A-5CB0-8DC647EEDE29} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 00:55:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T00:55:48.120 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T00:59:47.686 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T00:59:47.686 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T00:59:47.686 [Cloud] Queued cloud request. 2026-09-22T00:59:47.686 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T00:59:47.686 [Cloud] Dequeued cloud request. 2026-09-22T00:59:47.686 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T00:59:47.843 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1A3F300B-06FA-CD6D-1F6F-CA2506C4FB69} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 00:59:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T00:59:48.358 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T00:59:52.780 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T01:00:02.061 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617058, FileId: 0x2c00000002115d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.061 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617057, FileId: 0x410000000311f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.077 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617065, FileId: 0x430000000311f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.077 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617064, FileId: 0x2e00000002115d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.093 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617071, FileId: 0x3000000002115d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.093 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617070, FileId: 0x450000000311f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.108 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617076, FileId: 0x470000000311f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.108 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617077, FileId: 0x3200000002115d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.108 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617083, FileId: 0x3400000002115d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.124 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617082, FileId: 0x490000000311f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.124 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617088, FileId: 0x4b0000000311f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.124 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617089, FileId: 0x3600000002115d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.155 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617094, FileId: 0x3800000002115d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.155 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617095, FileId: 0x4d0000000311f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.171 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617101, FileId: 0x3a00000002115d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.171 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617100, FileId: 0x4f0000000311f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.171 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617106, FileId: 0x510000000311f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.171 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617107, FileId: 0x3c00000002115d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.186 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617112, FileId: 0x530000000311f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.186 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617113, FileId: 0x3e00000002115d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.202 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617118, FileId: 0x4000000002115d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.202 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617119, FileId: 0x550000000311f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.218 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617124, FileId: 0x570000000311f2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:00:02.218 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e2db-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1617125, FileId: 0x4200000002115d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T01:04:57.421 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T01:04:57.421 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T01:04:57.421 [Cloud] Queued cloud request. 2026-09-22T01:04:57.421 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T01:04:57.421 [Cloud] Dequeued cloud request. 2026-09-22T01:04:57.421 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T01:04:57.577 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9EF83C3A-02E5-8E96-C4DD-2FAAEDCBAC0F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 01:04:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T01:04:58.077 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T01:05:26.641 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T01:05:26.641 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T01:05:26.641 [Cloud] Queued cloud request. 2026-09-22T01:05:26.641 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T01:05:26.641 [Cloud] Dequeued cloud request. 2026-09-22T01:05:26.641 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T01:05:27.000 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FD9BCE6C-25D5-BFC2-B321-B57F2441D40A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 01:05:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T01:05:27.516 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T01:14:57.784 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T01:19:07.835 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:35634835-69E8-4A26-9E9D-7BE7D69C8A90, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-22T01:19:07.835 Scheduled scan with Id 35634835-69E8-4A26-9E9D-7BE7D69C8A90 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-22T01:19:07.851 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-22T01:19:07.851 [SFC] System file cache build is not needed (already completed) 2026-09-22T01:19:16.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T01:19:16.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T01:19:16.304 [Cloud] Queued cloud request. 2026-09-22T01:19:16.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T01:19:16.304 [Cloud] Dequeued cloud request. 2026-09-22T01:19:16.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T01:19:16.460 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E21AFBF4-ADD2-5F97-426E-A82E731AC91C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 01:19:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T01:19:16.960 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T01:19:30.663 Engine:Triggered AR EMS scan 2026-09-22T01:19:30.663 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.695 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.695 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.710 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.710 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.726 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.726 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.741 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.741 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.741 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.757 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.757 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.757 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.757 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.773 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.773 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.788 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.788 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.788 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.804 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.804 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.804 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.820 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.820 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.820 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.820 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.835 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.851 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.851 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.851 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.866 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.866 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.882 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.882 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.882 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.898 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.898 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.913 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.913 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.913 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.929 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.929 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.929 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.945 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.945 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.960 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.960 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.976 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.976 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.991 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:30.991 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:31.007 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:31.007 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:31.023 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:31.023 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:31.023 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:31.038 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:31.038 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:31.054 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:31.070 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:19:31.070 Engine:EMS scan for process: svchost pid: 5076, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-22T01:20:09.741 QuickScan:ScanID:35634835-69E8-4A26-9E9D-7BE7D69C8A90: Quick scan finished with error 0 2026-09-22T01:20:10.241 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-22T01:20:10.241 [RTP] Duplicating the current plugin configuration object... 2026-09-22T01:20:10.241 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-22T01:20:10.241 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-22T01:20:10.241 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-22T01:20:10.241 [RTP] No config change detected. Not updating plugin configuration. 2026-09-22T01:20:10.241 [RTP] No config changes found. No configuration switch. 2026-09-22T01:20:10.241 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-22T01:30:02.793 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T01:34:06.699 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T01:34:06.699 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T01:34:06.699 [Cloud] Queued cloud request. 2026-09-22T01:34:06.699 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T01:34:06.699 [Cloud] Dequeued cloud request. 2026-09-22T01:34:06.699 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T01:34:06.839 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0F1773A1-4027-254B-B5A1-F585505AFBAB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 01:34:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T01:34:07.340 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T01:39:42.859 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 5860, Count: 394, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mamBLOG\include\compat.inc.php, EstimatedImpact: 0% 2026-09-22T01:39:42.859 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 5266, Count: 439, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-22T01:39:42.859 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 2286, Count: 167, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-22T01:39:42.859 ProcessImageName: powershell.exe, Pid: 7380, TotalTime: 1353, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-22T01:39:42.859 ProcessImageName: AgentShellService.exe, Pid: 6244, TotalTime: 652, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 49% 2026-09-22T01:39:42.859 ProcessImageName: WmiPrvSE.exe, Pid: 3212, TotalTime: 629, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-22T01:39:42.859 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 362, Count: 25, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-22T01:39:42.859 ProcessImageName: powershell.exe, Pid: 3172, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-22T01:39:42.859 ProcessImageName: WmiPrvSE.exe, Pid: 7068, TotalTime: 248, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-22T01:39:42.859 ProcessImageName: python.exe, Pid: 6972, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-22T01:39:42.859 ProcessImageName: taskhostw.exe, Pid: 5396, TotalTime: 108, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-22T01:39:42.859 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 90, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-22T01:39:42.859 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e170-0.MAD, EstimatedImpact: 0% 2026-09-22T01:39:42.859 ProcessImageName: DeviceCensus.exe, Pid: 5700, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-22T01:39:42.859 ProcessImageName: mysqldump.exe, Pid: 4824, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-22T01:39:42.859 ProcessImageName: powershell.exe, Pid: 612, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-22T01:39:42.859 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-22T01:39:42.859 ProcessImageName: powershell.exe, Pid: 7448, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpC32.tmp, EstimatedImpact: 0% 2026-09-22T01:39:42.859 ProcessImageName: ngentask.exe, Pid: 7296, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-22T01:39:42.859 ProcessImageName: cmd.exe, Pid: 1096, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-22T01:45:07.798 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T01:58:08.727 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T01:58:08.727 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T01:58:08.727 [Cloud] Queued cloud request. 2026-09-22T01:58:08.727 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T01:58:08.727 [Cloud] Dequeued cloud request. 2026-09-22T01:58:08.727 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T01:58:08.899 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{43B5D671-0892-5B89-6E71-B7ED26257C03} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 01:58:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T01:58:09.399 [NRI] Successfully updated NIS service with platform settings for enforcement level Log IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 2026-09-22T02:00:05.133 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T02:00:05.165 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-22T02:00:05.165 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-22T02:00:05.165 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-22T02:00:05.165 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T02:00:05.165 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-22T02:00:05.165 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-22T02:00:05.165 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-22T02:00:05.165 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-22T02:00:05.165 MdCoreSvc is supported in this platform and OS 2026-09-22T02:00:05.633 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-22T02:00:05.633 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-22T02:00:05.633 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-22T02:00:12.805 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T02:00:50.258 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T02:00:50.258 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T02:00:50.258 [Cloud] Queued cloud request. 2026-09-22T02:00:50.258 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T02:00:50.258 [Cloud] Dequeued cloud request. 2026-09-22T02:00:50.258 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T02:00:50.399 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{937110BE-136B-B983-F128-C537D8D6920F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 02:00:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T02:00:50.915 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T02:01:38.430 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T02:01:38.430 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T02:01:38.430 [Cloud] Queued cloud request. 2026-09-22T02:01:38.430 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T02:01:38.430 [Cloud] Dequeued cloud request. 2026-09-22T02:01:38.430 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T02:01:38.524 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{86575697-AEB8-78E6-F1FE-ED8029D4A4D7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 02:01:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T02:01:39.024 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T02:15:17.810 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T02:23:15.939 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T02:23:15.939 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T02:23:15.939 [Cloud] Queued cloud request. 2026-09-22T02:23:15.939 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T02:23:15.939 [Cloud] Dequeued cloud request. 2026-09-22T02:23:15.939 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T02:23:16.143 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9BA9D17B-2F4A-416F-E34E-7924930B1081} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 02:23:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T02:23:16.658 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T02:30:22.817 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T02:40:33.900 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T02:40:33.900 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T02:40:33.900 [Cloud] Queued cloud request. 2026-09-22T02:40:33.900 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T02:40:33.900 [Cloud] Dequeued cloud request. 2026-09-22T02:40:33.900 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T02:40:34.338 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C9A75558-B59A-FA17-C2BF-542C7BDC043B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 02:40:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T02:40:34.854 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T02:45:27.822 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T03:00:32.830 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T03:03:57.127 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T03:03:57.127 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T03:03:57.127 [Cloud] Queued cloud request. 2026-09-22T03:03:57.127 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T03:03:57.127 [Cloud] Dequeued cloud request. 2026-09-22T03:03:57.127 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T03:03:57.315 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{30D4B082-CDF6-C16E-DB06-5D88D13E8192} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 03:03:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T03:03:57.830 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:04:29.346 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T03:04:29.346 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T03:04:29.346 [Cloud] Queued cloud request. 2026-09-22T03:04:29.346 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T03:04:29.346 [Cloud] Dequeued cloud request. 2026-09-22T03:04:29.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T03:04:30.393 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4B3ECBE9-C660-F085-C30F-CA83C5CA9C4E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 03:04:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T03:04:30.893 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:07:07.052 [AutoPurge] Cleanup Routine tasks have started. 2026-09-22T03:07:07.052 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-22T03:07:07.052 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-22T03:07:07.052 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-22T03:07:07.052 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-22T03:07:07.052 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-22T03:07:07.052 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-22T03:07:07.067 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-22T03:07:07.067 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-22T03:07:07.067 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-22-2026 03:07:07 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-22-2026 03:07:07 2026-09-22T03:07:07.067 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-22T03:07:07.067 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-22T03:07:07.067 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-22T03:07:07.067 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-22T03:07:07.067 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-22T03:07:07.067 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-22T03:07:07.161 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-22T03:07:07.255 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-22T03:07:07.255 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-22T03:07:07.286 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-22T03:07:07.286 [AutoPurge] Removing expired default signature package ... 2026-09-22T03:07:07.458 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-22T03:07:07.536 Job Notification: New process added to job (1392) 2026-09-22T03:07:07.614 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-22T03:07:08.067 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:07:08.536 Job Notification: Process exited from job (1392) 2026-09-22T03:07:08.583 [AutoPurge] Verification Routine tasks have ended. 2026-09-22T03:07:08.708 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-22T03:07:08.802 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-22T03:07:09.239 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-22T03:07:09.333 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-22T03:07:09.473 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-22T03:07:11.083 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:11.427 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-22T03:07:11.536 Engine:Setting original file name "dual_engine_adapter.dll" for "c:\program files (x86)\microsoft\edgecore\153.0.4234.48\dual_engine_adapter_x64.dll", hr=0x0 2026-09-22T03:07:11.739 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-22T03:07:11.755 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:11.942 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-22T03:07:12.536 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-22T03:07:13.145 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-22T03:07:13.270 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-22T03:07:13.395 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-22T03:07:13.630 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:07:13.770 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-22T03:07:14.098 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-22T03:07:14.208 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-22T03:07:14.380 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:14.505 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:14.567 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:14.583 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-22T03:07:14.739 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:07:14.802 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-22T03:07:14.833 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-22T03:07:14.895 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-22T03:07:15.020 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-22T03:07:15.442 Engine:Setting original file name "mini_installer.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{56eb18f8-b008-4cbd-b6d2-8c97fe7e9062}\153.0.4234.48\microsoftedge_x64_153.0.4234.48_153.0.4234.32.exe", hr=0x0 2026-09-22T03:07:15.598 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:15.645 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-22T03:07:16.052 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:07:16.177 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-22T03:07:16.770 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-22T03:07:17.223 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:17.411 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:07:17.708 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-22T03:07:18.130 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-22T03:07:18.208 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-22T03:07:18.599 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.271.7\microsoftedgeupdatesetup_x86_1.3.271.7.exe", hr=0x0 2026-09-22T03:07:18.692 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-22T03:07:18.817 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:19.458 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:07:19.599 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-22T03:07:19.599 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-22T03:07:19.645 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-22T03:07:19.833 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-22T03:07:19.895 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-22T03:07:19.942 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:20.020 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-22T03:07:20.239 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-22T03:07:20.646 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-22T03:07:20.880 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-22T03:07:21.396 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-22T03:07:22.693 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-22T03:07:23.177 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-22T03:07:23.208 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-22T03:07:23.239 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-22T03:07:23.239 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-22T03:07:23.255 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-22T03:07:23.380 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-22T03:07:23.568 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-22T03:07:23.599 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:23.677 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-22T03:07:24.146 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-22T03:07:24.193 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-22T03:07:24.208 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-22T03:07:24.255 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-22T03:07:24.724 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:24.911 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:24.943 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-22T03:07:24.989 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-22T03:07:25.005 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:25.458 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-22T03:07:25.833 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-22T03:07:25.849 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:26.615 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-22T03:07:26.630 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-22T03:07:27.302 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:07:27.646 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-22T03:07:28.083 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-22T03:07:28.240 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:28.396 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:28.536 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-22T03:07:28.740 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-22T03:07:28.802 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-22T03:07:28.865 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:29.365 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-22T03:07:29.755 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-22T03:07:29.802 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-22T03:07:29.865 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:07:30.177 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:07:30.396 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-22T03:07:30.505 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-22T03:07:30.630 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-22T03:07:30.662 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-22T03:07:30.755 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-22T03:07:31.287 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-22T03:07:31.708 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-22T03:07:31.818 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-22T03:07:31.912 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-22T03:07:32.490 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-22T03:07:32.537 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:32.896 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-22T03:07:33.005 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-22T03:07:33.021 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-22T03:07:33.052 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-22T03:07:33.162 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-22T03:07:33.193 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-22T03:07:33.240 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-22T03:07:33.583 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-22T03:07:33.583 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-22T03:07:33.958 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-22T03:07:34.146 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:34.255 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-22T03:07:34.255 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-22T03:07:34.474 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:07:34.708 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-22T03:07:35.099 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:07:35.412 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-22T03:07:35.568 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-22T03:07:35.927 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-22T03:07:35.943 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:36.115 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-22T03:07:36.224 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-22T03:07:36.724 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-22T03:07:36.787 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-22T03:07:36.927 Engine:Setting original file name "notification_helper.exe" for "c:\program files (x86)\microsoft\edge\application\153.0.4234.48\notification_click_helper.exe", hr=0x0 2026-09-22T03:07:37.021 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:37.037 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-22T03:07:37.224 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-22T03:07:37.287 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-22T03:07:37.490 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:07:38.037 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:07:38.177 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-22T03:07:38.240 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-22T03:07:38.896 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-22T03:07:38.896 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-22T03:07:39.177 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-22T03:07:39.349 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-22T03:07:39.693 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-22T03:07:40.365 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:07:40.630 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-22T03:07:41.084 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-22T03:07:41.380 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-22T03:07:41.537 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-22T03:07:41.568 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:41.568 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-22T03:07:41.677 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-22T03:07:41.880 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-22T03:07:42.256 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-22T03:07:42.334 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-22T03:07:42.584 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-22T03:07:42.849 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-22T03:07:42.896 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-22T03:07:43.209 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:07:43.396 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-22T03:07:43.599 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-22T03:07:44.396 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:07:44.459 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-22T03:07:44.537 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-22T03:07:44.599 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-22T03:07:45.568 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-22T03:07:45.646 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-22T03:07:45.756 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-22T03:07:45.896 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-22T03:07:46.115 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-22T03:07:46.287 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-22T03:07:46.974 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-22T03:07:47.021 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-22T03:07:47.052 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-22T03:07:47.131 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-22T03:07:47.240 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-22T03:07:47.568 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-22T03:07:47.709 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-22T03:07:47.756 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-22T03:07:47.771 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-22T03:07:47.865 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:47.912 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-22T03:07:47.959 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-22T03:07:48.287 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-22T03:07:48.412 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-22T03:07:48.693 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-22T03:07:48.818 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:49.052 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-22T03:07:49.459 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-22T03:07:49.552 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-22T03:07:49.724 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-22T03:07:49.943 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-22T03:07:50.006 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-22T03:07:50.084 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:07:50.271 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:07:50.474 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-22T03:07:50.552 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-22T03:07:50.756 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:07:50.927 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-22T03:07:51.006 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:07:51.256 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:07:51.302 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-22T03:07:51.349 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-22T03:07:51.537 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-22T03:07:51.584 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-22T03:07:51.584 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-22T03:07:52.006 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-22T03:07:52.068 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:52.115 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-22T03:07:52.209 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:07:52.396 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:07:52.506 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-22T03:07:52.631 Engine:Setting original file name "CopilotUpdate.exe" for "c:\windows\systemtemp\copilotupdate.exe.old{9c304e8d-10bc-445a-8771-81a12ae6dd9b}", hr=0x0 2026-09-22T03:07:53.084 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-22T03:07:53.209 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-22T03:07:53.271 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-22T03:07:53.427 Engine:Setting original file name "Vulkan Runtime" for "c:\program files (x86)\microsoft\edgecore\153.0.4234.48\vulkan-1.dll", hr=0x0 2026-09-22T03:07:53.568 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-22T03:07:53.599 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-22T03:07:53.646 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-22T03:07:54.162 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-22T03:07:54.209 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-22T03:07:54.568 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-22T03:07:54.646 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-22T03:07:54.677 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-22T03:07:54.693 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:54.709 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:54.740 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:07:54.756 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-22T03:07:54.771 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:55.381 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-22T03:07:55.693 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-22T03:07:55.974 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:07:56.052 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-22T03:07:56.334 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:56.365 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:07:56.490 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-22T03:07:56.818 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:56.834 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-22T03:07:57.006 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-22T03:07:57.021 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-22T03:07:57.146 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-22T03:07:57.209 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-22T03:07:57.224 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-22T03:07:57.474 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-22T03:07:57.506 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-22T03:07:57.506 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-22T03:07:57.677 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-22T03:07:57.896 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:58.099 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-22T03:07:58.443 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\systemapps\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-22T03:07:58.568 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-22T03:07:58.693 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-22T03:07:58.927 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-22T03:07:59.099 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-22T03:07:59.115 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-22T03:07:59.115 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:07:59.349 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-22T03:07:59.365 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-22T03:07:59.599 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-22T03:07:59.740 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-22T03:07:59.740 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-22T03:08:00.521 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:08:00.521 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-22T03:08:00.631 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-22T03:08:00.756 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:08:00.771 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:08:01.662 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:08:02.131 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-22T03:08:02.349 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:02.365 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-22T03:08:02.599 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:02.631 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-22T03:08:02.724 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-22T03:08:02.849 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-22T03:08:02.912 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-22T03:08:03.271 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-22T03:08:03.303 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:08:03.584 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:08:03.584 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:03.646 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-22T03:08:04.240 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-22T03:08:04.787 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-22T03:08:04.834 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:04.881 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-22T03:08:04.974 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:08:05.193 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:05.271 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-22T03:08:05.568 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-22T03:08:06.068 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:06.099 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-22T03:08:06.365 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:08:06.506 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-22T03:08:06.709 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-22T03:08:06.724 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:07.006 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-22T03:08:07.412 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-22T03:08:07.459 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:07.568 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:07.709 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-22T03:08:07.724 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-22T03:08:08.068 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-22T03:08:08.178 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:08.334 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-22T03:08:08.365 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-22T03:08:08.381 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:08.412 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:08:08.584 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-22T03:08:08.631 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:08:09.099 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-22T03:08:09.209 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-22T03:08:09.678 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-22T03:08:09.740 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-22T03:08:09.803 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-22T03:08:09.896 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-22T03:08:09.943 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:08:09.974 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-22T03:08:10.053 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-22T03:08:10.506 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-22T03:08:10.662 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-22T03:08:10.896 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-22T03:08:10.912 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-22T03:08:11.240 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-22T03:08:11.240 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:11.584 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-22T03:08:11.912 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-22T03:08:12.178 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-22T03:08:12.240 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-22T03:08:12.287 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-22T03:08:12.349 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:08:12.521 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-22T03:08:12.584 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-22T03:08:12.615 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-22T03:08:12.693 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-22T03:08:13.053 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-22T03:08:13.084 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:08:13.193 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:08:13.521 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-22T03:08:13.599 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:08:13.771 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-22T03:08:13.990 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-22T03:08:14.287 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-22T03:08:14.303 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:14.646 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-22T03:08:14.662 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-22T03:08:14.693 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-22T03:08:14.943 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-22T03:08:15.193 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-22T03:08:15.209 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-22T03:08:15.599 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-22T03:08:15.693 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-22T03:08:15.818 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-22T03:08:15.896 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:08:15.912 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-22T03:08:16.053 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-22T03:08:16.240 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-22T03:08:16.412 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-22T03:08:16.490 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-22T03:08:16.662 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-22T03:08:17.959 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-22T03:08:18.365 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-22T03:08:18.506 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-22T03:08:18.740 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:08:19.006 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-22T03:08:19.224 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-22T03:08:19.506 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-22T03:08:19.756 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-22T03:08:19.865 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-22T03:08:19.896 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-22T03:08:19.896 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-22T03:08:20.021 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-22T03:08:20.303 Engine:Setting original file name " " for "c:\program files (x86)\microsoft\edgecore\153.0.4234.48\dxcompiler.dll", hr=0x0 2026-09-22T03:08:20.537 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-22T03:08:20.568 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:20.568 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-22T03:08:20.646 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-22T03:08:20.678 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-22T03:08:20.787 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-22T03:08:21.178 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-22T03:08:21.271 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-22T03:08:21.474 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-22T03:08:21.474 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:21.599 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-22T03:08:21.615 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-22T03:08:21.818 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-22T03:08:21.881 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:08:22.146 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-22T03:08:22.459 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-22T03:08:22.943 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:08:23.412 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-22T03:08:23.506 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-22T03:08:24.006 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-22T03:08:24.396 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:08:24.521 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:24.803 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-22T03:08:25.068 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-22T03:08:25.131 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-22T03:08:25.303 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-22T03:08:25.443 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-22T03:08:26.131 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-22T03:08:26.896 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-22T03:08:26.975 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-22T03:08:27.053 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-22T03:08:27.709 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-22T03:08:28.037 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-22T03:08:28.318 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-22T03:08:28.381 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-22T03:08:28.490 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-22T03:08:28.490 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-22T03:08:28.959 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-22T03:08:29.068 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-22T03:08:29.084 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:29.115 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-22T03:08:29.396 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-22T03:08:29.412 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:08:29.615 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-22T03:08:29.818 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-22T03:08:30.146 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-22T03:08:30.631 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-22T03:08:30.756 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:08:30.959 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:31.178 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-22T03:08:31.553 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:31.631 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-22T03:08:31.834 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-22T03:08:32.006 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-22T03:08:32.162 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:32.287 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-22T03:08:32.553 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-22T03:08:32.896 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-22T03:08:32.943 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-22T03:08:32.975 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-22T03:08:33.131 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:33.162 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-22T03:08:33.521 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-22T03:08:33.678 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-22T03:08:33.787 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:34.772 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-22T03:08:35.350 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-22T03:08:35.443 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-22T03:08:35.506 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-22T03:08:35.553 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-22T03:08:35.897 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:35.959 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-22T03:08:36.193 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-22T03:08:36.303 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-22T03:08:36.381 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-22T03:08:36.459 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:36.537 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-22T03:08:36.772 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-22T03:08:36.834 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-22T03:08:37.193 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-22T03:08:37.272 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-22T03:08:37.350 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-22T03:08:37.350 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-22T03:08:37.365 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-22T03:08:37.381 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-22T03:08:37.506 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-22T03:08:37.506 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:08:37.537 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-22T03:08:37.584 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-22T03:08:37.959 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-22T03:08:37.975 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-22T03:08:38.318 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:08:38.381 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-22T03:08:38.397 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-22T03:08:38.428 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-22T03:08:39.350 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-22T03:08:39.506 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:08:39.709 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:08:39.709 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-22T03:08:40.006 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-22T03:08:40.194 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-22T03:08:40.318 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-22T03:08:40.397 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:41.068 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-22T03:08:41.084 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-22T03:08:41.256 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-22T03:08:41.272 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-22T03:08:41.287 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:08:41.772 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:08:41.787 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-22T03:08:41.928 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-22T03:08:41.928 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-22T03:08:42.100 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-22T03:08:42.553 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-22T03:08:42.959 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-22T03:08:43.193 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:43.631 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-22T03:08:43.865 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-22T03:08:43.912 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-22T03:08:44.068 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-22T03:08:44.100 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-22T03:08:44.178 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-22T03:08:44.272 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-22T03:08:44.350 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-22T03:08:44.350 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:08:44.600 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-22T03:08:44.678 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-22T03:08:44.975 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-22T03:08:45.100 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-22T03:08:45.256 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-22T03:08:45.272 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:08:45.428 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\de-de\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:45.584 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-console-l1-1-0.dll", hr=0x0 2026-09-22T03:08:45.740 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0 2026-09-22T03:08:45.756 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-registry-l2-1-0.dll", hr=0x0 2026-09-22T03:08:46.068 Engine:Setting original file name "MrmCore.dll" for "c:\windows\winsxs\wow64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.20348.5020_none_9e6a80bbc86408d7\mrmcorer.dll", hr=0x0 2026-09-22T03:08:46.084 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:46.318 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_en-gb_56416fd74780e848\vsswmi.dll.mui", hr=0x0 2026-09-22T03:08:46.334 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\es-es\aerolite.msstyles.mui", hr=0x0 2026-09-22T03:08:46.506 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_7573f1c6d4639f87\penimc.dll", hr=0x0 2026-09-22T03:08:46.522 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.data.winmd", hr=0x0 2026-09-22T03:08:46.693 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\de-de\ndisimplatcim.dll.mui", hr=0x0 2026-09-22T03:08:46.772 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_4e347e352039867c\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:46.881 Engine:Setting original file name "winsqlite3" for "c:\windows\winsxs\wow64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.20348.4647_none_c9096b99901f19cd\winsqlite3.dll", hr=0x0 2026-09-22T03:08:46.928 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0 2026-09-22T03:08:46.928 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000c.dll", hr=0x0 2026-09-22T03:08:47.490 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-1-0.dll", hr=0x0 2026-09-22T03:08:47.506 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata000a.dll", hr=0x0 2026-09-22T03:08:47.787 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-2-0.dll", hr=0x0 2026-09-22T03:08:47.865 Engine:Setting original file name "wmic.exe" for "c:\windows\winsxs\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.20348.2849_none_54405a5933961199\wmic.exe", hr=0x0 2026-09-22T03:08:48.037 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.storage.winmd", hr=0x0 2026-09-22T03:08:48.350 Engine:Setting original file name "CRYPT32.DLL" for "c:\windows\systemresources\crypt32.dll.mun", hr=0x0 2026-09-22T03:08:48.600 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_7d8ffbc5cb37c8e0\bootmgr.exe.mui", hr=0x0 2026-09-22T03:08:48.647 Engine:Setting original file name "mstsc.exe" for "c:\windows\systemresources\mstsc.exe.mun", hr=0x0 2026-09-22T03:08:48.865 Engine:Setting original file name "SYSTEMCPL.DLL" for "c:\windows\systemresources\systemcpl.dll.mun", hr=0x0 2026-09-22T03:08:48.912 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0 2026-09-22T03:08:49.068 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1e6e07718388e886\diagpackage.dll.mui", hr=0x0 2026-09-22T03:08:49.115 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0 2026-09-22T03:08:49.740 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0 2026-09-22T03:08:49.756 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mpg4decd_31bf3856ad364e35_10.0.20348.2849_none_08e768f194682e23\mpg4decd.dll", hr=0x0 2026-09-22T03:08:49.772 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0 2026-09-22T03:08:49.818 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0 2026-09-22T03:08:50.022 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-1.dll", hr=0x0 2026-09-22T03:08:50.022 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\naturallanguage6.dll", hr=0x0 2026-09-22T03:08:50.506 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0 2026-09-22T03:08:50.772 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0 2026-09-22T03:08:51.068 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ja-jp_5634cc97d85965d9\bootmgr_ex.efi.mui", hr=0x0 2026-09-22T03:08:51.068 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0 2026-09-22T03:08:51.303 OriginalFileName Maintenance::28393 files in Moac, 0 skipped (cached), 541 filename set 2026-09-22T03:08:51.303 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-22T03:13:29.147 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T03:13:29.147 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T03:13:29.147 [Cloud] Queued cloud request. 2026-09-22T03:13:29.147 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T03:13:29.147 [Cloud] Dequeued cloud request. 2026-09-22T03:13:29.147 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T03:13:29.334 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9A8901DB-D0B7-351F-C7C8-FBE73D4D8A7A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 03:13:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T03:13:29.834 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-22T03:13:29.865 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:13:29.865 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-22T03:13:29.865 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-22T03:13:29.865 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-22T03:13:29.865 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-22T03:13:29.865 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-22T03:13:29.865 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-22T03:13:29.865 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-22T03:13:29.865 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-22T03:13:29.865 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-22T03:13:29.865 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-22T03:13:29.865 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-22T03:13:29.865 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-22T03:13:29.865 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-22T03:13:29.865 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-22T03:13:29.865 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-22T03:13:29.865 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-22T03:13:29.865 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-22T03:13:29.865 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-22T03:13:29.865 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-22T03:13:29.865 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-22T03:13:29.865 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:13:29.865 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:13:29.881 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:13:29.881 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:13:32.459 [RTP] Duplicating the current plugin configuration object... 2026-09-22T03:13:32.459 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-22T03:13:32.459 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-22T03:13:32.459 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-22T03:13:32.459 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-22T03:13:32.459 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-22T03:13:49.975 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T03:13:49.975 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T03:13:49.975 [Cloud] Queued cloud request. 2026-09-22T03:13:49.975 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T03:13:49.975 [Cloud] Dequeued cloud request. 2026-09-22T03:13:49.975 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T03:13:50.303 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BE85522A-45FC-6B73-3099-FC331644C3D4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 03:13:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T03:13:50.803 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:15:37.836 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T03:25:02.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T03:25:02.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T03:25:02.604 [Cloud] Queued cloud request. 2026-09-22T03:25:02.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T03:25:02.604 [Cloud] Dequeued cloud request. 2026-09-22T03:25:02.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T03:25:12.745 [Cloud] End of cloud request. 2026-09-22T03:25:13.245 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:30:37.858 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T03:30:37.858 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T03:30:37.858 [Cloud] Queued cloud request. 2026-09-22T03:30:37.858 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T03:30:37.858 [Cloud] Dequeued cloud request. 2026-09-22T03:30:37.858 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T03:30:38.046 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{417A5805-2141-3196-7109-3C757FE08356} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 03:30:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T03:30:38.546 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:30:42.843 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T03:35:59.781 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T03:35:59.781 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T03:35:59.781 [Cloud] Queued cloud request. 2026-09-22T03:35:59.781 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T03:35:59.781 [Cloud] Dequeued cloud request. 2026-09-22T03:35:59.781 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T03:36:09.922 [Cloud] End of cloud request. 2026-09-22T03:36:10.422 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:39:42.909 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 10093, Count: 604, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-22T03:39:42.909 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 5266, Count: 439, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-22T03:39:42.909 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4423, Count: 352, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-22T03:39:42.909 ProcessImageName: powershell.exe, Pid: 7380, TotalTime: 1353, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-22T03:39:42.909 ProcessImageName: AgentShellService.exe, Pid: 6244, TotalTime: 652, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 49% 2026-09-22T03:39:42.909 ProcessImageName: WmiPrvSE.exe, Pid: 3212, TotalTime: 629, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-22T03:39:42.909 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 424, Count: 27, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-22T03:39:42.909 ProcessImageName: powershell.exe, Pid: 3172, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-22T03:39:42.909 ProcessImageName: WmiPrvSE.exe, Pid: 7068, TotalTime: 248, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-22T03:39:42.909 ProcessImageName: python.exe, Pid: 6972, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-22T03:39:42.909 ProcessImageName: taskhostw.exe, Pid: 5396, TotalTime: 108, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-22T03:39:42.909 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-22T03:39:42.909 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 90, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-22T03:39:42.909 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e170-0.MAD, EstimatedImpact: 0% 2026-09-22T03:39:42.909 ProcessImageName: DeviceCensus.exe, Pid: 5700, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-22T03:39:42.909 ProcessImageName: mysqldump.exe, Pid: 4824, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-22T03:39:42.909 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-22T03:39:42.909 ProcessImageName: powershell.exe, Pid: 612, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-22T03:39:42.909 ProcessImageName: ngentask.exe, Pid: 7296, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-22T03:39:42.909 ProcessImageName: powershell.exe, Pid: 7448, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpC32.tmp, EstimatedImpact: 0% 2026-09-22T03:39:42.909 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-22T03:39:42.909 ProcessImageName: cmd.exe, Pid: 1096, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-22T03:44:04.442 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T03:44:04.442 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T03:44:04.442 [Cloud] Queued cloud request. 2026-09-22T03:44:04.442 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T03:44:04.442 [Cloud] Dequeued cloud request. 2026-09-22T03:44:04.442 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T03:44:04.645 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{84213210-FD52-5E9F-7E8A-5F88BEABCAD8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 03:44:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T03:44:05.145 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:44:41.676 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T03:44:41.676 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T03:44:41.676 [Cloud] Queued cloud request. 2026-09-22T03:44:41.676 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T03:44:41.676 [Cloud] Dequeued cloud request. 2026-09-22T03:44:41.676 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T03:44:41.754 [Cloud] End of cloud request. 2026-09-22T03:44:42.270 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T03:45:47.848 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T03:51:07.851 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T03:51:07.851 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T03:51:07.851 [Cloud] Queued cloud request. 2026-09-22T03:51:07.851 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T03:51:07.851 [Cloud] Dequeued cloud request. 2026-09-22T03:51:07.851 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T03:51:08.054 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CBB59100-3DB4-748B-87AD-7E703454D1CD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 03:51:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T03:51:08.554 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T04:00:52.855 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T04:06:48.013 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T04:06:48.013 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T04:06:48.013 [Cloud] Queued cloud request. 2026-09-22T04:06:48.013 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T04:06:48.013 [Cloud] Dequeued cloud request. 2026-09-22T04:06:48.013 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T04:06:48.184 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D62C0C48-45FA-4C63-75BF-80D676DC9B21} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 04:06:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T04:06:48.700 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T04:15:57.861 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T04:17:30.862 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T04:17:30.862 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T04:17:30.862 [Cloud] Queued cloud request. 2026-09-22T04:17:30.862 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T04:17:30.862 [Cloud] Dequeued cloud request. 2026-09-22T04:17:30.862 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T04:17:31.050 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{80DE6E4E-1590-C134-ED97-01E5CE16A7D3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 04:17:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T04:17:31.550 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T04:17:48.347 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T04:17:48.347 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T04:17:48.347 [Cloud] Queued cloud request. 2026-09-22T04:17:48.347 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T04:17:48.347 [Cloud] Dequeued cloud request. 2026-09-22T04:17:48.347 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T04:17:48.425 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{461596D4-23C9-7036-2D15-95D35917FDC1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 04:17:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T04:17:48.941 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T04:26:53.865 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T04:26:53.865 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T04:26:53.865 [Cloud] Queued cloud request. 2026-09-22T04:26:53.865 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T04:26:53.865 [Cloud] Dequeued cloud request. 2026-09-22T04:26:53.865 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T04:26:54.053 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B8759DEC-0F8C-A6BE-BE71-4510F51669A3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 04:26:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T04:26:54.568 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T04:31:02.867 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T04:33:23.869 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T04:33:23.869 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T04:33:23.869 [Cloud] Queued cloud request. 2026-09-22T04:33:23.869 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T04:33:24.025 [Cloud] Dequeued cloud request. 2026-09-22T04:33:24.025 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T04:33:24.165 [Cloud] End of cloud request. 2026-09-22T04:33:24.681 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T04:36:25.384 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T04:36:25.384 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T04:36:25.384 [Cloud] Queued cloud request. 2026-09-22T04:36:25.384 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T04:36:25.384 [Cloud] Dequeued cloud request. 2026-09-22T04:36:25.384 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T04:36:25.525 [Cloud] End of cloud request. 2026-09-22T04:36:26.040 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T04:46:07.874 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T04:49:02.516 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T04:49:02.516 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T04:49:02.516 [Cloud] Queued cloud request. 2026-09-22T04:49:02.516 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T04:49:02.516 [Cloud] Dequeued cloud request. 2026-09-22T04:49:02.516 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T04:49:02.688 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{14702D77-C0C4-3E0B-EF28-7D751F535717} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 04:49:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T04:49:03.188 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T04:51:26.344 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T04:51:26.344 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T04:51:26.344 [Cloud] Queued cloud request. 2026-09-22T04:51:26.344 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T04:51:26.344 [Cloud] Dequeued cloud request. 2026-09-22T04:51:26.344 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T04:51:26.485 [Cloud] End of cloud request. 2026-09-22T04:51:26.985 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T04:59:06.286 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T04:59:06.286 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T04:59:06.286 [Cloud] Queued cloud request. 2026-09-22T04:59:06.286 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T04:59:06.286 [Cloud] Dequeued cloud request. 2026-09-22T04:59:06.286 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T04:59:06.442 [Cloud] End of cloud request. 2026-09-22T04:59:06.958 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T05:01:12.880 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T05:02:07.208 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T05:02:07.208 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T05:02:07.208 [Cloud] Queued cloud request. 2026-09-22T05:02:07.208 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T05:02:07.208 [Cloud] Dequeued cloud request. 2026-09-22T05:02:07.208 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T05:02:07.396 [Cloud] End of cloud request. 2026-09-22T05:02:07.896 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T05:03:08.646 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T05:03:08.646 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T05:03:08.646 [Cloud] Queued cloud request. 2026-09-22T05:03:08.646 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T05:03:08.646 [Cloud] Dequeued cloud request. 2026-09-22T05:03:08.817 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T05:03:09.083 [Cloud] End of cloud request. 2026-09-22T05:03:09.599 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T05:14:35.774 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T05:14:35.774 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T05:14:35.774 [Cloud] Queued cloud request. 2026-09-22T05:14:35.774 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T05:14:35.774 [Cloud] Dequeued cloud request. 2026-09-22T05:14:35.774 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T05:14:35.962 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4AA2F292-CB2E-D425-FE07-62012714FF82} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 05:14:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T05:14:36.477 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T05:16:17.886 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T05:18:35.184 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T05:18:35.184 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T05:18:35.184 [Cloud] Queued cloud request. 2026-09-22T05:18:35.184 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T05:18:35.184 [Cloud] Dequeued cloud request. 2026-09-22T05:18:35.184 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T05:18:35.606 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D7066199-85D1-7B93-692D-6D0BB1CF7EFA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 05:18:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T05:18:36.122 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T05:20:32.107 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T05:20:32.107 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T05:20:32.107 [Cloud] Queued cloud request. 2026-09-22T05:20:32.107 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T05:20:32.107 [Cloud] Dequeued cloud request. 2026-09-22T05:20:32.107 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T05:20:32.294 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{565911FC-B9D3-C7C3-AED1-96A2228CB76B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 05:20:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T05:20:32.794 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T05:31:22.892 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T05:39:42.959 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 16192, Count: 1051, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-22T05:39:42.959 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 6464, Count: 539, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-22T05:39:42.959 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 5266, Count: 439, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-22T05:39:42.959 ProcessImageName: powershell.exe, Pid: 7380, TotalTime: 1353, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-22T05:39:42.959 ProcessImageName: AgentShellService.exe, Pid: 6244, TotalTime: 652, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 49% 2026-09-22T05:39:42.959 ProcessImageName: WmiPrvSE.exe, Pid: 3212, TotalTime: 629, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-22T05:39:42.959 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 454, Count: 29, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-22T05:39:42.959 ProcessImageName: powershell.exe, Pid: 3172, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-22T05:39:42.959 ProcessImageName: WmiPrvSE.exe, Pid: 7068, TotalTime: 248, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-22T05:39:42.959 ProcessImageName: python.exe, Pid: 6972, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-22T05:39:42.959 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 120, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-22T05:39:42.959 ProcessImageName: taskhostw.exe, Pid: 5396, TotalTime: 108, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-22T05:39:42.959 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-22T05:39:42.959 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e170-0.MAD, EstimatedImpact: 0% 2026-09-22T05:39:42.959 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_310F0D2B41E141D9BB9B40175EE173AC.MAI, EstimatedImpact: 48% 2026-09-22T05:39:42.959 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-22T05:39:42.959 ProcessImageName: DeviceCensus.exe, Pid: 5700, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-22T05:39:42.959 ProcessImageName: mysqldump.exe, Pid: 4824, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-22T05:39:42.959 ProcessImageName: powershell.exe, Pid: 612, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-22T05:39:42.959 ProcessImageName: ngentask.exe, Pid: 7296, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-22T05:39:42.959 ProcessImageName: powershell.exe, Pid: 7448, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpC32.tmp, EstimatedImpact: 0% 2026-09-22T05:39:42.959 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-22T05:39:42.959 ProcessImageName: cmd.exe, Pid: 1096, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-22T05:46:27.897 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T06:01:04.186 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:01:04.186 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:01:04.186 [Cloud] Queued cloud request. 2026-09-22T06:01:04.186 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:01:04.186 [Cloud] Dequeued cloud request. 2026-09-22T06:01:04.186 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:01:18.358 [Cloud] End of cloud request. 2026-09-22T06:01:18.873 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:01:32.904 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T06:07:14.689 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:07:14.689 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:07:14.689 [Cloud] Queued cloud request. 2026-09-22T06:07:14.689 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:07:14.689 [Cloud] Dequeued cloud request. 2026-09-22T06:07:14.689 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:07:19.111 [Cloud] End of cloud request. 2026-09-22T06:07:19.626 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:13:06.690 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:13:06.690 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:13:06.690 [Cloud] Queued cloud request. 2026-09-22T06:13:06.690 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:13:06.690 [Cloud] Dequeued cloud request. 2026-09-22T06:13:06.690 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:13:06.862 [Cloud] End of cloud request. 2026-09-22T06:13:07.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:14:10.174 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:14:10.174 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:14:10.174 [Cloud] Queued cloud request. 2026-09-22T06:14:10.174 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:14:10.174 [Cloud] Dequeued cloud request. 2026-09-22T06:14:10.174 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:14:10.331 [Cloud] End of cloud request. 2026-09-22T06:14:10.846 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:14:21.831 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:14:21.831 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:14:21.831 [Cloud] Queued cloud request. 2026-09-22T06:14:21.831 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:14:21.831 [Cloud] Dequeued cloud request. 2026-09-22T06:14:21.831 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:14:21.971 [Cloud] End of cloud request. 2026-09-22T06:14:22.487 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:14:45.893 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:14:45.893 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:14:45.893 [Cloud] Queued cloud request. 2026-09-22T06:14:45.893 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:14:45.893 [Cloud] Dequeued cloud request. 2026-09-22T06:14:45.893 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:14:45.971 [Cloud] End of cloud request. 2026-09-22T06:14:46.487 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:15:31.613 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:15:31.613 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:15:31.613 [Cloud] Queued cloud request. 2026-09-22T06:15:31.613 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:15:31.613 [Cloud] Dequeued cloud request. 2026-09-22T06:15:31.613 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:15:31.738 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9320C4BF-A255-71E7-5115-957135EFD2FD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 06:15:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T06:15:32.238 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:15:36.285 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:15:36.285 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:15:36.285 [Cloud] Queued cloud request. 2026-09-22T06:15:36.285 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:15:36.285 [Cloud] Dequeued cloud request. 2026-09-22T06:15:36.285 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:15:36.410 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E90AACD8-17B7-DFBA-6EFA-A161BCED0F33} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 06:15:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T06:15:36.910 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:16:37.911 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T06:21:21.351 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:21:21.351 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:21:21.351 [Cloud] Queued cloud request. 2026-09-22T06:21:21.351 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:21:21.351 [Cloud] Dequeued cloud request. 2026-09-22T06:21:21.351 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:21:21.507 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A115532E-8E1C-B1E5-FEB5-F2182609A8F1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 06:21:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T06:21:22.007 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:22:50.335 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:22:50.335 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:22:50.335 [Cloud] Queued cloud request. 2026-09-22T06:22:50.335 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:22:50.335 [Cloud] Dequeued cloud request. 2026-09-22T06:22:50.335 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:22:50.491 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{81977286-7C6E-A812-6137-FEEAC5F88CDA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 06:22:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T06:22:51.007 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:31:42.917 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T06:41:14.141 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:41:14.141 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:41:14.141 [Cloud] Queued cloud request. 2026-09-22T06:41:14.141 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:41:14.328 [Cloud] Dequeued cloud request. 2026-09-22T06:41:14.328 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:41:24.437 [Cloud] End of cloud request. 2026-09-22T06:41:24.953 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:42:08.328 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:42:08.328 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:42:08.328 [Cloud] Queued cloud request. 2026-09-22T06:42:08.328 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:42:08.328 [Cloud] Dequeued cloud request. 2026-09-22T06:42:08.328 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:42:08.484 [Cloud] End of cloud request. 2026-09-22T06:42:08.984 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:42:18.109 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:42:18.109 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:42:18.109 [Cloud] Queued cloud request. 2026-09-22T06:42:18.109 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:42:18.109 [Cloud] Dequeued cloud request. 2026-09-22T06:42:18.109 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:42:18.281 [Cloud] End of cloud request. 2026-09-22T06:42:18.781 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:42:32.016 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:42:32.016 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:42:32.016 [Cloud] Queued cloud request. 2026-09-22T06:42:32.016 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:42:32.016 [Cloud] Dequeued cloud request. 2026-09-22T06:42:32.016 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:42:32.156 [Cloud] End of cloud request. 2026-09-22T06:42:32.656 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:43:22.438 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:43:22.438 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:43:22.438 [Cloud] Queued cloud request. 2026-09-22T06:43:22.438 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:43:22.438 [Cloud] Dequeued cloud request. 2026-09-22T06:43:22.438 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:43:22.516 [Cloud] End of cloud request. 2026-09-22T06:43:23.031 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:46:47.922 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T06:50:57.941 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:50:57.941 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:50:57.941 [Cloud] Queued cloud request. 2026-09-22T06:50:57.941 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:50:57.941 [Cloud] Dequeued cloud request. 2026-09-22T06:50:57.941 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:50:58.097 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{09F9DE71-3E61-FADE-B201-217F8A729FE0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 06:50:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T06:50:58.597 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T06:52:52.441 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T06:52:52.441 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T06:52:52.441 [Cloud] Queued cloud request. 2026-09-22T06:52:52.441 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T06:52:52.441 [Cloud] Dequeued cloud request. 2026-09-22T06:52:52.441 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T06:52:52.644 [Cloud] End of cloud request. 2026-09-22T06:52:53.160 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T07:01:14.570 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T07:01:14.570 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T07:01:14.570 [Cloud] Queued cloud request. 2026-09-22T07:01:14.570 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T07:01:14.570 [Cloud] Dequeued cloud request. 2026-09-22T07:01:14.570 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T07:01:15.180 [Cloud] End of cloud request. 2026-09-22T07:01:15.695 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T07:01:52.930 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T07:06:02.790 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T07:06:02.790 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T07:06:02.790 [Cloud] Queued cloud request. 2026-09-22T07:06:02.790 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T07:06:02.790 [Cloud] Dequeued cloud request. 2026-09-22T07:06:02.790 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T07:06:03.072 [Cloud] End of cloud request. 2026-09-22T07:06:03.572 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T07:16:57.936 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T07:32:02.942 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T07:32:08.130 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T07:32:08.130 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T07:32:08.130 [Cloud] Queued cloud request. 2026-09-22T07:32:08.130 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T07:32:08.130 [Cloud] Dequeued cloud request. 2026-09-22T07:32:08.130 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T07:32:08.380 [Cloud] End of cloud request. 2026-09-22T07:32:08.880 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T07:35:48.647 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T07:35:48.647 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T07:35:48.647 [Cloud] Queued cloud request. 2026-09-22T07:35:48.647 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T07:35:48.647 [Cloud] Dequeued cloud request. 2026-09-22T07:35:48.647 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T07:35:48.913 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2899ADE9-0D83-C32C-1CB8-A9AB9085EE42} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 07:35:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T07:35:49.413 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T07:39:43.024 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 19088, Count: 1208, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-22T07:39:43.024 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 8679, Count: 715, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-22T07:39:43.024 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 5266, Count: 439, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-22T07:39:43.024 ProcessImageName: powershell.exe, Pid: 7380, TotalTime: 1353, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-22T07:39:43.024 ProcessImageName: AgentShellService.exe, Pid: 6244, TotalTime: 652, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 49% 2026-09-22T07:39:43.024 ProcessImageName: WmiPrvSE.exe, Pid: 3212, TotalTime: 629, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-22T07:39:43.024 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 469, Count: 31, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-22T07:39:43.024 ProcessImageName: powershell.exe, Pid: 3172, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-22T07:39:43.024 ProcessImageName: WmiPrvSE.exe, Pid: 7068, TotalTime: 248, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-22T07:39:43.024 ProcessImageName: python.exe, Pid: 6972, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-22T07:39:43.024 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-22T07:39:43.024 ProcessImageName: taskhostw.exe, Pid: 5396, TotalTime: 108, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-22T07:39:43.024 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-22T07:39:43.024 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e170-0.MAD, EstimatedImpact: 0% 2026-09-22T07:39:43.024 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_310F0D2B41E141D9BB9B40175EE173AC.MAI, EstimatedImpact: 48% 2026-09-22T07:39:43.024 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-22T07:39:43.024 ProcessImageName: DeviceCensus.exe, Pid: 5700, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-22T07:39:43.024 ProcessImageName: mysqldump.exe, Pid: 4824, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-22T07:39:43.024 ProcessImageName: powershell.exe, Pid: 612, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-22T07:39:43.024 ProcessImageName: ngentask.exe, Pid: 7296, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-22T07:39:43.024 ProcessImageName: powershell.exe, Pid: 7448, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpC32.tmp, EstimatedImpact: 0% 2026-09-22T07:39:43.024 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-22T07:39:43.024 ProcessImageName: cmd.exe, Pid: 1096, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-22T07:47:07.947 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T07:52:16.388 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T07:52:16.388 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T07:52:16.388 [Cloud] Queued cloud request. 2026-09-22T07:52:16.388 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T07:52:16.388 [Cloud] Dequeued cloud request. 2026-09-22T07:52:16.388 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T07:52:16.544 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{90ACBE93-5755-F7E8-719A-047E53ADB79E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 07:52:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T07:52:17.060 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:02:12.955 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T08:06:32.457 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:06:32.457 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:06:32.457 [Cloud] Queued cloud request. 2026-09-22T08:06:32.457 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:06:32.457 [Cloud] Dequeued cloud request. 2026-09-22T08:06:32.457 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:06:32.613 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9B40DE78-A18E-488E-3012-0FD836E1E1AA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 08:06:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T08:06:33.113 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:17:17.961 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T08:23:04.276 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:23:04.276 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:23:04.276 [Cloud] Queued cloud request. 2026-09-22T08:23:04.276 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:23:04.276 [Cloud] Dequeued cloud request. 2026-09-22T08:23:04.276 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:23:04.432 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4028FF9A-1944-DBB1-E387-365ECD011AC0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 08:23:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T08:23:04.932 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:25:35.730 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:25:35.730 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:25:35.730 [Cloud] Queued cloud request. 2026-09-22T08:25:35.730 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:25:35.730 [Cloud] Dequeued cloud request. 2026-09-22T08:25:35.730 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:25:35.871 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7474B5CD-59CA-22DF-CCB8-4EA8AF4E5AEB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 08:25:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T08:25:36.386 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:26:19.871 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:26:19.871 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:26:19.871 [Cloud] Queued cloud request. 2026-09-22T08:26:19.871 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:26:19.871 [Cloud] Dequeued cloud request. 2026-09-22T08:26:19.871 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:26:19.965 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E513E792-5334-30AC-C097-43977CD17787} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 08:26:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T08:26:20.465 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:32:22.967 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T08:32:27.248 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:32:27.248 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:32:27.248 [Cloud] Queued cloud request. 2026-09-22T08:32:27.248 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:32:27.248 [Cloud] Dequeued cloud request. 2026-09-22T08:32:27.248 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:32:27.389 [Cloud] End of cloud request. 2026-09-22T08:32:27.405 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:32:27.405 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:32:27.405 [Cloud] Queued cloud request. 2026-09-22T08:32:27.405 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:32:27.405 [Cloud] Dequeued cloud request. 2026-09-22T08:32:27.405 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:32:27.905 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:32:37.420 [Cloud] End of cloud request. 2026-09-22T08:32:37.936 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:34:56.686 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:34:56.686 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:34:56.686 [Cloud] Queued cloud request. 2026-09-22T08:34:56.686 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:34:56.686 [Cloud] Dequeued cloud request. 2026-09-22T08:34:56.686 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:34:56.842 [Cloud] End of cloud request. 2026-09-22T08:34:57.342 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:36:25.376 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:36:25.376 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:36:25.376 [Cloud] Queued cloud request. 2026-09-22T08:36:25.376 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:36:25.376 [Cloud] Dequeued cloud request. 2026-09-22T08:36:25.376 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:36:25.517 [Cloud] End of cloud request. 2026-09-22T08:36:26.017 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:38:12.721 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:38:12.721 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:38:12.721 [Cloud] Queued cloud request. 2026-09-22T08:38:12.721 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:38:12.721 [Cloud] Dequeued cloud request. 2026-09-22T08:38:12.721 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:38:12.877 [Cloud] End of cloud request. 2026-09-22T08:38:13.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:38:31.268 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:38:31.268 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:38:31.268 [Cloud] Queued cloud request. 2026-09-22T08:38:31.268 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:38:31.268 [Cloud] Dequeued cloud request. 2026-09-22T08:38:31.268 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:38:31.361 [Cloud] End of cloud request. 2026-09-22T08:38:31.877 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:38:54.518 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:38:54.518 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:38:54.518 [Cloud] Queued cloud request. 2026-09-22T08:38:54.518 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:38:54.518 [Cloud] Dequeued cloud request. 2026-09-22T08:38:54.518 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:38:54.596 [Cloud] End of cloud request. 2026-09-22T08:38:55.096 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:41:19.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:41:19.925 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:41:19.925 [Cloud] Queued cloud request. 2026-09-22T08:41:19.925 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:41:19.925 [Cloud] Dequeued cloud request. 2026-09-22T08:41:19.925 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:41:20.097 [Cloud] End of cloud request. 2026-09-22T08:41:20.597 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:43:05.956 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:43:05.956 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:43:05.956 [Cloud] Queued cloud request. 2026-09-22T08:43:05.956 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:43:05.956 [Cloud] Dequeued cloud request. 2026-09-22T08:43:05.956 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:43:06.128 [Cloud] End of cloud request. 2026-09-22T08:43:06.644 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:44:37.472 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:44:37.472 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:44:37.472 [Cloud] Queued cloud request. 2026-09-22T08:44:37.472 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:44:37.472 [Cloud] Dequeued cloud request. 2026-09-22T08:44:37.472 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:44:37.644 [Cloud] End of cloud request. 2026-09-22T08:44:38.144 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:46:10.332 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:46:10.332 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:46:10.332 [Cloud] Queued cloud request. 2026-09-22T08:46:10.332 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:46:10.332 [Cloud] Dequeued cloud request. 2026-09-22T08:46:10.332 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:46:10.520 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{316A0425-D7AD-7583-26D4-170459F46393} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 08:46:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T08:46:11.020 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:47:27.974 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T08:49:25.788 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:49:25.788 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:49:25.788 [Cloud] Queued cloud request. 2026-09-22T08:49:25.788 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:49:25.788 [Cloud] Dequeued cloud request. 2026-09-22T08:49:25.788 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:49:25.975 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5D500680-43E6-83BB-F96B-55EA1292C4E5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 08:49:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T08:49:26.475 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:49:54.788 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:49:54.788 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:49:54.788 [Cloud] Queued cloud request. 2026-09-22T08:49:54.788 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:49:54.788 [Cloud] Dequeued cloud request. 2026-09-22T08:49:54.788 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:49:55.413 [Cloud] End of cloud request. 2026-09-22T08:49:55.929 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:55:23.367 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:55:23.367 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:55:23.367 [Cloud] Queued cloud request. 2026-09-22T08:55:23.367 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:55:23.367 [Cloud] Dequeued cloud request. 2026-09-22T08:55:23.367 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:55:25.226 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A58D369B-6CA3-AE85-32F2-D13A5561C9B6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 08:55:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T08:55:25.742 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:56:39.321 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:56:39.321 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:56:39.321 [Cloud] Queued cloud request. 2026-09-22T08:56:39.321 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:56:39.321 [Cloud] Dequeued cloud request. 2026-09-22T08:56:39.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:56:39.509 [Cloud] End of cloud request. 2026-09-22T08:56:40.025 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:56:45.446 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:56:45.446 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:56:45.446 [Cloud] Queued cloud request. 2026-09-22T08:56:45.446 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:56:45.446 [Cloud] Dequeued cloud request. 2026-09-22T08:56:45.446 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:56:45.587 [Cloud] End of cloud request. 2026-09-22T08:56:46.103 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:57:33.229 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:57:33.229 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:57:33.229 [Cloud] Queued cloud request. 2026-09-22T08:57:33.229 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:57:33.229 [Cloud] Dequeued cloud request. 2026-09-22T08:57:33.229 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:57:33.401 [Cloud] End of cloud request. 2026-09-22T08:57:33.901 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T08:58:36.261 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T08:58:36.261 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T08:58:36.261 [Cloud] Queued cloud request. 2026-09-22T08:58:36.261 [Cloud] Dequeued cloud request. 2026-09-22T08:58:36.261 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T08:58:36.261 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T08:58:36.401 [Cloud] End of cloud request. 2026-09-22T08:58:36.917 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:00:45.683 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:00:45.683 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:00:45.683 [Cloud] Queued cloud request. 2026-09-22T09:00:45.683 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:00:45.683 [Cloud] Dequeued cloud request. 2026-09-22T09:00:45.683 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:00:45.870 [Cloud] End of cloud request. 2026-09-22T09:00:46.370 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:01:38.355 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:01:38.355 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:01:38.355 [Cloud] Queued cloud request. 2026-09-22T09:01:38.355 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:01:38.355 [Cloud] Dequeued cloud request. 2026-09-22T09:01:38.355 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:01:39.308 [Cloud] End of cloud request. 2026-09-22T09:01:39.808 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:02:27.261 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:02:27.261 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:02:27.261 [Cloud] Queued cloud request. 2026-09-22T09:02:27.261 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:02:27.261 [Cloud] Dequeued cloud request. 2026-09-22T09:02:27.261 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:02:27.339 [Cloud] End of cloud request. 2026-09-22T09:02:27.855 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:02:32.980 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T09:02:49.777 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:02:49.777 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:02:49.777 [Cloud] Queued cloud request. 2026-09-22T09:02:49.777 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:02:49.777 [Cloud] Dequeued cloud request. 2026-09-22T09:02:49.777 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:02:50.214 [Cloud] End of cloud request. 2026-09-22T09:02:50.730 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:03:41.480 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:03:41.480 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:03:41.480 [Cloud] Queued cloud request. 2026-09-22T09:03:41.480 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:03:41.480 [Cloud] Dequeued cloud request. 2026-09-22T09:03:41.480 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:03:41.605 [Cloud] End of cloud request. 2026-09-22T09:03:42.105 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:03:56.761 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:03:56.761 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:03:56.761 [Cloud] Queued cloud request. 2026-09-22T09:03:56.761 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:03:56.761 [Cloud] Dequeued cloud request. 2026-09-22T09:03:56.761 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:03:56.980 [Cloud] End of cloud request. 2026-09-22T09:03:57.480 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:08:56.046 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:08:56.046 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:08:56.046 [Cloud] Queued cloud request. 2026-09-22T09:08:56.046 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:08:56.046 [Cloud] Dequeued cloud request. 2026-09-22T09:08:56.046 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:09:06.124 [Cloud] End of cloud request. 2026-09-22T09:09:06.640 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:09:16.202 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:09:16.202 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:09:16.202 [Cloud] Queued cloud request. 2026-09-22T09:09:16.202 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:09:16.202 [Cloud] Dequeued cloud request. 2026-09-22T09:09:16.202 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:09:16.343 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0510E4FF-6AFD-AD57-A8C7-1704FE57B222} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 09:09:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T09:09:16.859 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:09:39.734 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:09:39.734 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:09:39.734 [Cloud] Queued cloud request. 2026-09-22T09:09:39.734 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:09:39.984 [Cloud] Dequeued cloud request. 2026-09-22T09:09:39.984 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:09:40.062 [Cloud] End of cloud request. 2026-09-22T09:09:40.577 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:10:07.468 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:10:07.468 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:10:07.468 [Cloud] Queued cloud request. 2026-09-22T09:10:07.468 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:10:07.468 [Cloud] Dequeued cloud request. 2026-09-22T09:10:07.468 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:10:07.624 [Cloud] End of cloud request. 2026-09-22T09:10:08.140 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:10:46.202 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:10:46.202 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:10:46.202 [Cloud] Queued cloud request. 2026-09-22T09:10:46.202 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:10:46.202 [Cloud] Dequeued cloud request. 2026-09-22T09:10:46.202 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:10:46.343 [Cloud] End of cloud request. 2026-09-22T09:10:46.843 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:10:58.656 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:10:58.656 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:10:58.656 [Cloud] Queued cloud request. 2026-09-22T09:10:58.656 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:10:58.656 [Cloud] Dequeued cloud request. 2026-09-22T09:10:58.656 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:10:58.734 [Cloud] End of cloud request. 2026-09-22T09:10:59.234 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:16:35.549 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:16:35.549 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:16:35.549 [Cloud] Queued cloud request. 2026-09-22T09:16:35.549 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:16:35.549 [Cloud] Dequeued cloud request. 2026-09-22T09:16:35.549 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:16:35.768 [Cloud] End of cloud request. 2026-09-22T09:16:36.283 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:17:00.596 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:17:00.596 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:17:00.596 [Cloud] Queued cloud request. 2026-09-22T09:17:00.596 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:17:00.596 [Cloud] Dequeued cloud request. 2026-09-22T09:17:00.596 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:17:00.674 [Cloud] End of cloud request. 2026-09-22T09:17:01.174 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:17:37.988 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T09:18:20.957 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:18:20.957 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:18:20.957 [Cloud] Queued cloud request. 2026-09-22T09:18:20.957 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:18:20.957 [Cloud] Dequeued cloud request. 2026-09-22T09:18:20.957 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:18:21.160 [Cloud] End of cloud request. 2026-09-22T09:18:21.675 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:30:47.836 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:30:47.836 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:30:47.836 [Cloud] Queued cloud request. 2026-09-22T09:30:47.836 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:30:47.836 [Cloud] Dequeued cloud request. 2026-09-22T09:30:47.836 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:30:48.008 [Cloud] End of cloud request. 2026-09-22T09:30:48.508 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:30:51.461 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:30:51.461 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:30:51.461 [Cloud] Queued cloud request. 2026-09-22T09:30:51.461 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:30:51.461 [Cloud] Dequeued cloud request. 2026-09-22T09:30:51.461 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:30:51.586 [Cloud] End of cloud request. 2026-09-22T09:30:52.102 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{2F9C5478-5751-7F5C-8FFB-A614D927AAB6} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-22-2026 09:32:09 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T09:32:11.305 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:32:11.305 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:32:11.305 [Cloud] Queued cloud request. 2026-09-22T09:32:11.305 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:32:11.305 [Cloud] Dequeued cloud request. 2026-09-22T09:32:11.305 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:32:11.649 [Cloud] End of cloud request. 2026-09-22T09:32:12.164 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:32:28.368 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:32:28.368 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:32:28.368 [Cloud] Queued cloud request. 2026-09-22T09:32:28.368 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:32:28.368 [Cloud] Dequeued cloud request. 2026-09-22T09:32:28.368 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:32:28.446 [Cloud] End of cloud request. 2026-09-22T09:32:28.946 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:32:42.993 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T09:33:48.321 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:33:48.321 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:33:48.321 [Cloud] Queued cloud request. 2026-09-22T09:33:48.321 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:33:48.321 [Cloud] Dequeued cloud request. 2026-09-22T09:33:48.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:33:48.461 [Cloud] End of cloud request. 2026-09-22T09:33:48.977 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:34:18.305 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:34:18.305 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:34:18.305 [Cloud] Queued cloud request. 2026-09-22T09:34:18.305 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:34:18.305 [Cloud] Dequeued cloud request. 2026-09-22T09:34:18.305 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:34:18.383 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{37056905-A675-A3BD-2B01-DF37273B2886} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 09:34:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T09:34:18.883 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:35:44.775 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:35:44.775 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:35:44.775 [Cloud] Queued cloud request. 2026-09-22T09:35:44.775 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:35:44.775 [Cloud] Dequeued cloud request. 2026-09-22T09:35:44.775 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:35:44.916 [Cloud] End of cloud request. 2026-09-22T09:35:45.416 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:36:15.010 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:36:15.010 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:36:15.010 [Cloud] Queued cloud request. 2026-09-22T09:36:15.010 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:36:15.010 [Cloud] Dequeued cloud request. 2026-09-22T09:36:15.010 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:36:15.088 [Cloud] End of cloud request. 2026-09-22T09:36:15.603 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:39:31.153 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:39:31.153 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:39:31.153 [Cloud] Queued cloud request. 2026-09-22T09:39:31.153 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:39:31.153 [Cloud] Dequeued cloud request. 2026-09-22T09:39:31.153 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:39:31.309 [Cloud] End of cloud request. 2026-09-22T09:39:31.809 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:39:43.074 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 22190, Count: 1463, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-22T09:39:43.074 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 10783, Count: 892, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-22T09:39:43.074 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 5266, Count: 439, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-22T09:39:43.074 ProcessImageName: powershell.exe, Pid: 7380, TotalTime: 1353, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-22T09:39:43.074 ProcessImageName: AgentShellService.exe, Pid: 6244, TotalTime: 652, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 49% 2026-09-22T09:39:43.074 ProcessImageName: WmiPrvSE.exe, Pid: 3212, TotalTime: 629, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-22T09:39:43.074 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 499, Count: 33, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-22T09:39:43.074 ProcessImageName: powershell.exe, Pid: 3172, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-22T09:39:43.074 ProcessImageName: WmiPrvSE.exe, Pid: 7068, TotalTime: 248, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-22T09:39:43.074 ProcessImageName: python.exe, Pid: 6972, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-22T09:39:43.074 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-22T09:39:43.074 ProcessImageName: taskhostw.exe, Pid: 5396, TotalTime: 108, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-22T09:39:43.074 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-22T09:39:43.074 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e170-0.MAD, EstimatedImpact: 0% 2026-09-22T09:39:43.074 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_310F0D2B41E141D9BB9B40175EE173AC.MAI, EstimatedImpact: 48% 2026-09-22T09:39:43.074 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-22T09:39:43.074 ProcessImageName: DeviceCensus.exe, Pid: 5700, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-22T09:39:43.074 ProcessImageName: mysqldump.exe, Pid: 4824, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-22T09:39:43.074 ProcessImageName: powershell.exe, Pid: 612, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-22T09:39:43.074 ProcessImageName: ngentask.exe, Pid: 7296, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-22T09:39:43.074 ProcessImageName: powershell.exe, Pid: 7448, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpC32.tmp, EstimatedImpact: 0% 2026-09-22T09:39:43.074 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-22T09:39:43.074 ProcessImageName: cmd.exe, Pid: 1096, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-22T09:42:29.043 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:42:29.043 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:42:29.043 [Cloud] Queued cloud request. 2026-09-22T09:42:29.043 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:42:29.043 [Cloud] Dequeued cloud request. 2026-09-22T09:42:29.043 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:42:29.199 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9187826E-228C-99F4-65F4-BEC8C134FA2C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 09:42:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T09:42:29.715 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:45:21.389 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:45:21.389 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:45:21.389 [Cloud] Queued cloud request. 2026-09-22T09:45:21.389 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:45:21.389 [Cloud] Dequeued cloud request. 2026-09-22T09:45:21.389 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:45:21.561 [Cloud] End of cloud request. 2026-09-22T09:45:22.061 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:47:48.000 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T09:51:54.329 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:51:54.329 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:51:54.329 [Cloud] Queued cloud request. 2026-09-22T09:51:54.329 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:51:54.329 [Cloud] Dequeued cloud request. 2026-09-22T09:51:54.329 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:51:54.485 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{936ACC38-6FD8-6C38-1611-093100A39EB2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 09:51:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T09:51:55.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:52:12.751 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:52:12.751 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:52:12.751 [Cloud] Queued cloud request. 2026-09-22T09:52:12.751 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:52:12.751 [Cloud] Dequeued cloud request. 2026-09-22T09:52:12.751 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:52:12.829 [Cloud] End of cloud request. 2026-09-22T09:52:13.329 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:52:16.844 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:52:16.844 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:52:16.844 [Cloud] Queued cloud request. 2026-09-22T09:52:16.844 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:52:16.844 [Cloud] Dequeued cloud request. 2026-09-22T09:52:16.844 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:52:17.016 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6BFBB76A-223F-2859-B7B7-9684A9B3E79B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 09:52:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T09:52:17.516 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:56:48.941 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:56:48.941 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:56:48.941 [Cloud] Queued cloud request. 2026-09-22T09:56:48.941 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:56:48.941 [Cloud] Dequeued cloud request. 2026-09-22T09:56:48.941 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:56:49.175 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DD2AF484-7857-4E1E-399A-CB9537C944A2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 09:56:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T09:56:49.691 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:57:01.613 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:57:01.613 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:57:01.613 [Cloud] Queued cloud request. 2026-09-22T09:57:01.613 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:57:01.613 [Cloud] Dequeued cloud request. 2026-09-22T09:57:01.613 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:57:01.706 [Cloud] End of cloud request. 2026-09-22T09:57:02.206 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T09:57:30.629 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T09:57:30.629 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T09:57:30.629 [Cloud] Queued cloud request. 2026-09-22T09:57:30.629 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T09:57:30.629 [Cloud] Dequeued cloud request. 2026-09-22T09:57:30.629 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T09:57:30.723 [Cloud] End of cloud request. 2026-09-22T09:57:31.239 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:01:55.724 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:01:55.724 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:01:55.724 [Cloud] Queued cloud request. 2026-09-22T10:01:55.724 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:01:55.724 [Cloud] Dequeued cloud request. 2026-09-22T10:01:55.724 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:01:55.881 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{22B8BBA1-DB03-8A92-9469-1B657053FC6D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 10:01:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T10:01:56.396 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:02:02.568 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:02:02.568 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:02:02.568 [Cloud] Queued cloud request. 2026-09-22T10:02:02.568 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:02:02.568 [Cloud] Dequeued cloud request. 2026-09-22T10:02:02.568 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:02:02.646 [Cloud] End of cloud request. 2026-09-22T10:02:03.146 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:02:47.568 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:02:47.568 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:02:47.568 [Cloud] Queued cloud request. 2026-09-22T10:02:47.568 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:02:47.568 [Cloud] Dequeued cloud request. 2026-09-22T10:02:47.568 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:02:47.693 [Cloud] End of cloud request. 2026-09-22T10:02:48.209 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:02:53.006 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T10:03:29.318 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:03:29.318 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:03:29.318 [Cloud] Queued cloud request. 2026-09-22T10:03:29.318 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:03:29.318 [Cloud] Dequeued cloud request. 2026-09-22T10:03:29.318 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:03:29.427 [Cloud] End of cloud request. 2026-09-22T10:03:29.927 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:04:50.365 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:04:50.365 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:04:50.365 [Cloud] Queued cloud request. 2026-09-22T10:04:50.365 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:04:50.365 [Cloud] Dequeued cloud request. 2026-09-22T10:04:50.365 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:04:50.521 [Cloud] End of cloud request. 2026-09-22T10:04:51.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:06:07.883 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:06:07.883 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:06:07.883 [Cloud] Queued cloud request. 2026-09-22T10:06:07.883 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:06:07.883 [Cloud] Dequeued cloud request. 2026-09-22T10:06:07.883 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:06:08.023 [Cloud] End of cloud request. 2026-09-22T10:06:08.523 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:08:51.307 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:08:51.307 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:08:51.307 [Cloud] Queued cloud request. 2026-09-22T10:08:51.307 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:08:51.307 [Cloud] Dequeued cloud request. 2026-09-22T10:08:51.307 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:08:51.463 [Cloud] End of cloud request. 2026-09-22T10:08:51.963 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:09:27.541 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:09:27.541 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:09:27.541 [Cloud] Queued cloud request. 2026-09-22T10:09:27.541 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:09:27.541 [Cloud] Dequeued cloud request. 2026-09-22T10:09:27.541 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:09:27.619 [Cloud] End of cloud request. 2026-09-22T10:09:28.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:12:35.479 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:12:35.479 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:12:35.479 [Cloud] Queued cloud request. 2026-09-22T10:12:35.479 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:12:35.479 [Cloud] Dequeued cloud request. 2026-09-22T10:12:35.479 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:12:35.697 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FF2FC020-DA50-4A45-5688-9B6B59C44BD4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 10:12:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T10:12:36.197 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:13:52.057 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:13:52.057 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:13:52.057 [Cloud] Queued cloud request. 2026-09-22T10:13:52.057 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:13:52.057 [Cloud] Dequeued cloud request. 2026-09-22T10:13:52.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:13:52.213 [Cloud] End of cloud request. 2026-09-22T10:13:52.713 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:16:48.995 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:16:48.995 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:16:48.995 [Cloud] Queued cloud request. 2026-09-22T10:16:48.995 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:16:48.995 [Cloud] Dequeued cloud request. 2026-09-22T10:16:48.995 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:16:49.136 [Cloud] End of cloud request. 2026-09-22T10:16:49.651 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:17:14.933 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:17:14.933 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:17:14.933 [Cloud] Queued cloud request. 2026-09-22T10:17:14.933 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:17:14.933 [Cloud] Dequeued cloud request. 2026-09-22T10:17:14.933 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:17:16.120 [Cloud] End of cloud request. 2026-09-22T10:17:16.636 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:17:20.168 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:17:20.168 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:17:20.168 [Cloud] Queued cloud request. 2026-09-22T10:17:20.168 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:17:20.168 [Cloud] Dequeued cloud request. 2026-09-22T10:17:20.168 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:17:20.246 [Cloud] End of cloud request. 2026-09-22T10:17:20.746 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:17:58.014 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T10:21:10.264 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:21:10.264 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:21:10.264 [Cloud] Queued cloud request. 2026-09-22T10:21:10.264 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:21:10.264 [Cloud] Dequeued cloud request. 2026-09-22T10:21:10.264 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:21:10.498 [Cloud] End of cloud request. 2026-09-22T10:21:11.014 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:33:03.018 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T10:33:17.158 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:33:17.158 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:33:17.158 [Cloud] Queued cloud request. 2026-09-22T10:33:17.158 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:33:17.158 [Cloud] Dequeued cloud request. 2026-09-22T10:33:17.158 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:33:17.362 [Cloud] End of cloud request. 2026-09-22T10:33:17.862 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:33:32.533 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:33:32.533 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:33:32.533 [Cloud] Queued cloud request. 2026-09-22T10:33:32.533 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:33:32.533 [Cloud] Dequeued cloud request. 2026-09-22T10:33:32.533 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:33:32.612 [Cloud] End of cloud request. 2026-09-22T10:33:33.112 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:35:33.705 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:35:33.705 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:35:33.705 [Cloud] Queued cloud request. 2026-09-22T10:35:33.705 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:35:33.705 [Cloud] Dequeued cloud request. 2026-09-22T10:35:33.705 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:35:33.908 [Cloud] End of cloud request. 2026-09-22T10:35:34.408 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:36:32.520 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:36:32.520 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:36:32.520 [Cloud] Queued cloud request. 2026-09-22T10:36:32.520 [Cloud] Dequeued cloud request. 2026-09-22T10:36:32.520 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:36:32.520 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:36:32.629 [Cloud] End of cloud request. 2026-09-22T10:36:33.145 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:37:51.162 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:37:51.162 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:37:51.162 [Cloud] Queued cloud request. 2026-09-22T10:37:51.162 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:37:51.162 [Cloud] Dequeued cloud request. 2026-09-22T10:37:51.162 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:37:51.349 [Cloud] End of cloud request. 2026-09-22T10:37:51.849 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:46:48.664 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:46:48.664 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:46:48.664 [Cloud] Queued cloud request. 2026-09-22T10:46:48.664 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:46:48.664 [Cloud] Dequeued cloud request. 2026-09-22T10:46:48.664 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:46:48.820 [Cloud] End of cloud request. 2026-09-22T10:46:49.320 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T10:48:08.026 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T10:49:28.495 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T10:49:28.495 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T10:49:28.495 [Cloud] Queued cloud request. 2026-09-22T10:49:28.495 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T10:49:28.495 [Cloud] Dequeued cloud request. 2026-09-22T10:49:28.495 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T10:49:28.651 [Cloud] End of cloud request. 2026-09-22T10:49:29.166 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:01:05.703 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:01:05.703 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:01:05.703 [Cloud] Queued cloud request. 2026-09-22T11:01:05.703 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:01:05.703 [Cloud] Dequeued cloud request. 2026-09-22T11:01:05.703 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:01:06.437 [Cloud] End of cloud request. 2026-09-22T11:01:06.937 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:03:13.031 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T11:09:50.473 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:09:50.473 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:09:50.473 [Cloud] Queued cloud request. 2026-09-22T11:09:50.473 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:09:50.473 [Cloud] Dequeued cloud request. 2026-09-22T11:09:50.473 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:09:50.676 [Cloud] End of cloud request. 2026-09-22T11:09:51.192 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:14:18.943 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:14:18.943 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:14:18.943 [Cloud] Queued cloud request. 2026-09-22T11:14:18.943 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:14:18.943 [Cloud] Dequeued cloud request. 2026-09-22T11:14:18.943 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:14:19.100 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{78358DC7-C68E-5E80-0C0D-86AC14EE1D34} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 11:14:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T11:14:19.600 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:18:18.039 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T11:20:21.321 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:20:21.321 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:20:21.321 [Cloud] Queued cloud request. 2026-09-22T11:20:21.321 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:20:21.321 [Cloud] Dequeued cloud request. 2026-09-22T11:20:21.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:20:21.493 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EB55C1A3-8112-27DA-E0B6-F52C7E7E2C9C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 11:20:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T11:20:21.993 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:23:58.399 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:23:58.399 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:23:58.399 [Cloud] Queued cloud request. 2026-09-22T11:23:58.399 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:23:58.399 [Cloud] Dequeued cloud request. 2026-09-22T11:23:58.399 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:24:08.477 [Cloud] End of cloud request. 2026-09-22T11:24:08.993 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:25:08.197 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:25:08.197 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:25:08.197 [Cloud] Queued cloud request. 2026-09-22T11:25:08.197 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:25:08.197 [Cloud] Dequeued cloud request. 2026-09-22T11:25:08.197 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:25:08.290 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C1E81F13-E74A-95FF-1E82-6B9B9E8DAF61} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 11:25:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T11:25:08.806 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:32:37.483 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:32:37.483 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:32:37.483 [Cloud] Queued cloud request. 2026-09-22T11:32:37.483 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:32:37.483 [Cloud] Dequeued cloud request. 2026-09-22T11:32:37.483 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:32:37.733 [Cloud] End of cloud request. 2026-09-22T11:32:38.233 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:32:51.936 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:32:51.936 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:32:51.936 [Cloud] Queued cloud request. 2026-09-22T11:32:51.936 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:32:51.936 [Cloud] Dequeued cloud request. 2026-09-22T11:32:51.936 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:32:52.014 [Cloud] End of cloud request. 2026-09-22T11:32:52.514 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:33:23.045 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T11:33:51.436 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:33:51.436 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:33:51.436 [Cloud] Queued cloud request. 2026-09-22T11:33:51.436 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:33:51.436 [Cloud] Dequeued cloud request. 2026-09-22T11:33:51.436 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:33:51.514 [Cloud] End of cloud request. 2026-09-22T11:33:52.014 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:35:39.545 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:35:39.545 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:35:39.545 [Cloud] Queued cloud request. 2026-09-22T11:35:39.545 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:35:39.545 [Cloud] Dequeued cloud request. 2026-09-22T11:35:39.545 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:35:39.701 [Cloud] End of cloud request. 2026-09-22T11:35:40.201 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:35:54.264 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:35:54.264 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:35:54.264 [Cloud] Queued cloud request. 2026-09-22T11:35:54.264 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:35:54.264 [Cloud] Dequeued cloud request. 2026-09-22T11:35:54.264 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:35:55.452 [Cloud] End of cloud request. 2026-09-22T11:35:55.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:38:55.471 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:38:55.471 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:38:55.471 [Cloud] Queued cloud request. 2026-09-22T11:38:55.471 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:38:55.471 [Cloud] Dequeued cloud request. 2026-09-22T11:38:55.471 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:38:55.612 [Cloud] End of cloud request. 2026-09-22T11:38:56.112 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:39:43.143 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 22711, Count: 1489, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-22T11:39:43.143 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 12859, Count: 1067, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-22T11:39:43.143 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 5266, Count: 439, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-22T11:39:43.143 ProcessImageName: powershell.exe, Pid: 7380, TotalTime: 1353, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-22T11:39:43.143 ProcessImageName: AgentShellService.exe, Pid: 6244, TotalTime: 652, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 49% 2026-09-22T11:39:43.143 ProcessImageName: WmiPrvSE.exe, Pid: 3212, TotalTime: 629, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-22T11:39:43.143 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 559, Count: 37, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-22T11:39:43.143 ProcessImageName: WmiPrvSE.exe, Pid: 6968, TotalTime: 439, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 39% 2026-09-22T11:39:43.143 ProcessImageName: powershell.exe, Pid: 3172, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-22T11:39:43.143 ProcessImageName: WmiPrvSE.exe, Pid: 7068, TotalTime: 248, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-22T11:39:43.143 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 180, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-22T11:39:43.143 ProcessImageName: python.exe, Pid: 6972, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-22T11:39:43.143 ProcessImageName: taskhostw.exe, Pid: 5396, TotalTime: 108, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-22T11:39:43.143 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-22T11:39:43.143 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e170-0.MAD, EstimatedImpact: 0% 2026-09-22T11:39:43.143 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_310F0D2B41E141D9BB9B40175EE173AC.MAI, EstimatedImpact: 48% 2026-09-22T11:39:43.143 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-22T11:39:43.143 ProcessImageName: DeviceCensus.exe, Pid: 5700, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-22T11:39:43.143 ProcessImageName: mysqldump.exe, Pid: 4824, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-22T11:39:43.143 ProcessImageName: powershell.exe, Pid: 612, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-22T11:39:43.143 ProcessImageName: ngentask.exe, Pid: 7296, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-22T11:39:43.143 ProcessImageName: powershell.exe, Pid: 7448, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpC32.tmp, EstimatedImpact: 0% 2026-09-22T11:39:43.143 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-22T11:39:43.143 ProcessImageName: cmd.exe, Pid: 1096, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-22T11:45:33.268 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:45:33.268 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:45:33.268 [Cloud] Queued cloud request. 2026-09-22T11:45:33.268 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:45:33.268 [Cloud] Dequeued cloud request. 2026-09-22T11:45:33.268 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:45:33.456 [Cloud] End of cloud request. 2026-09-22T11:45:33.972 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:48:28.053 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T11:53:51.867 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:53:51.867 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:53:51.867 [Cloud] Queued cloud request. 2026-09-22T11:53:51.867 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:53:51.867 [Cloud] Dequeued cloud request. 2026-09-22T11:53:51.867 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:53:52.070 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C515D2F4-23E2-C9C1-6859-27121B16CD04} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 11:53:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T11:53:52.570 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T11:57:57.933 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T11:57:57.933 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T11:57:57.933 [Cloud] Queued cloud request. 2026-09-22T11:57:57.933 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T11:57:57.933 [Cloud] Dequeued cloud request. 2026-09-22T11:57:57.933 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T11:57:58.136 [Cloud] End of cloud request. 2026-09-22T11:57:58.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:03:33.059 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T12:07:20.031 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:07:20.031 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:07:20.031 [Cloud] Queued cloud request. 2026-09-22T12:07:20.031 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:07:20.031 [Cloud] Dequeued cloud request. 2026-09-22T12:07:20.031 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:07:20.218 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FC5CC4BC-3720-AAA9-FC93-F6F7B12DD972} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 12:07:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T12:07:20.734 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:08:34.047 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:08:34.047 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:08:34.047 [Cloud] Queued cloud request. 2026-09-22T12:08:34.047 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:08:34.047 [Cloud] Dequeued cloud request. 2026-09-22T12:08:34.047 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:08:34.204 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ACE67451-819A-ABCD-2B83-C6825D560F5B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 12:08:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T12:08:34.719 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:18:38.068 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T12:19:07.584 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:19:07.584 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:19:07.584 [Cloud] Queued cloud request. 2026-09-22T12:19:07.584 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:19:07.584 [Cloud] Dequeued cloud request. 2026-09-22T12:19:07.584 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:19:07.740 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{59A478C3-D245-8F3A-7DB8-5DD13F1AE3BA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 12:19:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T12:19:08.240 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:27:13.462 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:27:13.462 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:27:13.462 [Cloud] Queued cloud request. 2026-09-22T12:27:13.462 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:27:13.649 [Cloud] Dequeued cloud request. 2026-09-22T12:27:13.649 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:27:13.821 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C91F2384-ED2E-DFE2-DE8B-1B5882494C8B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 12:27:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T12:27:14.321 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:31:26.323 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:31:26.323 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:31:26.323 [Cloud] Queued cloud request. 2026-09-22T12:31:26.323 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:31:26.323 [Cloud] Dequeued cloud request. 2026-09-22T12:31:26.323 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:31:26.589 [Cloud] End of cloud request. 2026-09-22T12:31:27.089 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:33:21.652 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:33:21.652 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:33:21.652 [Cloud] Queued cloud request. 2026-09-22T12:33:21.652 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:33:21.652 [Cloud] Dequeued cloud request. 2026-09-22T12:33:21.652 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:33:21.839 [Cloud] End of cloud request. 2026-09-22T12:33:22.339 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:33:43.073 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T12:34:43.980 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:34:43.980 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:34:43.980 [Cloud] Queued cloud request. 2026-09-22T12:34:43.980 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:34:43.980 [Cloud] Dequeued cloud request. 2026-09-22T12:34:43.980 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:34:44.152 [Cloud] End of cloud request. 2026-09-22T12:34:44.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:46:30.893 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:46:30.893 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:46:30.893 [Cloud] Queued cloud request. 2026-09-22T12:46:30.893 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:46:30.893 [Cloud] Dequeued cloud request. 2026-09-22T12:46:30.893 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:46:31.080 [Cloud] End of cloud request. 2026-09-22T12:46:31.596 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:48:48.082 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T12:49:32.473 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:49:32.473 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:49:32.473 [Cloud] Queued cloud request. 2026-09-22T12:49:32.473 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:49:32.473 [Cloud] Dequeued cloud request. 2026-09-22T12:49:32.473 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:49:32.661 [Cloud] End of cloud request. 2026-09-22T12:49:33.161 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:50:08.457 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:50:08.457 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:50:08.457 [Cloud] Queued cloud request. 2026-09-22T12:50:08.457 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:50:08.457 [Cloud] Dequeued cloud request. 2026-09-22T12:50:08.457 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:50:18.145 [Cloud] End of cloud request. 2026-09-22T12:50:18.645 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:53:34.848 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:53:34.848 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:53:34.848 [Cloud] Queued cloud request. 2026-09-22T12:53:34.848 [Cloud] Dequeued cloud request. 2026-09-22T12:53:34.848 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:53:34.848 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:53:35.051 [Cloud] End of cloud request. 2026-09-22T12:53:35.567 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:53:39.864 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:53:39.864 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:53:39.864 [Cloud] Queued cloud request. 2026-09-22T12:53:39.864 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:53:39.864 [Cloud] Dequeued cloud request. 2026-09-22T12:53:39.864 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:53:39.958 [Cloud] End of cloud request. 2026-09-22T12:53:40.473 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:55:58.240 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:55:58.240 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:55:58.240 [Cloud] Queued cloud request. 2026-09-22T12:55:58.240 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:55:58.240 [Cloud] Dequeued cloud request. 2026-09-22T12:55:58.240 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:55:58.427 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C06CDCC-5816-167C-49A0-74F2205E5F01} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 12:55:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T12:55:58.927 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T12:59:00.181 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T12:59:00.181 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T12:59:00.181 [Cloud] Queued cloud request. 2026-09-22T12:59:00.181 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T12:59:00.181 [Cloud] Dequeued cloud request. 2026-09-22T12:59:00.181 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T12:59:00.446 [Cloud] End of cloud request. 2026-09-22T12:59:00.946 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T13:03:53.087 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T13:04:34.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T13:04:34.337 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T13:04:34.337 [Cloud] Queued cloud request. 2026-09-22T13:04:34.337 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T13:04:34.337 [Cloud] Dequeued cloud request. 2026-09-22T13:04:34.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T13:04:34.665 [Cloud] End of cloud request. 2026-09-22T13:04:35.181 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T13:18:58.096 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T13:27:48.491 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T13:27:48.491 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T13:27:48.491 [Cloud] Queued cloud request. 2026-09-22T13:27:48.491 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T13:27:48.491 [Cloud] Dequeued cloud request. 2026-09-22T13:27:48.491 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T13:27:48.679 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0DC98CB3-870C-2066-FA38-28CE64FF3F77} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 13:27:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T13:27:49.195 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T13:31:23.163 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T13:31:23.163 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T13:31:23.163 [Cloud] Queued cloud request. 2026-09-22T13:31:23.163 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T13:31:23.163 [Cloud] Dequeued cloud request. 2026-09-22T13:31:23.163 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T13:31:23.366 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9F167C06-CF4E-CE5E-4B4F-9F131AE59844} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 13:31:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T13:31:23.882 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T13:34:03.101 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T13:39:43.216 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 23002, Count: 1503, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-22T13:39:43.216 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 14916, Count: 1244, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-22T13:39:43.216 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 5266, Count: 439, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-22T13:39:43.216 ProcessImageName: powershell.exe, Pid: 7380, TotalTime: 1353, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-22T13:39:43.216 ProcessImageName: AgentShellService.exe, Pid: 6244, TotalTime: 652, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 49% 2026-09-22T13:39:43.216 ProcessImageName: WmiPrvSE.exe, Pid: 3212, TotalTime: 629, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-22T13:39:43.216 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 605, Count: 39, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-22T13:39:43.216 ProcessImageName: WmiPrvSE.exe, Pid: 6968, TotalTime: 439, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 39% 2026-09-22T13:39:43.216 ProcessImageName: powershell.exe, Pid: 3172, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-22T13:39:43.216 ProcessImageName: WmiPrvSE.exe, Pid: 7068, TotalTime: 248, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-22T13:39:43.216 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-22T13:39:43.216 ProcessImageName: python.exe, Pid: 6972, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-22T13:39:43.216 ProcessImageName: taskhostw.exe, Pid: 5396, TotalTime: 108, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-22T13:39:43.216 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-22T13:39:43.216 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e170-0.MAD, EstimatedImpact: 0% 2026-09-22T13:39:43.216 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_310F0D2B41E141D9BB9B40175EE173AC.MAI, EstimatedImpact: 48% 2026-09-22T13:39:43.216 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-22T13:39:43.216 ProcessImageName: DeviceCensus.exe, Pid: 5700, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-22T13:39:43.216 ProcessImageName: mysqldump.exe, Pid: 4824, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-22T13:39:43.216 ProcessImageName: powershell.exe, Pid: 612, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-22T13:39:43.216 ProcessImageName: ngentask.exe, Pid: 7296, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-22T13:39:43.216 ProcessImageName: powershell.exe, Pid: 7448, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpC32.tmp, EstimatedImpact: 0% 2026-09-22T13:39:43.216 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-22T13:39:43.216 ProcessImageName: cmd.exe, Pid: 1096, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-22T13:49:08.111 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T13:50:36.533 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T13:50:36.533 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T13:50:36.533 [Cloud] Queued cloud request. 2026-09-22T13:50:36.533 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T13:50:36.533 [Cloud] Dequeued cloud request. 2026-09-22T13:50:36.533 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T13:50:36.736 [Cloud] End of cloud request. 2026-09-22T13:50:37.236 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T14:00:01.100 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T14:00:01.100 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T14:00:01.100 [Cloud] Queued cloud request. 2026-09-22T14:00:01.100 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T14:00:01.100 [Cloud] Dequeued cloud request. 2026-09-22T14:00:01.100 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T14:00:01.365 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9E5B2A1E-D516-D56C-41D1-14FDE7138A01} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 14:00:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T14:00:01.881 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T14:04:13.116 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T14:19:18.125 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T14:26:05.908 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T14:26:05.908 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T14:26:05.908 [Cloud] Queued cloud request. 2026-09-22T14:26:05.908 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T14:26:05.908 [Cloud] Dequeued cloud request. 2026-09-22T14:26:05.908 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T14:26:06.095 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1EEF0ECE-45AB-01A2-D85F-E2C02D3065A8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 14:26:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T14:26:06.595 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T14:28:49.989 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T14:28:49.989 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T14:28:49.989 [Cloud] Queued cloud request. 2026-09-22T14:28:49.989 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T14:28:49.989 [Cloud] Dequeued cloud request. 2026-09-22T14:28:49.989 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T14:28:50.177 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6A6E81EE-1FC9-F39F-7E79-C1A4D2DD2E39} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 14:28:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T14:28:50.677 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T14:34:23.132 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T14:36:48.882 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T14:36:48.882 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T14:36:48.882 [Cloud] Queued cloud request. 2026-09-22T14:36:48.882 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T14:36:48.882 [Cloud] Dequeued cloud request. 2026-09-22T14:36:48.882 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T14:36:49.600 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2EA79D9A-8599-3511-C1BC-86E642E05300} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 14:36:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T14:36:50.116 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T14:49:28.139 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T14:59:48.973 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T14:59:48.973 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T14:59:48.973 [Cloud] Queued cloud request. 2026-09-22T14:59:48.973 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T14:59:48.973 [Cloud] Dequeued cloud request. 2026-09-22T14:59:48.973 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T14:59:49.129 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{47DE12C0-597C-139A-127D-2AC67B9F0C77} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 14:59:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T14:59:49.645 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T15:02:52.411 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T15:02:52.411 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T15:02:52.411 [Cloud] Queued cloud request. 2026-09-22T15:02:52.411 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T15:02:52.411 [Cloud] Dequeued cloud request. 2026-09-22T15:02:52.411 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T15:02:52.551 [Cloud] End of cloud request. 2026-09-22T15:02:53.051 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T15:04:33.145 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T15:05:58.833 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T15:05:58.833 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T15:05:58.833 [Cloud] Queued cloud request. 2026-09-22T15:05:58.833 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T15:05:58.833 [Cloud] Dequeued cloud request. 2026-09-22T15:05:58.833 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T15:06:08.912 [Cloud] End of cloud request. 2026-09-22T15:06:09.412 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T15:19:38.154 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T15:23:22.060 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T15:23:22.060 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T15:23:22.060 [Cloud] Queued cloud request. 2026-09-22T15:23:22.060 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T15:23:22.060 [Cloud] Dequeued cloud request. 2026-09-22T15:23:22.060 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T15:23:22.279 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{930E3254-B0A4-E1E7-B939-AF20D0903B68} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 15:23:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T15:23:22.794 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T15:30:22.142 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T15:30:22.142 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T15:30:22.142 [Cloud] Queued cloud request. 2026-09-22T15:30:22.142 [Cloud] Dequeued cloud request. 2026-09-22T15:30:22.142 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T15:30:22.142 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T15:30:22.345 [Cloud] End of cloud request. 2026-09-22T15:30:22.861 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T15:34:43.158 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T15:39:43.288 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27614, Count: 1849, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-22T15:39:43.288 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 17036, Count: 1415, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-22T15:39:43.288 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 5266, Count: 439, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-22T15:39:43.288 ProcessImageName: powershell.exe, Pid: 7380, TotalTime: 1353, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-22T15:39:43.288 ProcessImageName: AgentShellService.exe, Pid: 6244, TotalTime: 652, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 49% 2026-09-22T15:39:43.288 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 635, Count: 41, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-22T15:39:43.288 ProcessImageName: WmiPrvSE.exe, Pid: 3212, TotalTime: 629, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-22T15:39:43.288 ProcessImageName: WmiPrvSE.exe, Pid: 6968, TotalTime: 439, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 39% 2026-09-22T15:39:43.288 ProcessImageName: powershell.exe, Pid: 3172, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-22T15:39:43.288 ProcessImageName: WmiPrvSE.exe, Pid: 7068, TotalTime: 248, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-22T15:39:43.288 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 225, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-22T15:39:43.288 ProcessImageName: python.exe, Pid: 6972, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-22T15:39:43.288 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 62, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e170-0.MAD, EstimatedImpact: 0% 2026-09-22T15:39:43.288 ProcessImageName: taskhostw.exe, Pid: 5396, TotalTime: 108, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-22T15:39:43.288 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-22T15:39:43.288 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_310F0D2B41E141D9BB9B40175EE173AC.MAI, EstimatedImpact: 48% 2026-09-22T15:39:43.288 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-22T15:39:43.288 ProcessImageName: DeviceCensus.exe, Pid: 5700, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-22T15:39:43.288 ProcessImageName: mysqldump.exe, Pid: 4824, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-22T15:39:43.288 ProcessImageName: powershell.exe, Pid: 612, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-22T15:39:43.288 ProcessImageName: ngentask.exe, Pid: 7296, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-22T15:39:43.288 ProcessImageName: powershell.exe, Pid: 7448, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpC32.tmp, EstimatedImpact: 0% 2026-09-22T15:39:43.288 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-22T15:39:43.288 ProcessImageName: cmd.exe, Pid: 1096, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-22T15:39:54.507 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T15:39:54.507 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T15:39:54.507 [Cloud] Queued cloud request. 2026-09-22T15:39:54.507 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T15:39:54.507 [Cloud] Dequeued cloud request. 2026-09-22T15:39:54.507 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T15:39:54.663 [Cloud] End of cloud request. 2026-09-22T15:39:55.163 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T15:42:33.819 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T15:42:33.819 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T15:42:33.819 [Cloud] Queued cloud request. 2026-09-22T15:42:33.819 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T15:42:33.819 [Cloud] Dequeued cloud request. 2026-09-22T15:42:33.819 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T15:42:43.913 [Cloud] End of cloud request. 2026-09-22T15:42:44.413 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T15:49:48.168 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T15:52:18.949 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T15:52:18.949 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T15:52:18.949 [Cloud] Queued cloud request. 2026-09-22T15:52:18.949 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T15:52:18.949 [Cloud] Dequeued cloud request. 2026-09-22T15:52:18.949 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T15:52:19.105 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E4DB3A8D-B275-7A73-A314-BB967507C9FE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 15:52:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T15:52:19.605 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:00:18.172 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T16:00:18.172 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T16:00:18.172 [Cloud] Queued cloud request. 2026-09-22T16:00:18.172 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T16:00:18.172 [Cloud] Dequeued cloud request. 2026-09-22T16:00:18.172 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T16:00:18.766 [Cloud] End of cloud request. 2026-09-22T16:00:19.266 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:04:53.174 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T16:06:10.611 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T16:06:10.611 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T16:06:10.611 [Cloud] Queued cloud request. 2026-09-22T16:06:10.611 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T16:06:10.611 [Cloud] Dequeued cloud request. 2026-09-22T16:06:10.611 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T16:06:10.845 [Cloud] End of cloud request. 2026-09-22T16:06:11.361 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:08:22.489 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T16:08:22.489 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T16:08:22.489 [Cloud] Queued cloud request. 2026-09-22T16:08:22.489 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T16:08:22.489 [Cloud] Dequeued cloud request. 2026-09-22T16:08:22.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T16:08:22.645 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4366CD29-AFE6-8789-0400-1C0E0049D359} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 16:08:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T16:08:23.161 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:10:13.646 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T16:10:13.646 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T16:10:13.646 [Cloud] Queued cloud request. 2026-09-22T16:10:13.646 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T16:10:13.646 [Cloud] Dequeued cloud request. 2026-09-22T16:10:13.646 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T16:10:13.802 [Cloud] End of cloud request. 2026-09-22T16:10:14.318 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:11:10.896 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T16:11:10.896 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T16:11:10.896 [Cloud] Queued cloud request. 2026-09-22T16:11:10.896 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T16:11:10.896 [Cloud] Dequeued cloud request. 2026-09-22T16:11:10.896 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T16:11:10.990 [Cloud] End of cloud request. 2026-09-22T16:11:11.490 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:13:44.490 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T16:13:44.490 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T16:13:44.490 [Cloud] Queued cloud request. 2026-09-22T16:13:44.490 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T16:13:44.490 [Cloud] Dequeued cloud request. 2026-09-22T16:13:44.490 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T16:13:44.662 [Cloud] End of cloud request. 2026-09-22T16:13:45.177 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:15:38.976 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T16:15:38.976 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T16:15:38.976 [Cloud] Queued cloud request. 2026-09-22T16:15:38.976 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T16:15:38.976 [Cloud] Dequeued cloud request. 2026-09-22T16:15:38.976 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T16:15:39.117 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D5BA81F0-98CA-8C23-E1CB-CCEB018607E5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 16:15:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T16:15:39.617 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:19:58.182 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T16:21:30.245 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T16:21:30.245 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T16:21:30.245 [Cloud] Queued cloud request. 2026-09-22T16:21:30.245 [Cloud] Dequeued cloud request. 2026-09-22T16:21:30.245 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T16:21:30.245 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T16:21:30.479 [Cloud] End of cloud request. 2026-09-22T16:21:30.995 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:35:03.187 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T16:40:24.237 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T16:40:24.237 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T16:40:24.237 [Cloud] Queued cloud request. 2026-09-22T16:40:24.237 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T16:40:24.237 [Cloud] Dequeued cloud request. 2026-09-22T16:40:24.237 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T16:40:24.409 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{45930F56-671A-B5EF-49B4-C061955829ED} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 16:40:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T16:40:24.925 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:40:35.894 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T16:40:35.894 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T16:40:35.894 [Cloud] Queued cloud request. 2026-09-22T16:40:35.894 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T16:40:35.894 [Cloud] Dequeued cloud request. 2026-09-22T16:40:35.894 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T16:40:35.972 [Cloud] End of cloud request. 2026-09-22T16:40:36.487 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:41:06.987 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T16:41:06.987 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T16:41:06.987 [Cloud] Queued cloud request. 2026-09-22T16:41:06.987 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T16:41:06.987 [Cloud] Dequeued cloud request. 2026-09-22T16:41:06.987 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T16:41:07.066 [Cloud] End of cloud request. 2026-09-22T16:41:07.566 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:49:47.180 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T16:49:47.180 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T16:49:47.180 [Cloud] Queued cloud request. 2026-09-22T16:49:47.180 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T16:49:47.196 [Cloud] Dequeued cloud request. 2026-09-22T16:49:47.196 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T16:49:47.352 [Cloud] End of cloud request. 2026-09-22T16:49:47.868 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T16:50:08.196 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T17:05:13.201 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T17:09:28.408 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T17:09:28.408 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T17:09:28.408 [Cloud] Queued cloud request. 2026-09-22T17:09:28.408 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T17:09:28.408 [Cloud] Dequeued cloud request. 2026-09-22T17:09:28.408 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T17:09:28.627 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6B7FE74A-6639-582D-54D3-957F616565E5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 17:09:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T17:09:29.127 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T17:14:42.861 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T17:14:42.861 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T17:14:42.861 [Cloud] Queued cloud request. 2026-09-22T17:14:42.861 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T17:14:42.861 [Cloud] Dequeued cloud request. 2026-09-22T17:14:42.861 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T17:14:43.018 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8554A769-7043-68EE-63DF-E51F33D05102} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 17:14:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T17:14:43.533 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T17:15:46.145 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T17:15:46.145 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T17:15:46.145 [Cloud] Queued cloud request. 2026-09-22T17:15:46.145 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T17:15:46.145 [Cloud] Dequeued cloud request. 2026-09-22T17:15:46.145 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T17:15:46.316 [Cloud] End of cloud request. 2026-09-22T17:15:46.832 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T17:16:11.239 [RTP] [Mini-filter] Copy hint telemetry notification (\Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\AgentShell.exe) sent successfully. 2026-09-22T17:20:18.210 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T17:35:23.216 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T17:38:19.890 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T17:38:19.890 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T17:38:19.890 [Cloud] Queued cloud request. 2026-09-22T17:38:19.890 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T17:38:19.890 [Cloud] Dequeued cloud request. 2026-09-22T17:38:19.890 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T17:38:20.094 [Cloud] End of cloud request. 2026-09-22T17:38:20.594 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T17:39:43.344 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27737, Count: 1855, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-22T17:39:43.344 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 19002, Count: 1583, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-22T17:39:43.344 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 5266, Count: 439, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-22T17:39:43.344 ProcessImageName: powershell.exe, Pid: 7380, TotalTime: 1353, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-22T17:39:43.344 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 665, Count: 43, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-22T17:39:43.344 ProcessImageName: AgentShellService.exe, Pid: 6244, TotalTime: 652, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 49% 2026-09-22T17:39:43.344 ProcessImageName: WmiPrvSE.exe, Pid: 3212, TotalTime: 629, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-22T17:39:43.344 ProcessImageName: WmiPrvSE.exe, Pid: 6968, TotalTime: 439, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 39% 2026-09-22T17:39:43.344 ProcessImageName: powershell.exe, Pid: 3172, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-22T17:39:43.344 ProcessImageName: WmiPrvSE.exe, Pid: 7068, TotalTime: 248, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-22T17:39:43.344 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 240, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-22T17:39:43.344 ProcessImageName: python.exe, Pid: 6972, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-22T17:39:43.344 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 62, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e170-0.MAD, EstimatedImpact: 0% 2026-09-22T17:39:43.344 ProcessImageName: taskhostw.exe, Pid: 5396, TotalTime: 108, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-22T17:39:43.344 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-22T17:39:43.344 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_310F0D2B41E141D9BB9B40175EE173AC.MAI, EstimatedImpact: 48% 2026-09-22T17:39:43.344 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-22T17:39:43.344 ProcessImageName: DeviceCensus.exe, Pid: 5700, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 4% 2026-09-22T17:39:43.344 ProcessImageName: mysqldump.exe, Pid: 4824, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-22T17:39:43.344 ProcessImageName: powershell.exe, Pid: 612, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-22T17:39:43.344 ProcessImageName: ngentask.exe, Pid: 7296, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 12% 2026-09-22T17:39:43.344 ProcessImageName: powershell.exe, Pid: 7448, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpC32.tmp, EstimatedImpact: 0% 2026-09-22T17:39:43.344 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-22T17:39:43.344 ProcessImageName: cmd.exe, Pid: 1096, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-22T17:43:21.406 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T17:43:21.406 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T17:43:21.406 [Cloud] Queued cloud request. 2026-09-22T17:43:21.406 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T17:43:21.406 [Cloud] Dequeued cloud request. 2026-09-22T17:43:21.406 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T17:43:21.594 [Cloud] End of cloud request. 2026-09-22T17:43:22.094 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T17:45:23.875 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T17:45:23.875 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T17:45:23.875 [Cloud] Queued cloud request. 2026-09-22T17:45:23.875 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T17:45:23.875 [Cloud] Dequeued cloud request. 2026-09-22T17:45:23.875 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T17:45:24.063 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{75DBB6E1-6C9E-2F1F-F6A1-8CB1C0BC3D81} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 17:45:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T17:45:24.563 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T17:50:28.224 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T17:52:22.911 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T17:52:22.911 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T17:52:22.911 [Cloud] Queued cloud request. 2026-09-22T17:52:22.911 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T17:52:22.911 [Cloud] Dequeued cloud request. 2026-09-22T17:52:22.911 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T17:52:23.068 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FBFD5C0F-3A10-68BB-BA71-938FE5E93B95} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 17:52:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T17:52:23.568 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T17:53:56.880 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T17:53:56.880 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T17:53:56.880 [Cloud] Queued cloud request. 2026-09-22T17:53:56.880 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T17:53:56.880 [Cloud] Dequeued cloud request. 2026-09-22T17:53:56.880 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T17:53:57.021 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{52BF9F81-010E-94F6-5D62-2A6EF6B397A7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 17:53:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T17:53:57.537 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T18:00:22.260 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f2b2-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1954221, FileId: 0x38000000032954, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T18:00:22.260 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f2b2-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #1954220, FileId: 0xe000000032f49, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-22T18:05:33.229 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T18:17:42.862 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T18:17:42.862 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T18:17:42.862 [Cloud] Queued cloud request. 2026-09-22T18:17:42.862 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T18:17:42.862 [Cloud] Dequeued cloud request. 2026-09-22T18:17:42.862 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T18:17:43.096 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{93F90EB2-CE2B-226C-B338-B458DFD8E7EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 18:17:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T18:17:43.596 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T18:19:06.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T18:19:06.643 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T18:19:06.643 [Cloud] Queued cloud request. 2026-09-22T18:19:06.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T18:19:06.643 [Cloud] Dequeued cloud request. 2026-09-22T18:19:06.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T18:19:06.831 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{200ABBCA-5CA0-B58E-03FE-327E505CC3C4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 18:19:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T18:19:07.347 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T18:20:38.238 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T18:34:12.179 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T18:34:12.179 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T18:34:12.179 [Cloud] Queued cloud request. 2026-09-22T18:34:12.179 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T18:34:12.179 [Cloud] Dequeued cloud request. 2026-09-22T18:34:12.179 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T18:34:12.382 [Cloud] End of cloud request. 2026-09-22T18:34:12.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T18:35:43.243 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T18:36:08.869 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T18:36:08.869 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T18:36:08.869 [Cloud] Queued cloud request. 2026-09-22T18:36:08.869 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T18:36:08.869 [Cloud] Dequeued cloud request. 2026-09-22T18:36:08.869 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T18:36:09.056 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D9257FF1-D92C-AB10-D3DD-C850D20D6716} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 18:36:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T18:36:09.556 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T18:50:48.251 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T18:55:04.565 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T18:55:04.565 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T18:55:04.565 [Cloud] Queued cloud request. 2026-09-22T18:55:04.565 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T18:55:04.565 [Cloud] Dequeued cloud request. 2026-09-22T18:55:04.565 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T18:55:04.721 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FF98C367-ADCE-AF98-8DE5-96D0C99E35A7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 18:55:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T18:55:05.237 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T19:05:36.632 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T19:05:36.632 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T19:05:36.632 [Cloud] Queued cloud request. 2026-09-22T19:05:36.632 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T19:05:36.632 [Cloud] Dequeued cloud request. 2026-09-22T19:05:36.632 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T19:05:36.819 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9BF7293F-6737-4E50-C58C-139ACE3D8EAD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 19:05:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T19:05:37.319 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T19:05:53.257 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T19:10:02.839 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T19:10:02.839 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T19:10:02.839 [Cloud] Queued cloud request. 2026-09-22T19:10:02.839 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T19:10:02.839 [Cloud] Dequeued cloud request. 2026-09-22T19:10:02.839 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T19:10:03.042 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{05E4CE74-8850-1D3A-B61C-BD9D58133F40} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 19:10:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T19:10:03.542 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T19:13:53.339 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T19:13:53.339 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T19:13:53.339 [Cloud] Queued cloud request. 2026-09-22T19:13:53.339 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T19:13:53.339 [Cloud] Dequeued cloud request. 2026-09-22T19:13:53.339 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T19:13:53.526 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{726E3EFA-7DBA-7392-E408-605A35C8E23A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 19:13:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T19:13:54.042 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T19:20:58.265 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T19:21:11.687 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T19:21:11.687 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T19:21:11.687 [Cloud] Queued cloud request. 2026-09-22T19:21:11.687 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T19:21:11.687 [Cloud] Dequeued cloud request. 2026-09-22T19:21:11.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T19:21:11.828 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2E9CB152-C584-D9AB-E501-37FE5C8A254B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 19:21:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T19:21:12.343 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T19:36:03.270 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T19:39:13.273 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-22T19:39:13.305 Job Notification: New process added to job (6520) 2026-09-22T19:39:13.320 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-22T19:39:13.320 Aggressive catchup quick scan threshold: 660054704941 / 25920000000000 2026-09-22T19:39:13.320 Job Notification: New process added to job (7956) 2026-09-22T19:39:13.320 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:6520] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7956]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-22T19:39:13.461 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-22T19:39:13.461 Job Notification: New process added to job (4616) 2026-09-22T19:39:13.461 Job Notification: New process added to job (348) 2026-09-22T19:39:13.526 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:4616] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:348]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-22T19:39:13.633 Job Notification: New process added to job (5836) 2026-09-22T19:39:13.680 Task(GetDeviceTicket -AccessKey 645C57C9-000E-FF30-F37B-B8B9975ECBF0 ) launched as network service 2026-09-22T19:39:13.836 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-22T19:39:13.836 [RTP] Duplicating the current plugin configuration object... 2026-09-22T19:39:13.836 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-22T19:39:13.836 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-22T19:39:13.836 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-22T19:39:13.836 [RTP] No config change detected. Not updating plugin configuration. 2026-09-22T19:39:13.836 [RTP] No config changes found. No configuration switch. 2026-09-22T19:39:13.836 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-22T19:39:14.320 Job Notification: Process exited from job (5836) 2026-09-22T19:39:14.492 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-22T19:39:14.492 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T19:39:14.492 [Cloud] Queued cloud request. 2026-09-22T19:39:14.492 [Cloud] Dequeued cloud request. 2026-09-22T19:39:14.492 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T19:39:14.648 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-22T19:39:14.648 [Cloud] End of cloud request. 2026-09-22T19:39:14.992 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T19:39:25.367 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\1E4020F7-D21B-447E-8F9E-DC1A02D369301334.1dd4aca1176b898 2026-09-22T19:39:25.445 Verifying engine and signature files (source: 0) ... 2026-09-22T19:39:25.445 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A}\mpengine.dll] due to PPL. 2026-09-22T19:39:25.445 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A}\mpasbase.vdm]. File not in cache (0x1) 2026-09-22T19:39:26.430 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A}\mpasbase.vdm] 2026-09-22T19:39:26.430 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-22T19:39:26.445 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A}\mpasdlta.vdm] 2026-09-22T19:39:26.445 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A}\mpavbase.vdm]. File not in cache (0x1) 2026-09-22T19:39:26.867 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A}\mpavbase.vdm] 2026-09-22T19:39:26.867 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-22T19:39:26.883 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A}\mpavdlta.vdm] 2026-09-22T19:39:27.101 [Engine] IsHybridMode: 0 2026-09-22T19:39:27.101 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-22T19:39:27.101 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0FE4699049CD1C80C1FC063B83241442D76A1D54.bin): 0x00000002 2026-09-22T19:39:27.101 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0FE4699049CD1C80C1FC063B83241442D76A1D54.bin) 2026-09-22T19:39:27.101 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-22T19:39:27.101 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-22T19:39:27.101 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-22T19:39:27.101 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-22T19:39:39.508 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-22T19:39:39.508 [AutoExclusion] Applied roles from cache. 2026-09-22T19:39:39.508 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-22T19:39:39.648 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF68AB020, lRefCount: 6, hr=0 2026-09-22T19:39:39.648 [Engine] New active engine 00007FFCF4ABB020 replacing engine 00007FFCF68AB020. Number of active engines: 2 2026-09-22T19:39:39.680 EngineInit:Global ASOC is enabled 2026-09-22T19:39:39.680 EngineInit:ASOO is enabled for developer volumes 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.836 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-22T19:39:39.867 MpWriteUupSignatureVersion 1.459.335.0, hr = 0 2026-09-22T19:39:39.867 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-22T19:39:39.899 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-22T19:39:39.899 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-22T19:39:39.899 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-22T19:39:39.899 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-22T19:39:39.914 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-22T19:39:39.914 [Plugin] Initializing RTP plugin state... 2026-09-22T19:39:39.914 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-22T19:39:39.914 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎21‎-‎2026 21:39:43 Last Perf:‎09‎-‎21‎-‎2026 21:39:42 First RTP Scan:‎09‎-‎21‎-‎2026 21:39:43 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1339 Misses:7195 BM Queue:0,162,0 Proc:0,45,0 File:0,162,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:1986999 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:443883188 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:3290 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:136115 TotalHits:1073284 InstanceCacheInserts:30464 InstanceCacheUpdates:0 InstanceCacheDeletes:16842 InstanceCacheHits:665 InstanceCacheMisses:92991 InstanceCacheOverflows:12907 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:5ms (7368/1454) Success: 1454, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-22T19:39:39.914 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A} 2026-09-22T19:39:39.914 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{848713B0-F256-4182-8B83-73148FB646A1} removed 2026-09-22T19:39:39.914 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-22T19:39:39.914 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C}\mpasbase.vdm in use, hr=0x80070020 2026-09-22T19:39:39.914 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-22T19:39:39.914 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-22T19:39:39.914 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-22T19:39:39.914 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-22T19:39:39.914 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-22-2026 19:39:39 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-22-2026 19:39:39 2026-09-22T19:39:39.930 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-22T19:39:39.930 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-22T19:39:39.930 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-22T19:39:39.930 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-22T19:39:39.930 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T19:39:39.930 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-22T19:39:39.930 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-22T19:39:39.930 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-22T19:39:39.930 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-22T19:39:39.930 MdCoreSvc is supported in this platform and OS Signature updated on 09-22-2026 19:39:39 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.335.0 AV Signature Version: 1.459.335.0 ************************************************************ 2026-09-22T19:39:39.946 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-22T19:39:39.946 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\1E4020F7-D21B-447E-8F9E-DC1A02D369301334.1dd4aca1176b898 2026-09-22T19:39:39.992 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-22T19:39:39.992 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 2026-09-22T19:39:40.027 Process scan (postsignatureupdatescan) started. Signature updated via MicrosoftUpdateServer on 09-22-2026 19:39:40 ************************************************************ 2026-09-22T19:39:40.180 Job Notification: Process exited from job (4616) 2026-09-22T19:39:40.195 Job Notification: Process exited from job (348) 2026-09-22T19:39:40.211 Job Notification: Process exited from job (6520) 2026-09-22T19:39:40.227 Job Notification: Process exited from job (7956) 2026-09-22T19:39:40.258 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-22T19:39:40.258 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-22T19:39:40.258 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-22T19:39:40.258 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-22T19:39:40.258 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-22T19:39:40.273 [Engine] Engine 00007FFCF68AB020 no longer in use. Number of active engines: 1 2026-09-22T19:39:40.273 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-22T19:39:40.273 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-22T19:39:40.383 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-22T19:39:40.383 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-22T19:39:40.383 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-22T19:39:40.883 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 28297, Count: 1920, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-22T19:39:40.883 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 21236, Count: 1754, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-22T19:39:40.883 ProcessImageName: AgentShell.exe, Pid: 7800, TotalTime: 5266, Count: 439, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-22T19:39:40.883 ProcessImageName: powershell.exe, Pid: 7380, TotalTime: 1353, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-22T19:39:40.883 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 725, Count: 49, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-22T19:39:40.883 ProcessImageName: AgentShellService.exe, Pid: 6244, TotalTime: 652, Count: 20, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 49% 2026-09-22T19:39:40.883 ProcessImageName: WmiPrvSE.exe, Pid: 3212, TotalTime: 629, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-22T19:39:40.883 ProcessImageName: WmiPrvSE.exe, Pid: 6968, TotalTime: 439, Count: 38, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 39% 2026-09-22T19:39:40.883 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 270, Count: 19, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-22T19:39:40.883 ProcessImageName: powershell.exe, Pid: 3172, TotalTime: 262, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-22T19:39:40.883 ProcessImageName: WmiPrvSE.exe, Pid: 7068, TotalTime: 248, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-22T19:39:40.883 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 150, Count: 66, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1e170-0.MAD, EstimatedImpact: 0% 2026-09-22T19:39:40.883 ProcessImageName: python.exe, Pid: 6972, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 5% 2026-09-22T19:39:40.883 ProcessImageName: taskhostw.exe, Pid: 5396, TotalTime: 108, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-22T19:39:40.883 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-22T19:39:40.945 [Engine] RSIG_UNLOADENGINE, 00007FFCF68AB020, err=0x0 2026-09-22T19:39:40.977 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8A789C3B-0DBF-4A3F-A2C4-6CE39C589C9C} removed 2026-09-22T19:39:54.524 Process scan (postsignatureupdatescan) completed. 2026-09-22T19:44:39.713 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-22T19:50:24.466 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T19:50:24.466 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T19:50:24.466 [Cloud] Queued cloud request. 2026-09-22T19:50:24.466 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T19:50:24.466 [Cloud] Dequeued cloud request. 2026-09-22T19:50:24.466 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T19:50:24.653 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F6A7BE5-8EFB-63C5-BA59-A9872B674FA6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 19:50:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T19:50:25.153 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T19:51:04.591 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T19:51:04.591 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T19:51:04.591 [Cloud] Queued cloud request. 2026-09-22T19:51:04.591 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T19:51:04.591 [Cloud] Dequeued cloud request. 2026-09-22T19:51:04.591 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T19:51:04.731 [Cloud] End of cloud request. 2026-09-22T19:51:05.231 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T19:51:08.278 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T19:51:17.356 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T19:51:17.356 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T19:51:17.356 [Cloud] Queued cloud request. 2026-09-22T19:51:17.356 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T19:51:17.356 [Cloud] Dequeued cloud request. 2026-09-22T19:51:17.356 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{0574033B-28EC-37F7-5550-6C98ED10258D} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 19:51:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T19:51:25.872 [Cloud] End of cloud request. 2026-09-22T19:51:26.388 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T19:54:30.997 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T19:54:30.997 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T19:54:30.997 [Cloud] Queued cloud request. 2026-09-22T19:54:30.997 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T19:54:30.997 [Cloud] Dequeued cloud request. 2026-09-22T19:54:30.997 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T19:54:31.138 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9393BBAC-940B-CB4D-026C-406153F5661D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 19:54:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T19:54:31.638 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T19:59:36.376 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T19:59:36.376 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T19:59:36.376 [Cloud] Queued cloud request. 2026-09-22T19:59:36.376 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T19:59:36.579 [Cloud] Dequeued cloud request. 2026-09-22T19:59:36.579 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T19:59:36.720 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{97B04161-01A9-C264-F321-D1BF70D8E0CE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 19:59:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T19:59:37.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T20:06:13.283 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T20:07:11.033 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T20:07:11.033 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T20:07:11.033 [Cloud] Queued cloud request. 2026-09-22T20:07:11.033 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T20:07:11.033 [Cloud] Dequeued cloud request. 2026-09-22T20:07:11.033 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T20:07:11.205 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4FD7993A-0AE1-C318-8431-5991CE0F5832} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 20:07:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T20:07:11.705 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T20:21:18.290 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T20:36:23.296 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T20:38:13.111 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T20:38:13.111 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T20:38:13.111 [Cloud] Queued cloud request. 2026-09-22T20:38:13.111 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T20:38:13.111 [Cloud] Dequeued cloud request. 2026-09-22T20:38:13.111 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T20:38:13.314 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2C70C532-3F39-BB43-E622-74A4EEC5A1E4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 20:38:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T20:38:13.830 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T20:44:20.879 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T20:44:20.879 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T20:44:20.879 [Cloud] Queued cloud request. 2026-09-22T20:44:20.879 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T20:44:20.879 [Cloud] Dequeued cloud request. 2026-09-22T20:44:20.879 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T20:44:21.067 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6C7B978D-615D-20ED-80A8-F6389274B7B2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 20:44:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T20:44:21.567 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T20:51:21.648 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T20:51:21.648 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T20:51:21.648 [Cloud] Queued cloud request. 2026-09-22T20:51:21.648 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T20:51:21.648 [Cloud] Dequeued cloud request. 2026-09-22T20:51:21.648 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T20:51:21.851 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EE913A84-4E39-F2D6-38FB-2C2924ED005A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 20:51:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T20:51:22.366 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T20:51:28.304 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T21:03:47.464 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T21:03:47.464 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T21:03:47.464 [Cloud] Queued cloud request. 2026-09-22T21:03:47.464 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T21:03:47.464 [Cloud] Dequeued cloud request. 2026-09-22T21:03:47.464 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T21:03:47.652 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{15831CEB-B266-20C9-081A-5BAF44FA8E80} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 21:03:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T21:03:48.152 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T21:06:33.311 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T21:09:50.936 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T21:09:50.936 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T21:09:50.936 [Cloud] Queued cloud request. 2026-09-22T21:09:50.936 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T21:09:50.936 [Cloud] Dequeued cloud request. 2026-09-22T21:09:50.936 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T21:09:51.139 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{90FB7073-4CEA-4709-A447-1DB942A53280} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 21:09:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T21:09:51.654 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T21:18:58.676 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T21:18:58.676 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T21:18:58.676 [Cloud] Queued cloud request. 2026-09-22T21:18:58.676 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T21:18:58.676 [Cloud] Dequeued cloud request. 2026-09-22T21:18:58.676 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T21:18:58.863 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B8CABD63-C32E-B8C1-41B8-45FBBC1DA61E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 21:18:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T21:18:59.379 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T21:21:38.316 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T21:31:11.383 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T21:31:11.383 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T21:31:11.383 [Cloud] Queued cloud request. 2026-09-22T21:31:11.383 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T21:31:11.383 [Cloud] Dequeued cloud request. 2026-09-22T21:31:11.383 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T21:31:11.524 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CADC2ECB-8D0D-8657-31B1-19CECD60EB1B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 21:31:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T21:31:12.040 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T21:36:43.323 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T21:39:39.700 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 7228, Count: 513, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-22T21:39:39.700 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 1963, Count: 181, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-22T21:39:39.700 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-22T21:39:39.700 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-22T21:39:39.700 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-22T21:39:39.700 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 75, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-22T21:39:39.700 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 2% 2026-09-22T21:39:39.700 ProcessImageName: ngentask.exe, Pid: 4728, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-22T21:39:39.700 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-22T21:39:39.700 ProcessImageName: taskhostw.exe, Pid: 2224, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-22T21:50:14.517 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T21:50:14.517 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T21:50:14.517 [Cloud] Queued cloud request. 2026-09-22T21:50:14.517 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T21:50:14.517 [Cloud] Dequeued cloud request. 2026-09-22T21:50:14.517 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T21:50:14.658 [Cloud] End of cloud request. 2026-09-22T21:50:15.173 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T21:51:48.330 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T22:06:53.336 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T22:15:26.323 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T22:15:26.323 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T22:15:26.323 [Cloud] Queued cloud request. 2026-09-22T22:15:26.323 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T22:15:26.323 [Cloud] Dequeued cloud request. 2026-09-22T22:15:26.323 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T22:15:26.527 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{05406F85-C314-60D2-66ED-7684910ACD05} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 22:15:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T22:15:27.027 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T22:21:58.342 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T22:30:27.517 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T22:30:27.517 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T22:30:27.517 [Cloud] Queued cloud request. 2026-09-22T22:30:27.517 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T22:30:27.517 [Cloud] Dequeued cloud request. 2026-09-22T22:30:27.517 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T22:30:27.767 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D4532D7B-C8B6-D03F-C286-7DC7B517AA1F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 22:30:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T22:30:28.283 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T22:37:03.347 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T22:37:53.428 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T22:37:53.428 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T22:37:53.428 [Cloud] Queued cloud request. 2026-09-22T22:37:53.428 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T22:37:53.428 [Cloud] Dequeued cloud request. 2026-09-22T22:37:53.428 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T22:37:53.584 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{566A3B3A-0C15-E146-ED5F-2D95C1DBE6E4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 22:37:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T22:37:54.084 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T22:38:17.787 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T22:38:17.787 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T22:38:17.787 [Cloud] Queued cloud request. 2026-09-22T22:38:17.787 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T22:38:17.787 [Cloud] Dequeued cloud request. 2026-09-22T22:38:17.787 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T22:38:17.865 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C24C5B48-73A7-AE6C-9658-1E874E759E32} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 22:38:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T22:38:18.381 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T22:40:50.444 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T22:40:50.444 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T22:40:50.444 [Cloud] Queued cloud request. 2026-09-22T22:40:50.444 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T22:40:50.444 [Cloud] Dequeued cloud request. 2026-09-22T22:40:50.444 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T22:40:50.584 [Cloud] End of cloud request. 2026-09-22T22:40:51.084 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T22:43:54.585 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T22:43:54.585 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T22:43:54.585 [Cloud] Queued cloud request. 2026-09-22T22:43:54.585 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T22:43:54.585 [Cloud] Dequeued cloud request. 2026-09-22T22:43:54.585 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T22:43:54.788 [Cloud] End of cloud request. 2026-09-22T22:43:55.304 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T22:44:34.163 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T22:44:34.163 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T22:44:34.163 [Cloud] Queued cloud request. 2026-09-22T22:44:34.163 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T22:44:34.335 [Cloud] Dequeued cloud request. 2026-09-22T22:44:34.507 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T22:44:41.163 [Cloud] End of cloud request. 2026-09-22T22:44:41.663 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T22:52:08.355 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T22:55:09.527 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T22:55:09.527 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T22:55:09.527 [Cloud] Queued cloud request. 2026-09-22T22:55:09.527 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T22:55:09.527 [Cloud] Dequeued cloud request. 2026-09-22T22:55:09.527 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T22:55:09.714 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C58A4F3C-020A-C848-44EC-632A13BB2A06} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 22:55:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T22:55:10.214 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T22:56:18.137 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T22:56:18.137 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T22:56:18.137 [Cloud] Queued cloud request. 2026-09-22T22:56:18.137 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T22:56:18.137 [Cloud] Dequeued cloud request. 2026-09-22T22:56:18.137 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T22:56:18.324 [Cloud] End of cloud request. 2026-09-22T22:56:18.824 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T22:58:57.249 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T22:58:57.249 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T22:58:57.249 [Cloud] Queued cloud request. 2026-09-22T22:58:57.249 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T22:58:57.249 [Cloud] Dequeued cloud request. 2026-09-22T22:58:57.249 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T22:58:57.421 [Cloud] End of cloud request. 2026-09-22T22:58:57.936 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T23:07:13.361 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T23:14:37.190 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T23:14:37.190 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T23:14:37.190 [Cloud] Queued cloud request. 2026-09-22T23:14:37.190 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T23:14:37.190 [Cloud] Dequeued cloud request. 2026-09-22T23:14:37.190 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T23:14:37.362 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5A961949-3DE1-EF89-3C16-FFAD47A0CCEF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 23:14:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T23:14:37.878 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T23:19:23.023 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T23:19:23.023 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T23:19:23.023 [Cloud] Queued cloud request. 2026-09-22T23:19:23.023 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T23:19:23.023 [Cloud] Dequeued cloud request. 2026-09-22T23:19:23.023 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T23:19:23.163 [Cloud] End of cloud request. 2026-09-22T23:19:23.663 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T23:22:18.367 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T23:37:23.373 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T23:39:39.749 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 10222, Count: 684, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-22T23:39:39.749 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4132, Count: 361, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-22T23:39:39.749 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-22T23:39:39.749 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-22T23:39:39.749 ProcessImageName: python.exe, Pid: 7684, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-22T23:39:39.749 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 135, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-22T23:39:39.749 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-22T23:39:39.749 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-22T23:39:39.749 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 0% 2026-09-22T23:39:39.749 ProcessImageName: ngentask.exe, Pid: 4728, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-22T23:39:39.749 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-22T23:39:39.749 ProcessImageName: taskhostw.exe, Pid: 2224, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-22T23:40:06.827 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T23:40:06.827 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T23:40:06.827 [Cloud] Queued cloud request. 2026-09-22T23:40:06.827 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T23:40:06.827 [Cloud] Dequeued cloud request. 2026-09-22T23:40:06.827 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T23:40:16.968 [Cloud] End of cloud request. 2026-09-22T23:40:17.483 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T23:52:28.378 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-22T23:55:12.473 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T23:55:12.473 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T23:55:12.473 [Cloud] Queued cloud request. 2026-09-22T23:55:12.473 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T23:55:12.473 [Cloud] Dequeued cloud request. 2026-09-22T23:55:12.473 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T23:55:12.629 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E9404333-DA94-055F-7011-CCB6B5130ECD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 23:55:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T23:55:13.145 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-22T23:57:15.538 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-22T23:57:15.538 [Cloud] Start of cloud request. Passive mode: 0 2026-09-22T23:57:15.538 [Cloud] Queued cloud request. 2026-09-22T23:57:15.538 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-22T23:57:15.538 [Cloud] Dequeued cloud request. 2026-09-22T23:57:15.538 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-22T23:57:15.709 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A40488D8-9DC2-FAFD-C3ED-61D84B68F1D7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-22-2026 23:57:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-22T23:57:16.209 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T00:05:16.978 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T00:05:16.978 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T00:05:16.978 [Cloud] Queued cloud request. 2026-09-23T00:05:16.978 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T00:05:16.978 [Cloud] Dequeued cloud request. 2026-09-23T00:05:16.978 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T00:05:17.181 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A1B81FFB-449F-79D5-DA38-6DBA236209FD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 00:05:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T00:05:17.697 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T00:06:45.650 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T00:06:45.650 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T00:06:45.650 [Cloud] Queued cloud request. 2026-09-23T00:06:45.650 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T00:06:45.650 [Cloud] Dequeued cloud request. 2026-09-23T00:06:45.650 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T00:06:45.837 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{41924239-3FFC-0AB6-84F3-EAE43A67BA67} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 00:06:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T00:06:46.353 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T00:07:33.386 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T00:14:22.341 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T00:14:22.341 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T00:14:22.341 [Cloud] Queued cloud request. 2026-09-23T00:14:22.341 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T00:14:22.341 [Cloud] Dequeued cloud request. 2026-09-23T00:14:22.341 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T00:14:31.154 [Cloud] End of cloud request. 2026-09-23T00:14:31.654 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T00:21:31.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T00:21:31.657 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T00:21:31.657 [Cloud] Queued cloud request. 2026-09-23T00:21:31.657 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T00:21:31.657 [Cloud] Dequeued cloud request. 2026-09-23T00:21:31.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T00:21:31.798 [Cloud] End of cloud request. 2026-09-23T00:21:32.313 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T00:22:38.392 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T00:26:02.220 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T00:26:02.220 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T00:26:02.220 [Cloud] Queued cloud request. 2026-09-23T00:26:02.220 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T00:26:02.220 [Cloud] Dequeued cloud request. 2026-09-23T00:26:02.220 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T00:26:12.314 [Cloud] End of cloud request. 2026-09-23T00:26:12.829 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{1DB4A457-6C30-BB02-67B0-277A992B7EED} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-23-2026 00:29:29 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T00:29:29.786 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T00:29:29.786 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T00:29:29.786 [Cloud] Queued cloud request. 2026-09-23T00:29:29.786 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T00:29:29.786 [Cloud] Dequeued cloud request. 2026-09-23T00:29:29.786 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T00:29:30.270 [Cloud] End of cloud request. 2026-09-23T00:29:30.770 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T00:31:52.864 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T00:31:52.864 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T00:31:52.864 [Cloud] Queued cloud request. 2026-09-23T00:31:52.864 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T00:31:52.864 [Cloud] Dequeued cloud request. 2026-09-23T00:31:52.864 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T00:31:53.004 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8F7DE2E-F37D-E153-E3A8-9F416D29D123} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 00:31:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T00:31:53.520 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T00:34:38.177 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T00:34:38.177 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T00:34:38.177 [Cloud] Queued cloud request. 2026-09-23T00:34:38.177 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T00:34:38.177 [Cloud] Dequeued cloud request. 2026-09-23T00:34:38.177 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T00:34:38.412 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0F3155D2-D4CB-22B4-22B7-C680C359B10E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 00:34:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T00:34:38.927 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T00:37:43.399 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T00:52:48.404 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T01:00:02.048 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094844, FileId: 0x120000000334be, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.048 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094845, FileId: 0x260000000314dd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.080 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094850, FileId: 0x140000000334be, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.080 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094851, FileId: 0x280000000314dd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.095 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094857, FileId: 0x2a0000000314dd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.095 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094856, FileId: 0x160000000334be, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.095 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094863, FileId: 0x2c0000000314dd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.095 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094862, FileId: 0x180000000334be, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.111 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094870, FileId: 0x2e0000000314dd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.111 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094869, FileId: 0x1a0000000334be, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.127 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094876, FileId: 0x300000000314dd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.127 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094875, FileId: 0x1c0000000334be, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.142 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094881, FileId: 0x1e0000000334be, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.142 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094882, FileId: 0x320000000314dd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.142 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094888, FileId: 0x340000000314dd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.142 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094887, FileId: 0x200000000334be, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.158 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094893, FileId: 0x220000000334be, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.158 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094894, FileId: 0x360000000314dd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.173 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094900, FileId: 0x380000000314dd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.173 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094899, FileId: 0x240000000334be, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.189 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094905, FileId: 0x260000000334be, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.189 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094906, FileId: 0x3a0000000314dd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.205 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094911, FileId: 0x280000000334be, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:00:02.205 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f4f8-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2094912, FileId: 0x3c0000000314dd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T01:07:53.411 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T01:10:26.131 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T01:10:26.131 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T01:10:26.131 [Cloud] Queued cloud request. 2026-09-23T01:10:26.131 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T01:10:26.303 [Cloud] Dequeued cloud request. 2026-09-23T01:10:26.303 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T01:10:34.756 [Cloud] End of cloud request. 2026-09-23T01:10:35.271 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T01:16:32.679 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T01:16:32.679 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T01:16:32.679 [Cloud] Queued cloud request. 2026-09-23T01:16:32.679 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T01:16:32.679 [Cloud] Dequeued cloud request. 2026-09-23T01:16:32.679 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T01:16:32.851 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{90728342-9578-018A-6A87-5EECCFB1A31F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 01:16:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T01:16:33.367 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T01:19:07.853 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:1391A998-44DD-4287-8AA4-751D48B76269, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-23T01:19:07.853 Scheduled scan with Id 1391A998-44DD-4287-8AA4-751D48B76269 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-23T01:19:07.853 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-23T01:19:07.853 [SFC] System file cache build is not needed (already completed) 2026-09-23T01:19:20.775 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T01:19:20.775 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T01:19:20.775 [Cloud] Queued cloud request. 2026-09-23T01:19:20.775 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T01:19:20.775 [Cloud] Dequeued cloud request. 2026-09-23T01:19:20.775 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{337891C7-17C4-F37F-AF56-8861BFBF4B55} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 01:19:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T01:19:20.931 [Cloud] End of cloud request. 2026-09-23T01:19:21.431 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T01:19:28.775 Engine:Triggered AR EMS scan 2026-09-23T01:19:28.791 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.806 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.822 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.822 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.822 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.853 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.853 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.869 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.869 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.884 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.884 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.884 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.900 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.900 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.900 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.916 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.916 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.931 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.931 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.931 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.947 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.947 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.947 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.947 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.962 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.962 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.978 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.994 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.994 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.994 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:28.994 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.009 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.009 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.025 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.025 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.041 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.041 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.056 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.056 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.056 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.056 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.072 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.072 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.087 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.087 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.103 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.103 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.103 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.119 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.119 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.134 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.134 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.134 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.134 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.150 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.150 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.150 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.166 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.181 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.181 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:19:29.197 Engine:EMS scan for process: svchost pid: 2712, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-23T01:20:05.088 QuickScan:ScanID:1391A998-44DD-4287-8AA4-751D48B76269: Quick scan finished with error 0 2026-09-23T01:20:05.588 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-23T01:20:05.588 [RTP] Duplicating the current plugin configuration object... 2026-09-23T01:20:05.588 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-23T01:20:05.588 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-23T01:20:05.588 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-23T01:20:05.588 [RTP] No config change detected. Not updating plugin configuration. 2026-09-23T01:20:05.588 [RTP] No config changes found. No configuration switch. 2026-09-23T01:20:05.588 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-23T01:22:58.417 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T01:26:38.308 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T01:26:38.308 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T01:26:38.308 [Cloud] Queued cloud request. 2026-09-23T01:26:38.308 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T01:26:38.308 [Cloud] Dequeued cloud request. 2026-09-23T01:26:38.308 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T01:26:42.465 [Cloud] End of cloud request. 2026-09-23T01:26:42.965 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T01:34:32.889 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-23T01:34:32.889 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-23T01:34:32.889 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-23T01:34:32.889 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-23T01:34:32.889 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-23T01:34:32.889 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-23T01:34:32.925 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-23T01:34:32.968 [AutoPurge] Cleanup Routine tasks have started. 2026-09-23T01:34:32.983 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-23T01:34:32.983 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-23T01:34:32.983 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-23-2026 01:34:32 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-23-2026 01:34:32 2026-09-23T01:34:32.983 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-23T01:34:32.983 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-23T01:34:32.983 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-23T01:34:32.983 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-23T01:34:32.983 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-23T01:34:32.983 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-23T01:34:33.077 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-23T01:34:33.077 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-23T01:34:33.108 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-23T01:34:33.108 [AutoPurge] Removing expired default signature package ... 2026-09-23T01:34:33.358 Job Notification: New process added to job (3656) 2026-09-23T01:34:34.155 Job Notification: Process exited from job (3656) 2026-09-23T01:34:34.202 [AutoPurge] Verification Routine tasks have ended. 2026-09-23T01:38:03.424 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T01:39:39.799 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 13808, Count: 925, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-23T01:39:39.799 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4389, Count: 385, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T01:39:39.799 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2552, Count: 207, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-23T01:39:39.799 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-23T01:39:39.799 ProcessImageName: AgentShellService.exe, Pid: 6904, TotalTime: 697, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-23T01:39:39.799 ProcessImageName: WmiPrvSE.exe, Pid: 7856, TotalTime: 676, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 5% 2026-09-23T01:39:39.799 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 301, Count: 25, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-23T01:39:39.799 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T01:39:39.799 ProcessImageName: python.exe, Pid: 7684, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-23T01:39:39.799 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-23T01:39:39.799 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 0% 2026-09-23T01:39:39.799 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 90, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T01:39:39.799 ProcessImageName: DeviceCensus.exe, Pid: 2400, TotalTime: 77, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-23T01:39:39.799 ProcessImageName: taskhostw.exe, Pid: 4840, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 3% 2026-09-23T01:39:39.799 ProcessImageName: cmd.exe, Pid: 7960, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-23T01:39:39.799 ProcessImageName: mysqldump.exe, Pid: 7916, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 18% 2026-09-23T01:39:39.799 ProcessImageName: powershell.exe, Pid: 336, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-23T01:39:39.799 ProcessImageName: ngentask.exe, Pid: 4728, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-23T01:39:39.799 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-23T01:39:39.799 ProcessImageName: taskhostw.exe, Pid: 2224, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-23T01:42:03.394 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T01:42:03.394 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T01:42:03.394 [Cloud] Queued cloud request. 2026-09-23T01:42:03.394 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T01:42:03.394 [Cloud] Dequeued cloud request. 2026-09-23T01:42:03.394 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T01:42:03.565 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3507C742-F03E-9F46-D151-604A07239969} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 01:42:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T01:42:04.081 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-23T01:42:04.097 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T01:42:04.097 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-23T01:42:04.097 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-23T01:42:04.097 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-23T01:42:04.097 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-23T01:42:04.097 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-23T01:42:04.097 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-23T01:42:04.097 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-23T01:42:04.097 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-23T01:42:04.097 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-23T01:42:04.097 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-23T01:42:04.097 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-23T01:42:04.097 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-23T01:42:04.097 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-23T01:42:04.097 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-23T01:42:04.097 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-23T01:42:04.097 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-23T01:42:04.097 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-23T01:42:04.097 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T01:42:04.097 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-23T01:42:04.097 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-23T01:42:04.097 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-23T01:42:04.112 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T01:42:04.112 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T01:42:04.112 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T01:42:06.675 [RTP] Duplicating the current plugin configuration object... 2026-09-23T01:42:06.675 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-23T01:42:06.675 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-23T01:42:06.675 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-23T01:42:06.675 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-23T01:42:06.675 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-23T01:44:39.222 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T01:44:39.222 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T01:44:39.222 [Cloud] Queued cloud request. 2026-09-23T01:44:39.222 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T01:44:39.222 [Cloud] Dequeued cloud request. 2026-09-23T01:44:39.222 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T01:44:39.362 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6C14BFB0-B0AA-2273-AB9C-790D4AD3C3C7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 01:44:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T01:44:39.862 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T01:53:08.430 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T02:01:22.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T02:01:22.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T02:01:22.604 [Cloud] Queued cloud request. 2026-09-23T02:01:22.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T02:01:22.604 [Cloud] Dequeued cloud request. 2026-09-23T02:01:22.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T02:01:22.760 [Cloud] End of cloud request. 2026-09-23T02:01:23.276 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T02:03:33.385 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T02:03:33.385 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T02:03:33.385 [Cloud] Queued cloud request. 2026-09-23T02:03:33.385 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T02:03:33.385 [Cloud] Dequeued cloud request. 2026-09-23T02:03:33.385 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T02:03:33.526 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A43D8EDB-DE02-1F47-FFB6-8AAFE2661078} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 02:03:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T02:03:34.042 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T02:04:23.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T02:04:23.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T02:04:23.387 [Cloud] Queued cloud request. 2026-09-23T02:04:23.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T02:04:23.387 [Cloud] Dequeued cloud request. 2026-09-23T02:04:23.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T02:04:23.465 [Cloud] End of cloud request. 2026-09-23T02:04:23.965 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T02:04:51.731 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T02:04:51.731 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T02:04:51.731 [Cloud] Queued cloud request. 2026-09-23T02:04:51.731 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T02:04:51.731 [Cloud] Dequeued cloud request. 2026-09-23T02:04:51.731 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T02:04:51.871 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E4DA86D-AD01-E8A4-C31B-9671F8A0A461} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 02:04:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T02:04:52.371 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T02:08:13.436 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T02:10:57.859 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T02:10:57.859 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T02:10:57.859 [Cloud] Queued cloud request. 2026-09-23T02:10:57.859 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T02:10:57.859 [Cloud] Dequeued cloud request. 2026-09-23T02:10:57.859 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T02:10:58.030 [Cloud] End of cloud request. 2026-09-23T02:10:58.546 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T02:14:48.827 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T02:14:48.827 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T02:14:48.827 [Cloud] Queued cloud request. 2026-09-23T02:14:48.827 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T02:14:48.827 [Cloud] Dequeued cloud request. 2026-09-23T02:14:48.827 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T02:14:58.968 [Cloud] End of cloud request. 2026-09-23T02:14:59.468 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T02:22:22.003 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T02:22:22.003 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T02:22:22.003 [Cloud] Queued cloud request. 2026-09-23T02:22:22.003 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T02:22:22.003 [Cloud] Dequeued cloud request. 2026-09-23T02:22:22.003 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T02:22:32.143 [Cloud] End of cloud request. 2026-09-23T02:22:32.643 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T02:22:56.987 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T02:22:56.987 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T02:22:56.987 [Cloud] Queued cloud request. 2026-09-23T02:22:56.987 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T02:22:56.987 [Cloud] Dequeued cloud request. 2026-09-23T02:22:56.987 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T02:22:58.065 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{34A4AD6E-1FB7-B6E7-399B-ED08D0E9E32F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 02:22:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T02:22:58.565 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T02:23:18.440 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T02:36:05.775 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T02:36:05.775 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T02:36:05.775 [Cloud] Queued cloud request. 2026-09-23T02:36:05.775 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T02:36:05.775 [Cloud] Dequeued cloud request. 2026-09-23T02:36:05.775 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T02:36:15.868 [Cloud] End of cloud request. 2026-09-23T02:36:16.368 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T02:38:23.448 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T02:53:28.454 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T03:05:04.254 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T03:05:04.254 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T03:05:04.254 [Cloud] Queued cloud request. 2026-09-23T03:05:04.254 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T03:05:04.254 [Cloud] Dequeued cloud request. 2026-09-23T03:05:04.254 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T03:05:04.442 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0AD8B4FD-7452-3FA7-1840-FA53701C6FA7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 03:05:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T03:05:04.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T03:08:33.461 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T03:14:32.775 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T03:14:32.775 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T03:14:32.775 [Cloud] Queued cloud request. 2026-09-23T03:14:32.775 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T03:14:32.775 [Cloud] Dequeued cloud request. 2026-09-23T03:14:32.775 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T03:14:42.853 [Cloud] End of cloud request. 2026-09-23T03:14:43.369 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T03:23:22.012 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T03:23:22.012 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T03:23:22.012 [Cloud] Queued cloud request. 2026-09-23T03:23:22.012 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T03:23:22.012 [Cloud] Dequeued cloud request. 2026-09-23T03:23:22.012 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T03:23:24.684 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{63A623E4-A430-0F3F-5622-F28E471E590C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 03:23:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T03:23:25.184 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T03:23:38.465 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T03:27:28.124 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T03:27:28.124 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T03:27:28.124 [Cloud] Queued cloud request. 2026-09-23T03:27:28.124 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T03:27:28.124 [Cloud] Dequeued cloud request. 2026-09-23T03:27:28.139 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T03:27:28.311 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{19706434-B6EC-B837-8566-4862E80729E7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 03:27:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T03:27:28.811 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T03:27:37.421 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T03:27:37.421 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T03:27:37.421 [Cloud] Queued cloud request. 2026-09-23T03:27:37.421 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T03:27:37.421 [Cloud] Dequeued cloud request. 2026-09-23T03:27:37.421 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T03:27:37.499 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E337A5AC-2428-39AE-186B-4AA2FA4AAE60} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 03:27:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T03:27:37.999 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T03:29:02.859 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T03:29:02.859 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T03:29:02.859 [Cloud] Queued cloud request. 2026-09-23T03:29:02.859 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T03:29:02.859 [Cloud] Dequeued cloud request. 2026-09-23T03:29:02.859 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T03:29:03.016 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0A7FD30D-C68A-6479-FB55-CB2CAB422371} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 03:29:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T03:29:03.516 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T03:37:30.456 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T03:37:30.456 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T03:37:30.456 [Cloud] Queued cloud request. 2026-09-23T03:37:30.456 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T03:37:30.456 [Cloud] Dequeued cloud request. 2026-09-23T03:37:30.456 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T03:37:30.628 [Cloud] End of cloud request. 2026-09-23T03:37:31.144 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T03:38:43.473 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T03:39:39.864 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 20508, Count: 1339, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-23T03:39:39.864 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 4562, Count: 397, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-23T03:39:39.864 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4389, Count: 385, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T03:39:39.864 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-23T03:39:39.864 ProcessImageName: AgentShellService.exe, Pid: 6904, TotalTime: 697, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-23T03:39:39.864 ProcessImageName: WmiPrvSE.exe, Pid: 7856, TotalTime: 676, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 5% 2026-09-23T03:39:39.864 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 331, Count: 27, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-23T03:39:39.864 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T03:39:39.864 ProcessImageName: python.exe, Pid: 7684, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-23T03:39:39.864 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-23T03:39:39.864 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 0% 2026-09-23T03:39:39.864 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 90, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T03:39:39.864 ProcessImageName: DeviceCensus.exe, Pid: 2400, TotalTime: 77, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-23T03:39:39.864 ProcessImageName: taskhostw.exe, Pid: 4840, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 3% 2026-09-23T03:39:39.864 ProcessImageName: cmd.exe, Pid: 7960, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-23T03:39:39.864 ProcessImageName: mysqldump.exe, Pid: 7916, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 18% 2026-09-23T03:39:39.864 ProcessImageName: powershell.exe, Pid: 336, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-23T03:39:39.864 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-23T03:39:39.864 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-23T03:39:39.864 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-23T03:39:39.864 ProcessImageName: ngentask.exe, Pid: 4728, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-23T03:39:39.864 ProcessImageName: taskhostw.exe, Pid: 2224, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-23T03:47:07.695 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T03:47:07.695 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T03:47:07.695 [Cloud] Queued cloud request. 2026-09-23T03:47:07.695 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T03:47:07.695 [Cloud] Dequeued cloud request. 2026-09-23T03:47:07.695 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T03:47:07.851 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8B9BE960-8B72-5B85-F4B8-A84685366FF6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 03:47:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T03:47:08.367 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T03:49:56.539 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T03:49:56.539 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T03:49:56.539 [Cloud] Queued cloud request. 2026-09-23T03:49:56.539 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T03:49:56.539 [Cloud] Dequeued cloud request. 2026-09-23T03:49:56.539 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T03:49:56.758 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{369B1949-C561-0095-4882-5B4ADA891CC0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 03:49:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T03:49:57.274 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T03:53:48.479 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T03:54:00.463 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T03:54:00.463 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T03:54:00.463 [Cloud] Queued cloud request. 2026-09-23T03:54:00.463 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T03:54:00.635 [Cloud] Dequeued cloud request. 2026-09-23T03:54:00.822 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T03:54:10.947 [Cloud] End of cloud request. 2026-09-23T03:54:11.463 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T03:56:08.713 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T03:56:08.713 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T03:56:08.713 [Cloud] Queued cloud request. 2026-09-23T03:56:08.713 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T03:56:08.713 [Cloud] Dequeued cloud request. 2026-09-23T03:56:08.713 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T03:56:08.901 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{708F53CB-B359-9D96-F63C-00A8BD45F33D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 03:56:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T03:56:09.416 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T04:08:53.485 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T04:17:28.316 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T04:17:28.316 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T04:17:28.316 [Cloud] Queued cloud request. 2026-09-23T04:17:28.316 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T04:17:28.316 [Cloud] Dequeued cloud request. 2026-09-23T04:17:28.316 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T04:17:28.504 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F07D637D-61FD-5D5D-9643-B717C743195B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 04:17:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T04:17:29.019 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T04:23:58.491 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T04:30:04.416 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T04:30:04.416 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T04:30:04.416 [Cloud] Queued cloud request. 2026-09-23T04:30:04.416 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T04:30:04.603 [Cloud] Dequeued cloud request. 2026-09-23T04:30:04.603 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T04:30:12.416 [Cloud] End of cloud request. 2026-09-23T04:30:12.931 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T04:33:51.963 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T04:33:51.963 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T04:33:51.963 [Cloud] Queued cloud request. 2026-09-23T04:33:51.963 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T04:33:51.963 [Cloud] Dequeued cloud request. 2026-09-23T04:33:51.963 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T04:33:52.151 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{049E857B-5476-ACE4-6A4D-9335284B3785} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 04:33:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T04:33:52.651 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T04:36:33.385 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T04:36:33.385 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T04:36:33.385 [Cloud] Queued cloud request. 2026-09-23T04:36:33.385 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T04:36:33.385 [Cloud] Dequeued cloud request. 2026-09-23T04:36:33.385 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T04:36:33.573 [Cloud] End of cloud request. 2026-09-23T04:36:34.073 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T04:39:03.497 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T04:43:11.592 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T04:43:11.592 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T04:43:11.592 [Cloud] Queued cloud request. 2026-09-23T04:43:11.592 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T04:43:11.592 [Cloud] Dequeued cloud request. 2026-09-23T04:43:11.592 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T04:43:11.780 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{623E6D9D-8D8A-1977-C284-40A187367844} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 04:43:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T04:43:12.296 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T04:45:29.077 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\$Extend\$Deleted\002600000003FD814A028B77. Process: \Device\HarddiskVolume2\Windows\System32\svchost.exe, Status: 0xc0000001, State: 0, ScanRequest #2169906, FileId: 0x2600000003fd81, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x2000, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T04:47:09.093 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T04:47:09.093 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T04:47:09.093 [Cloud] Queued cloud request. 2026-09-23T04:47:09.093 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T04:47:09.093 [Cloud] Dequeued cloud request. 2026-09-23T04:47:09.093 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T04:47:09.280 [Cloud] End of cloud request. 2026-09-23T04:47:09.780 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T04:53:05.472 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T04:53:05.472 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T04:53:05.472 [Cloud] Queued cloud request. 2026-09-23T04:53:05.472 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T04:53:05.472 [Cloud] Dequeued cloud request. 2026-09-23T04:53:05.472 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T04:53:05.675 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1EC7C274-7E0F-4470-E9D7-252752D879DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 04:53:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T04:53:06.175 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T04:53:22.222 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T04:53:22.222 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T04:53:22.222 [Cloud] Queued cloud request. 2026-09-23T04:53:22.222 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T04:53:22.222 [Cloud] Dequeued cloud request. 2026-09-23T04:53:22.222 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T04:53:22.316 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{79352571-E549-DC46-2D76-2CFD37CE4032} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 04:53:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T04:53:22.831 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T04:54:08.503 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T04:56:02.644 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T04:56:02.644 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T04:56:02.644 [Cloud] Queued cloud request. 2026-09-23T04:56:02.644 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T04:56:02.644 [Cloud] Dequeued cloud request. 2026-09-23T04:56:02.644 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T04:56:02.847 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ACA08AA1-19FB-D20F-C0A6-61C8F6261667} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 04:56:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T04:56:03.347 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T04:57:42.755 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T04:57:42.755 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T04:57:42.755 [Cloud] Queued cloud request. 2026-09-23T04:57:42.755 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T04:57:42.755 [Cloud] Dequeued cloud request. 2026-09-23T04:57:42.755 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T04:57:42.927 [Cloud] End of cloud request. 2026-09-23T04:57:43.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T04:58:17.443 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T04:58:17.443 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T04:58:17.443 [Cloud] Queued cloud request. 2026-09-23T04:58:17.443 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T04:58:17.443 [Cloud] Dequeued cloud request. 2026-09-23T04:58:17.443 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T04:58:17.521 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{068FE0BE-52E8-CB78-4A22-966B69404604} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 04:58:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T04:58:18.021 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T04:59:53.646 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T04:59:53.646 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T04:59:53.646 [Cloud] Queued cloud request. 2026-09-23T04:59:53.646 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T04:59:53.646 [Cloud] Dequeued cloud request. 2026-09-23T04:59:53.646 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T05:00:03.787 [Cloud] End of cloud request. 2026-09-23T05:00:04.287 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T05:03:27.568 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T05:03:27.568 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T05:03:27.568 [Cloud] Queued cloud request. 2026-09-23T05:03:27.568 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T05:03:27.568 [Cloud] Dequeued cloud request. 2026-09-23T05:03:27.568 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T05:03:27.771 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2B0EB4D7-8200-3899-232D-DA8B6329C5E8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 05:03:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T05:03:28.287 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T05:03:48.974 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T05:03:48.974 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T05:03:48.974 [Cloud] Queued cloud request. 2026-09-23T05:03:48.974 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T05:03:48.974 [Cloud] Dequeued cloud request. 2026-09-23T05:03:48.974 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T05:03:49.068 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{51A90DC3-5E33-F755-D32F-667A32708353} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 05:03:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T05:03:49.568 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T05:07:48.868 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T05:07:48.868 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T05:07:48.868 [Cloud] Queued cloud request. 2026-09-23T05:07:48.868 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T05:07:49.087 [Cloud] Dequeued cloud request. 2026-09-23T05:07:49.087 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T05:07:49.243 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06338693-F486-1E4E-BFDE-ED3B6960FBC0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 05:07:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T05:07:49.743 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T05:09:13.510 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T05:18:19.045 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T05:18:19.045 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T05:18:19.045 [Cloud] Queued cloud request. 2026-09-23T05:18:19.045 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T05:18:19.045 [Cloud] Dequeued cloud request. 2026-09-23T05:18:19.045 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T05:18:19.248 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A27BEC51-97ED-5219-FC27-71697BB58599} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 05:18:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T05:18:19.748 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T05:24:18.515 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T05:26:45.796 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T05:26:45.796 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T05:26:45.796 [Cloud] Queued cloud request. 2026-09-23T05:26:45.796 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T05:26:45.984 [Cloud] Dequeued cloud request. 2026-09-23T05:26:45.984 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T05:26:46.125 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6ADF93C4-5660-D636-1697-784E1CAC4711} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 05:26:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T05:26:46.625 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T05:28:35.299 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T05:28:35.299 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T05:28:35.299 [Cloud] Queued cloud request. 2026-09-23T05:28:35.299 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T05:28:35.299 [Cloud] Dequeued cloud request. 2026-09-23T05:28:35.299 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T05:28:35.455 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5E3533EE-121D-A026-402A-CE6AB71CD75F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 05:28:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T05:28:35.955 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T05:31:21.456 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T05:31:21.456 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T05:31:21.456 [Cloud] Queued cloud request. 2026-09-23T05:31:21.456 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T05:31:21.456 [Cloud] Dequeued cloud request. 2026-09-23T05:31:21.456 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T05:31:21.597 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1F7D7E59-C662-EFE7-BC97-A085C2A1AA7C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 05:31:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T05:31:22.113 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T05:36:26.613 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T05:36:26.613 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T05:36:26.613 [Cloud] Queued cloud request. 2026-09-23T05:36:26.613 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T05:36:26.613 [Cloud] Dequeued cloud request. 2026-09-23T05:36:26.613 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T05:36:26.754 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1948F3BF-E9FD-05E9-45D9-D453C1F4F064} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 05:36:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T05:36:27.270 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T05:39:23.522 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T05:39:39.912 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 21533, Count: 1391, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-23T05:39:39.912 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 6810, Count: 587, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-23T05:39:39.912 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4389, Count: 385, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T05:39:39.912 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-23T05:39:39.912 ProcessImageName: AgentShellService.exe, Pid: 6904, TotalTime: 697, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-23T05:39:39.912 ProcessImageName: WmiPrvSE.exe, Pid: 7856, TotalTime: 676, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 5% 2026-09-23T05:39:39.912 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 452, Count: 37, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-23T05:39:39.912 ProcessImageName: powershell.exe, Pid: 7536, TotalTime: 215, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-23T05:39:39.912 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T05:39:39.912 ProcessImageName: python.exe, Pid: 7684, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-23T05:39:39.912 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 105, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T05:39:39.912 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-23T05:39:39.912 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 0% 2026-09-23T05:39:39.912 ProcessImageName: DeviceCensus.exe, Pid: 2400, TotalTime: 77, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-23T05:39:39.912 ProcessImageName: taskhostw.exe, Pid: 4840, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 3% 2026-09-23T05:39:39.912 ProcessImageName: cmd.exe, Pid: 7960, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-23T05:39:39.912 ProcessImageName: mysqldump.exe, Pid: 7916, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 18% 2026-09-23T05:39:39.912 ProcessImageName: python.exe, Pid: 4616, TotalTime: 30, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-23T05:39:39.912 ProcessImageName: powershell.exe, Pid: 336, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-23T05:39:39.912 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-23T05:39:39.912 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-23T05:39:39.912 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-23T05:39:39.912 ProcessImageName: ngentask.exe, Pid: 4728, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-23T05:39:39.912 ProcessImageName: taskhostw.exe, Pid: 2224, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-23T05:46:46.619 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T05:46:46.619 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T05:46:46.619 [Cloud] Queued cloud request. 2026-09-23T05:46:46.619 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T05:46:46.619 [Cloud] Dequeued cloud request. 2026-09-23T05:46:46.619 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T05:46:46.869 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8EF70CB-3806-4A54-D933-87A566207951} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 05:46:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T05:46:47.384 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T05:54:28.528 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T06:02:48.687 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:02:48.687 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:02:48.687 [Cloud] Queued cloud request. 2026-09-23T06:02:48.687 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:02:48.687 [Cloud] Dequeued cloud request. 2026-09-23T06:02:48.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:02:48.984 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7AB212EA-EB9C-8885-A3CE-633417C76C70} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 06:02:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T06:02:49.484 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:07:21.251 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:07:21.251 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:07:21.251 [Cloud] Queued cloud request. 2026-09-23T06:07:21.251 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:07:21.251 [Cloud] Dequeued cloud request. 2026-09-23T06:07:21.251 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:07:22.313 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{721904CE-7068-4ADD-EDEE-01C09B965600} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 06:07:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T06:07:22.829 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:09:33.535 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T06:16:27.193 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:16:27.193 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:16:27.193 [Cloud] Queued cloud request. 2026-09-23T06:16:27.193 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:16:27.193 [Cloud] Dequeued cloud request. 2026-09-23T06:16:27.193 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:16:27.834 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{135E6377-B0E0-1D7E-979A-089A09D249A0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 06:16:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T06:16:28.350 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:20:23.163 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:20:23.163 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:20:23.163 [Cloud] Queued cloud request. 2026-09-23T06:20:23.163 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:20:23.163 [Cloud] Dequeued cloud request. 2026-09-23T06:20:23.163 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:20:23.351 [Cloud] End of cloud request. 2026-09-23T06:20:23.851 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:20:57.367 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:20:57.367 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:20:57.367 [Cloud] Queued cloud request. 2026-09-23T06:20:57.367 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:20:57.367 [Cloud] Dequeued cloud request. 2026-09-23T06:20:57.367 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:20:57.445 [Cloud] End of cloud request. 2026-09-23T06:20:57.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:21:16.835 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:21:16.835 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:21:16.835 [Cloud] Queued cloud request. 2026-09-23T06:21:16.835 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:21:16.835 [Cloud] Dequeued cloud request. 2026-09-23T06:21:16.835 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:21:16.929 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{23FE1CA1-FEAD-2B5E-D987-B44603A5660D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 06:21:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T06:21:17.429 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:22:22.320 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:22:22.320 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:22:22.320 [Cloud] Queued cloud request. 2026-09-23T06:22:22.320 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:22:22.320 [Cloud] Dequeued cloud request. 2026-09-23T06:22:22.320 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:22:22.507 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D3E0B6F7-0BB0-C6C9-C857-ECB519CE05A5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 06:22:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T06:22:23.007 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:22:54.929 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:22:54.929 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:22:54.929 [Cloud] Queued cloud request. 2026-09-23T06:22:54.929 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:22:54.929 [Cloud] Dequeued cloud request. 2026-09-23T06:22:54.929 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:22:55.007 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{529A7579-0708-E383-52D7-D2CD69C7F235} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 06:22:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T06:22:55.523 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:24:06.884 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:24:06.884 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:24:06.884 [Cloud] Queued cloud request. 2026-09-23T06:24:06.884 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:24:06.884 [Cloud] Dequeued cloud request. 2026-09-23T06:24:06.884 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:24:07.072 [Cloud] End of cloud request. 2026-09-23T06:24:07.587 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:24:38.541 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T06:32:35.731 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:32:35.731 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:32:35.731 [Cloud] Queued cloud request. 2026-09-23T06:32:35.731 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:32:35.731 [Cloud] Dequeued cloud request. 2026-09-23T06:32:35.731 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:32:35.918 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E29DE85F-1276-FB1E-EF9A-69B962913AA4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 06:32:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T06:32:36.419 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:39:43.547 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T06:42:51.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:42:51.657 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:42:51.657 [Cloud] Queued cloud request. 2026-09-23T06:42:51.657 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:42:51.657 [Cloud] Dequeued cloud request. 2026-09-23T06:42:51.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:42:52.423 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F18C1D7-5176-412B-6CE1-6F98C45868F6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 06:42:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T06:42:52.923 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:43:12.626 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:43:12.626 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:43:12.626 [Cloud] Queued cloud request. 2026-09-23T06:43:12.626 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:43:12.626 [Cloud] Dequeued cloud request. 2026-09-23T06:43:12.626 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:43:12.704 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BEF453EC-AAC7-1EEC-80DE-D1EE4470AED1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 06:43:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T06:43:13.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:44:18.626 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:44:18.626 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:44:18.626 [Cloud] Queued cloud request. 2026-09-23T06:44:18.626 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:44:18.626 [Cloud] Dequeued cloud request. 2026-09-23T06:44:18.626 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:44:18.782 [Cloud] End of cloud request. 2026-09-23T06:44:19.282 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:44:32.532 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:44:32.532 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:44:32.532 [Cloud] Queued cloud request. 2026-09-23T06:44:32.532 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:44:32.532 [Cloud] Dequeued cloud request. 2026-09-23T06:44:32.532 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:44:32.611 [Cloud] End of cloud request. 2026-09-23T06:44:33.126 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:45:49.314 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:45:49.314 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:45:49.314 [Cloud] Queued cloud request. 2026-09-23T06:45:49.314 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:45:49.314 [Cloud] Dequeued cloud request. 2026-09-23T06:45:49.314 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:45:49.501 [Cloud] End of cloud request. 2026-09-23T06:45:50.001 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:48:51.129 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:48:51.129 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:48:51.129 [Cloud] Queued cloud request. 2026-09-23T06:48:51.129 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:48:51.129 [Cloud] Dequeued cloud request. 2026-09-23T06:48:51.129 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:48:51.285 [Cloud] End of cloud request. 2026-09-23T06:48:51.801 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:49:41.473 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:49:41.473 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:49:41.473 [Cloud] Queued cloud request. 2026-09-23T06:49:41.473 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:49:41.473 [Cloud] Dequeued cloud request. 2026-09-23T06:49:41.473 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:49:41.629 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2E123AB0-3878-3013-E02A-E56970E7E104} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 06:49:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T06:49:42.129 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:50:50.176 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:50:50.176 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:50:50.176 [Cloud] Queued cloud request. 2026-09-23T06:50:50.176 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:50:50.176 [Cloud] Dequeued cloud request. 2026-09-23T06:50:50.176 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:50:50.707 [Cloud] End of cloud request. 2026-09-23T06:50:51.223 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:51:02.051 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:51:02.051 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:51:02.051 [Cloud] Queued cloud request. 2026-09-23T06:51:02.051 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:51:02.051 [Cloud] Dequeued cloud request. 2026-09-23T06:51:02.051 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:51:02.442 [Cloud] End of cloud request. 2026-09-23T06:51:02.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:53:57.803 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:53:57.803 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:53:57.803 [Cloud] Queued cloud request. 2026-09-23T06:53:57.803 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:53:57.959 [Cloud] Dequeued cloud request. 2026-09-23T06:53:58.115 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:53:58.350 [Cloud] End of cloud request. 2026-09-23T06:53:58.865 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:54:48.553 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T06:57:10.350 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:57:10.350 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:57:10.350 [Cloud] Queued cloud request. 2026-09-23T06:57:10.350 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:57:10.350 [Cloud] Dequeued cloud request. 2026-09-23T06:57:10.350 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:57:10.631 [Cloud] End of cloud request. 2026-09-23T06:57:11.131 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T06:57:28.773 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T06:57:28.773 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T06:57:28.773 [Cloud] Queued cloud request. 2026-09-23T06:57:28.773 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T06:57:28.773 [Cloud] Dequeued cloud request. 2026-09-23T06:57:28.773 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T06:57:28.866 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E72650D4-ADB6-8EA8-6EB8-2289DBD77E99} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 06:57:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T06:57:29.366 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T07:00:22.087 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T07:00:22.087 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T07:00:22.087 [Cloud] Queued cloud request. 2026-09-23T07:00:22.087 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T07:00:22.087 [Cloud] Dequeued cloud request. 2026-09-23T07:00:22.087 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{ED7C802C-4388-FBE3-B5EE-95F35A025D33} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 07:00:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T07:00:23.290 [Cloud] End of cloud request. 2026-09-23T07:00:23.790 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T07:03:52.932 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T07:03:52.932 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T07:03:52.932 [Cloud] Queued cloud request. 2026-09-23T07:03:52.932 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T07:03:52.932 [Cloud] Dequeued cloud request. 2026-09-23T07:03:52.932 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T07:03:53.229 [Cloud] End of cloud request. 2026-09-23T07:03:53.729 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T07:09:53.559 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T07:15:05.809 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T07:15:05.809 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T07:15:05.809 [Cloud] Queued cloud request. 2026-09-23T07:15:05.809 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T07:15:05.809 [Cloud] Dequeued cloud request. 2026-09-23T07:15:05.809 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T07:15:07.059 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7986A50B-5E5D-7907-FB22-9B18995A4C3B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 07:15:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T07:15:07.560 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T07:20:56.798 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T07:20:56.798 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T07:20:56.798 [Cloud] Queued cloud request. 2026-09-23T07:20:56.798 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T07:20:56.798 [Cloud] Dequeued cloud request. 2026-09-23T07:20:56.798 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T07:20:56.986 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4E380DA7-77D9-9F68-6C4B-1CBBDE3FF0F5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 07:20:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T07:20:57.486 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T07:24:58.564 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T07:32:29.959 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T07:32:29.959 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T07:32:29.959 [Cloud] Queued cloud request. 2026-09-23T07:32:29.959 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T07:32:30.147 [Cloud] Dequeued cloud request. 2026-09-23T07:32:30.147 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T07:32:30.303 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{757C7B58-BF68-598C-83BB-6AF1B2B5B292} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 07:32:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T07:32:30.819 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T07:39:39.978 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 26919, Count: 1726, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-23T07:39:39.978 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 8854, Count: 773, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-23T07:39:39.978 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4389, Count: 385, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T07:39:39.978 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-23T07:39:39.978 ProcessImageName: AgentShellService.exe, Pid: 6904, TotalTime: 697, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-23T07:39:39.978 ProcessImageName: WmiPrvSE.exe, Pid: 7856, TotalTime: 676, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 5% 2026-09-23T07:39:39.978 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 452, Count: 37, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-23T07:39:39.978 ProcessImageName: powershell.exe, Pid: 7536, TotalTime: 215, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-23T07:39:39.978 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T07:39:39.978 ProcessImageName: python.exe, Pid: 7684, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-23T07:39:39.978 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 150, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T07:39:39.978 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 0% 2026-09-23T07:39:39.978 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-23T07:39:39.978 ProcessImageName: DeviceCensus.exe, Pid: 2400, TotalTime: 77, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-23T07:39:39.978 ProcessImageName: taskhostw.exe, Pid: 4840, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 3% 2026-09-23T07:39:39.978 ProcessImageName: cmd.exe, Pid: 7960, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-23T07:39:39.978 ProcessImageName: mysqldump.exe, Pid: 7916, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 18% 2026-09-23T07:39:39.978 ProcessImageName: python.exe, Pid: 4616, TotalTime: 30, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-23T07:39:39.978 ProcessImageName: powershell.exe, Pid: 336, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-23T07:39:39.978 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-23T07:39:39.978 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-23T07:39:39.978 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-23T07:39:39.978 ProcessImageName: ngentask.exe, Pid: 4728, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-23T07:39:39.978 ProcessImageName: taskhostw.exe, Pid: 2224, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-23T07:40:03.572 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T07:55:08.577 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T08:00:25.784 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T08:00:25.784 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T08:00:25.784 [Cloud] Queued cloud request. 2026-09-23T08:00:25.784 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T08:00:25.956 [Cloud] Dequeued cloud request. 2026-09-23T08:00:26.112 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T08:00:26.596 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{877E4713-D7CB-6A5A-960F-B94B314543F4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 08:00:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T08:00:27.096 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T08:10:13.585 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T08:14:14.977 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T08:14:14.977 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T08:14:14.977 [Cloud] Queued cloud request. 2026-09-23T08:14:14.977 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T08:14:14.977 [Cloud] Dequeued cloud request. 2026-09-23T08:14:14.977 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T08:14:15.242 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B275A3BF-EBCF-0E20-6D36-92DD6EF4B1FE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 08:14:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T08:14:15.758 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T08:20:35.417 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T08:20:35.417 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T08:20:35.417 [Cloud] Queued cloud request. 2026-09-23T08:20:35.417 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T08:20:35.417 [Cloud] Dequeued cloud request. 2026-09-23T08:20:35.417 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T08:20:35.604 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3FDFBC25-7035-7E4E-F3DB-A01D65DE07D0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 08:20:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T08:20:36.105 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T08:25:18.590 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T08:33:56.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T08:33:56.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T08:33:56.297 [Cloud] Queued cloud request. 2026-09-23T08:33:56.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T08:33:56.297 [Cloud] Dequeued cloud request. 2026-09-23T08:33:56.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T08:34:00.734 [Cloud] End of cloud request. 2026-09-23T08:34:01.250 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T08:40:23.597 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T08:41:59.067 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T08:41:59.067 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T08:41:59.067 [Cloud] Queued cloud request. 2026-09-23T08:41:59.067 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T08:41:59.067 [Cloud] Dequeued cloud request. 2026-09-23T08:41:59.067 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T08:42:14.895 [Cloud] End of cloud request. 2026-09-23T08:42:15.411 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T08:55:28.603 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T08:56:16.165 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T08:56:16.165 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T08:56:16.165 [Cloud] Queued cloud request. 2026-09-23T08:56:16.165 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T08:56:16.165 [Cloud] Dequeued cloud request. 2026-09-23T08:56:16.165 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T08:56:16.540 [Cloud] End of cloud request. 2026-09-23T08:56:17.056 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T08:59:17.574 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T08:59:17.574 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T08:59:17.574 [Cloud] Queued cloud request. 2026-09-23T08:59:17.574 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T08:59:17.574 [Cloud] Dequeued cloud request. 2026-09-23T08:59:17.574 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T08:59:17.840 [Cloud] End of cloud request. 2026-09-23T08:59:18.355 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T09:00:46.652 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T09:00:46.652 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T09:00:46.652 [Cloud] Queued cloud request. 2026-09-23T09:00:46.652 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T09:00:46.652 [Cloud] Dequeued cloud request. 2026-09-23T09:00:46.652 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T09:00:47.215 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D0DD1D38-D4B4-85C2-D4DE-FCC4683A0FB2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 09:00:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T09:00:47.731 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T09:02:58.902 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T09:02:58.902 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T09:02:58.902 [Cloud] Queued cloud request. 2026-09-23T09:02:58.902 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T09:02:58.902 [Cloud] Dequeued cloud request. 2026-09-23T09:02:58.902 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T09:02:59.090 [Cloud] End of cloud request. 2026-09-23T09:02:59.590 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T09:10:33.609 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T09:24:01.599 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T09:24:01.599 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T09:24:01.599 [Cloud] Queued cloud request. 2026-09-23T09:24:01.599 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T09:24:01.599 [Cloud] Dequeued cloud request. 2026-09-23T09:24:01.599 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T09:24:11.740 [Cloud] End of cloud request. 2026-09-23T09:24:12.256 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T09:25:38.616 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T09:29:45.196 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T09:29:45.196 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T09:29:45.196 [Cloud] Queued cloud request. 2026-09-23T09:29:45.196 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T09:29:45.196 [Cloud] Dequeued cloud request. 2026-09-23T09:29:45.196 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T09:29:45.415 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7D86DB6A-EFEF-7BD4-5A24-7C08BF09B64B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 09:29:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T09:29:45.931 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T09:34:02.760 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T09:34:02.760 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T09:34:02.760 [Cloud] Queued cloud request. 2026-09-23T09:34:02.760 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T09:34:02.760 [Cloud] Dequeued cloud request. 2026-09-23T09:34:02.760 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T09:34:03.042 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{69FA8A6E-B14D-FFC7-1A79-1E0D7932DA99} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 09:34:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T09:34:03.542 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T09:39:40.029 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27165, Count: 1735, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-23T09:39:40.029 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 11085, Count: 942, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-23T09:39:40.029 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4389, Count: 385, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T09:39:40.029 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-23T09:39:40.029 ProcessImageName: AgentShellService.exe, Pid: 6904, TotalTime: 697, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-23T09:39:40.029 ProcessImageName: WmiPrvSE.exe, Pid: 7856, TotalTime: 676, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 5% 2026-09-23T09:39:40.029 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 482, Count: 41, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-23T09:39:40.029 ProcessImageName: powershell.exe, Pid: 7536, TotalTime: 215, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-23T09:39:40.029 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T09:39:40.029 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 165, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T09:39:40.029 ProcessImageName: python.exe, Pid: 7684, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-23T09:39:40.029 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 0% 2026-09-23T09:39:40.029 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-23T09:39:40.029 ProcessImageName: DeviceCensus.exe, Pid: 2400, TotalTime: 77, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-23T09:39:40.029 ProcessImageName: taskhostw.exe, Pid: 4840, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 3% 2026-09-23T09:39:40.029 ProcessImageName: cmd.exe, Pid: 7960, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-23T09:39:40.029 ProcessImageName: mysqldump.exe, Pid: 7916, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 18% 2026-09-23T09:39:40.029 ProcessImageName: python.exe, Pid: 4616, TotalTime: 30, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-23T09:39:40.029 ProcessImageName: powershell.exe, Pid: 336, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-23T09:39:40.029 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-23T09:39:40.029 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-23T09:39:40.029 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-23T09:39:40.029 ProcessImageName: ngentask.exe, Pid: 4728, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-23T09:39:40.029 ProcessImageName: taskhostw.exe, Pid: 2224, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-23T09:40:43.623 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T09:53:07.720 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T09:53:07.720 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T09:53:07.720 [Cloud] Queued cloud request. 2026-09-23T09:53:07.720 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T09:53:07.720 [Cloud] Dequeued cloud request. 2026-09-23T09:53:07.720 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T09:53:07.877 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F52FE08-4A23-6813-D998-8FB8756BA4DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 09:53:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T09:53:08.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T09:55:48.628 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T09:58:34.209 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T09:58:34.209 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T09:58:34.209 [Cloud] Queued cloud request. 2026-09-23T09:58:34.209 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T09:58:34.209 [Cloud] Dequeued cloud request. 2026-09-23T09:58:34.209 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T09:58:34.397 [Cloud] End of cloud request. 2026-09-23T09:58:34.912 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T10:08:13.916 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T10:08:13.916 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T10:08:13.916 [Cloud] Queued cloud request. 2026-09-23T10:08:13.916 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T10:08:13.916 [Cloud] Dequeued cloud request. 2026-09-23T10:08:13.916 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T10:08:20.651 [Cloud] End of cloud request. 2026-09-23T10:08:21.151 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T10:10:53.635 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T10:25:58.641 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T10:41:03.650 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T10:56:08.655 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T10:57:29.485 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T10:57:29.485 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T10:57:29.485 [Cloud] Queued cloud request. 2026-09-23T10:57:29.485 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T10:57:29.485 [Cloud] Dequeued cloud request. 2026-09-23T10:57:29.485 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T10:57:39.626 [Cloud] End of cloud request. 2026-09-23T10:57:40.126 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T11:00:56.362 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T11:00:56.362 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T11:00:56.362 [Cloud] Queued cloud request. 2026-09-23T11:00:56.362 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T11:00:56.362 [Cloud] Dequeued cloud request. 2026-09-23T11:00:56.362 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T11:00:56.596 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FA1BD673-5B9D-C5E9-E80A-2AA8B348CD61} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 11:00:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T11:00:57.112 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T11:01:45.847 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T11:01:45.847 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T11:01:45.847 [Cloud] Queued cloud request. 2026-09-23T11:01:45.847 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T11:01:45.847 [Cloud] Dequeued cloud request. 2026-09-23T11:01:45.847 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T11:01:46.019 [Cloud] End of cloud request. 2026-09-23T11:01:46.519 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T11:11:13.663 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T11:26:18.669 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T11:27:45.203 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T11:27:45.203 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T11:27:45.203 [Cloud] Queued cloud request. 2026-09-23T11:27:45.203 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T11:27:45.203 [Cloud] Dequeued cloud request. 2026-09-23T11:27:45.203 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T11:27:46.703 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CCC64A44-0503-8CEB-1292-109EB936E2E2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 11:27:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T11:27:47.203 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T11:39:35.490 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T11:39:35.490 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T11:39:35.490 [Cloud] Queued cloud request. 2026-09-23T11:39:35.490 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T11:39:35.490 [Cloud] Dequeued cloud request. 2026-09-23T11:39:35.490 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T11:39:35.693 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{752DE920-513B-E5EE-4F66-3FEEC2772D50} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 11:39:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T11:39:36.193 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T11:39:40.099 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27838, Count: 1786, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-23T11:39:40.099 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 13267, Count: 1127, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-23T11:39:40.099 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4389, Count: 385, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T11:39:40.099 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-23T11:39:40.099 ProcessImageName: AgentShellService.exe, Pid: 6904, TotalTime: 697, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-23T11:39:40.099 ProcessImageName: WmiPrvSE.exe, Pid: 7856, TotalTime: 676, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 5% 2026-09-23T11:39:40.099 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 497, Count: 43, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-23T11:39:40.099 ProcessImageName: powershell.exe, Pid: 7536, TotalTime: 215, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-23T11:39:40.099 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 15, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T11:39:40.099 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T11:39:40.099 ProcessImageName: python.exe, Pid: 7684, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-23T11:39:40.099 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 0% 2026-09-23T11:39:40.099 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-23T11:39:40.099 ProcessImageName: DeviceCensus.exe, Pid: 2400, TotalTime: 77, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-23T11:39:40.099 ProcessImageName: taskhostw.exe, Pid: 4840, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 3% 2026-09-23T11:39:40.099 ProcessImageName: cmd.exe, Pid: 7960, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-23T11:39:40.099 ProcessImageName: mysqldump.exe, Pid: 7916, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 18% 2026-09-23T11:39:40.099 ProcessImageName: python.exe, Pid: 4616, TotalTime: 30, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-23T11:39:40.099 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-23T11:39:40.099 ProcessImageName: powershell.exe, Pid: 336, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-23T11:39:40.099 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-23T11:39:40.099 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-23T11:39:40.099 ProcessImageName: ngentask.exe, Pid: 4728, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-23T11:39:40.099 ProcessImageName: taskhostw.exe, Pid: 2224, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-23T11:41:23.678 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T11:56:28.683 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T11:58:16.889 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T11:58:16.889 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T11:58:16.889 [Cloud] Queued cloud request. 2026-09-23T11:58:16.889 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T11:58:16.889 [Cloud] Dequeued cloud request. 2026-09-23T11:58:16.889 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T11:58:27.202 [Cloud] End of cloud request. 2026-09-23T11:58:27.718 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T12:11:33.692 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T12:15:26.912 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T12:15:26.912 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T12:15:26.912 [Cloud] Queued cloud request. 2026-09-23T12:15:26.912 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T12:15:26.912 [Cloud] Dequeued cloud request. 2026-09-23T12:15:26.912 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T12:15:27.709 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{715AC8B3-7CFC-3902-06E3-EB39D272200A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 12:15:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T12:15:28.209 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T12:16:34.052 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T12:16:34.052 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T12:16:34.052 [Cloud] Queued cloud request. 2026-09-23T12:16:34.052 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T12:16:34.052 [Cloud] Dequeued cloud request. 2026-09-23T12:16:34.052 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T12:16:44.193 [Cloud] End of cloud request. 2026-09-23T12:16:44.709 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T12:26:38.697 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T12:41:43.706 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T12:49:04.054 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T12:49:04.054 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T12:49:04.054 [Cloud] Queued cloud request. 2026-09-23T12:49:04.054 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T12:49:04.054 [Cloud] Dequeued cloud request. 2026-09-23T12:49:04.054 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T12:49:04.725 [Cloud] End of cloud request. 2026-09-23T12:49:05.241 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T12:49:05.538 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T12:49:05.538 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T12:49:05.538 [Cloud] Queued cloud request. 2026-09-23T12:49:05.538 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T12:49:05.538 [Cloud] Dequeued cloud request. 2026-09-23T12:49:05.538 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T12:49:05.741 [Cloud] End of cloud request. 2026-09-23T12:49:06.241 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T12:53:43.165 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T12:53:43.165 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T12:53:43.165 [Cloud] Queued cloud request. 2026-09-23T12:53:43.165 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T12:53:43.165 [Cloud] Dequeued cloud request. 2026-09-23T12:53:43.165 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T12:53:43.634 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4FB5DD2F-4FF6-C500-3B6A-A69E0BB0A01C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 12:53:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T12:53:44.149 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T12:56:48.712 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T13:11:53.720 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T13:23:31.976 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T13:23:31.976 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T13:23:31.976 [Cloud] Queued cloud request. 2026-09-23T13:23:31.976 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T13:23:31.976 [Cloud] Dequeued cloud request. 2026-09-23T13:23:31.976 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T13:23:32.179 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6EAA7A09-4218-24FE-70CA-918EEC2EEFF5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 13:23:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T13:23:32.679 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T13:26:58.726 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T13:28:03.510 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T13:28:03.510 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T13:28:03.510 [Cloud] Queued cloud request. 2026-09-23T13:28:03.510 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T13:28:03.510 [Cloud] Dequeued cloud request. 2026-09-23T13:28:03.510 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T13:28:03.713 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{34A80E9A-C0FF-5E48-F7A9-5D1AA55D9A3D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 13:28:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T13:28:04.229 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T13:34:43.293 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T13:34:43.293 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T13:34:43.293 [Cloud] Queued cloud request. 2026-09-23T13:34:43.293 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T13:34:43.293 [Cloud] Dequeued cloud request. 2026-09-23T13:34:43.293 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T13:34:43.496 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{64AE0D9E-AE45-2A7F-1DB5-788FED7A3BE8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 13:34:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T13:34:44.012 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T13:37:38.624 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T13:37:38.624 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T13:37:38.624 [Cloud] Queued cloud request. 2026-09-23T13:37:38.624 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T13:37:38.624 [Cloud] Dequeued cloud request. 2026-09-23T13:37:38.624 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T13:37:38.811 [Cloud] End of cloud request. 2026-09-23T13:37:39.327 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T13:39:40.172 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 28346, Count: 1827, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-23T13:39:40.172 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 15340, Count: 1301, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-23T13:39:40.172 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4389, Count: 385, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T13:39:40.172 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-23T13:39:40.172 ProcessImageName: AgentShellService.exe, Pid: 6904, TotalTime: 697, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-23T13:39:40.172 ProcessImageName: WmiPrvSE.exe, Pid: 7856, TotalTime: 676, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 5% 2026-09-23T13:39:40.172 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 527, Count: 45, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-23T13:39:40.172 ProcessImageName: powershell.exe, Pid: 7536, TotalTime: 215, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-23T13:39:40.172 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 210, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T13:39:40.172 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T13:39:40.172 ProcessImageName: python.exe, Pid: 7684, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-23T13:39:40.172 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 0% 2026-09-23T13:39:40.172 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-23T13:39:40.172 ProcessImageName: DeviceCensus.exe, Pid: 2400, TotalTime: 77, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-23T13:39:40.172 ProcessImageName: taskhostw.exe, Pid: 4840, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 3% 2026-09-23T13:39:40.172 ProcessImageName: cmd.exe, Pid: 7960, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-23T13:39:40.172 ProcessImageName: mysqldump.exe, Pid: 7916, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 18% 2026-09-23T13:39:40.172 ProcessImageName: python.exe, Pid: 4616, TotalTime: 30, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-23T13:39:40.172 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-23T13:39:40.172 ProcessImageName: powershell.exe, Pid: 336, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-23T13:39:40.172 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-23T13:39:40.172 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-23T13:39:40.172 ProcessImageName: ngentask.exe, Pid: 4728, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-23T13:39:40.172 ProcessImageName: taskhostw.exe, Pid: 2224, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-23T13:42:03.735 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T13:57:08.741 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T13:58:23.228 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T13:58:23.228 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T13:58:23.228 [Cloud] Queued cloud request. 2026-09-23T13:58:23.228 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T13:58:23.228 [Cloud] Dequeued cloud request. 2026-09-23T13:58:23.228 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{170C326C-2B59-9238-64A3-BB75DAA284EE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 13:58:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T13:58:23.400 [Cloud] End of cloud request. 2026-09-23T13:58:23.900 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T14:12:01.452 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T14:12:01.452 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T14:12:01.452 [Cloud] Queued cloud request. 2026-09-23T14:12:01.452 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T14:12:01.452 [Cloud] Dequeued cloud request. 2026-09-23T14:12:01.452 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T14:12:01.670 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3EB2C332-60E4-04EC-855A-4561DE242B22} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 14:12:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T14:12:02.170 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T14:12:13.748 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T14:16:44.624 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T14:16:44.624 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T14:16:44.624 [Cloud] Queued cloud request. 2026-09-23T14:16:44.624 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T14:16:44.781 [Cloud] Dequeued cloud request. 2026-09-23T14:16:44.781 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T14:16:44.953 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{716C44A1-7053-4621-5F91-AF4BED6C9DC2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 14:16:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T14:16:45.468 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T14:22:23.550 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T14:22:23.550 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T14:22:23.550 [Cloud] Queued cloud request. 2026-09-23T14:22:23.550 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T14:22:23.550 [Cloud] Dequeued cloud request. 2026-09-23T14:22:23.550 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T14:22:33.691 [Cloud] End of cloud request. 2026-09-23T14:22:34.191 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T14:27:18.755 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T14:29:36.226 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T14:29:36.226 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T14:29:36.226 [Cloud] Queued cloud request. 2026-09-23T14:29:36.226 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T14:29:36.226 [Cloud] Dequeued cloud request. 2026-09-23T14:29:36.226 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T14:29:36.414 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{491E66A3-46AF-88C7-6530-191B097C2DB7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 14:29:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T14:29:36.914 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T14:29:44.149 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T14:29:44.149 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T14:29:44.149 [Cloud] Queued cloud request. 2026-09-23T14:29:44.149 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T14:29:44.149 [Cloud] Dequeued cloud request. 2026-09-23T14:29:44.149 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T14:29:44.227 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{549DDD3B-3021-C529-130E-31CB75609CBF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 14:29:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T14:29:44.727 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T14:34:39.025 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T14:34:39.025 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T14:34:39.025 [Cloud] Queued cloud request. 2026-09-23T14:34:39.025 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T14:34:39.025 [Cloud] Dequeued cloud request. 2026-09-23T14:34:39.025 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T14:34:39.463 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4C6DB572-244F-802C-A911-C302C63FC207} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 14:34:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T14:34:39.963 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T14:42:23.764 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T14:46:30.594 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T14:46:30.594 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T14:46:30.594 [Cloud] Queued cloud request. 2026-09-23T14:46:30.594 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T14:46:30.594 [Cloud] Dequeued cloud request. 2026-09-23T14:46:30.594 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T14:46:37.250 [Cloud] End of cloud request. 2026-09-23T14:46:37.750 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T14:49:45.549 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T14:49:45.549 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T14:49:45.549 [Cloud] Queued cloud request. 2026-09-23T14:49:45.549 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T14:49:45.549 [Cloud] Dequeued cloud request. 2026-09-23T14:49:45.549 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T14:49:45.736 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E7995A5-E4C8-B642-8572-0C767B45B593} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 14:49:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T14:49:46.252 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T14:57:28.771 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T15:00:59.148 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T15:00:59.148 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T15:00:59.148 [Cloud] Queued cloud request. 2026-09-23T15:00:59.148 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T15:00:59.148 [Cloud] Dequeued cloud request. 2026-09-23T15:00:59.148 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T15:01:09.273 [Cloud] End of cloud request. 2026-09-23T15:01:09.773 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T15:03:40.460 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T15:03:40.460 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T15:03:40.460 [Cloud] Queued cloud request. 2026-09-23T15:03:40.460 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T15:03:40.460 [Cloud] Dequeued cloud request. 2026-09-23T15:03:40.460 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T15:03:40.663 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FB3CADF4-39CA-435D-1852-132B0E464DE2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 15:03:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T15:03:41.179 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T15:12:33.778 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T15:22:42.642 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T15:22:42.642 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T15:22:42.642 [Cloud] Queued cloud request. 2026-09-23T15:22:42.642 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T15:22:42.642 [Cloud] Dequeued cloud request. 2026-09-23T15:22:42.642 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T15:22:42.860 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4DE8039D-9915-20BE-EA48-79B0A5C6DC95} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 15:22:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T15:22:43.360 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T15:23:23.860 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T15:23:23.860 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T15:23:23.860 [Cloud] Queued cloud request. 2026-09-23T15:23:23.860 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T15:23:23.860 [Cloud] Dequeued cloud request. 2026-09-23T15:23:23.860 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T15:23:23.939 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F3C072ED-99E3-D26F-910C-28E3FB924284} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 15:23:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T15:23:24.454 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T15:27:38.786 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T15:39:40.245 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 30379, Count: 2000, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-23T15:39:40.245 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 17303, Count: 1473, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-23T15:39:40.245 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4389, Count: 385, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T15:39:40.245 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-23T15:39:40.245 ProcessImageName: AgentShellService.exe, Pid: 6904, TotalTime: 697, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-23T15:39:40.245 ProcessImageName: WmiPrvSE.exe, Pid: 7856, TotalTime: 676, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 5% 2026-09-23T15:39:40.245 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 632, Count: 53, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-23T15:39:40.245 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 225, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T15:39:40.245 ProcessImageName: powershell.exe, Pid: 7536, TotalTime: 215, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-23T15:39:40.245 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T15:39:40.245 ProcessImageName: python.exe, Pid: 7684, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-23T15:39:40.245 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 0% 2026-09-23T15:39:40.245 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-23T15:39:40.245 ProcessImageName: DeviceCensus.exe, Pid: 2400, TotalTime: 77, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-23T15:39:40.245 ProcessImageName: taskhostw.exe, Pid: 4840, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 3% 2026-09-23T15:39:40.245 ProcessImageName: cmd.exe, Pid: 7960, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-23T15:39:40.245 ProcessImageName: mysqldump.exe, Pid: 7916, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 18% 2026-09-23T15:39:40.245 ProcessImageName: python.exe, Pid: 4616, TotalTime: 30, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-23T15:39:40.245 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-23T15:39:40.245 ProcessImageName: powershell.exe, Pid: 336, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-23T15:39:40.245 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-23T15:39:40.245 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-23T15:39:40.245 ProcessImageName: ngentask.exe, Pid: 4728, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-23T15:39:40.245 ProcessImageName: taskhostw.exe, Pid: 2224, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-23T15:42:43.792 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T15:57:48.800 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T16:04:06.051 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T16:04:06.051 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T16:04:06.051 [Cloud] Queued cloud request. 2026-09-23T16:04:06.051 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T16:04:06.051 [Cloud] Dequeued cloud request. 2026-09-23T16:04:06.051 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T16:04:06.348 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5A94FFFD-338D-6045-5550-8459F6460DBD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 16:04:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T16:04:06.848 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T16:06:55.991 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T16:06:55.991 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T16:06:55.991 [Cloud] Queued cloud request. 2026-09-23T16:06:55.991 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T16:06:55.991 [Cloud] Dequeued cloud request. 2026-09-23T16:06:55.991 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T16:06:56.225 [Cloud] End of cloud request. 2026-09-23T16:06:56.725 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T16:11:43.618 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T16:11:43.618 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T16:11:43.618 [Cloud] Queued cloud request. 2026-09-23T16:11:43.618 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T16:11:43.618 [Cloud] Dequeued cloud request. 2026-09-23T16:11:43.618 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T16:11:43.805 [Cloud] End of cloud request. 2026-09-23T16:11:44.321 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T16:12:53.805 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T16:13:47.962 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T16:13:47.962 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T16:13:47.962 [Cloud] Queued cloud request. 2026-09-23T16:13:47.962 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T16:13:47.962 [Cloud] Dequeued cloud request. 2026-09-23T16:13:47.962 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T16:13:48.134 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7993575F-5199-0272-2757-E7C206F70F49} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 16:13:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T16:13:48.634 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T16:27:58.815 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T16:29:40.409 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T16:29:40.409 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T16:29:40.409 [Cloud] Queued cloud request. 2026-09-23T16:29:40.409 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T16:29:40.409 [Cloud] Dequeued cloud request. 2026-09-23T16:29:40.409 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T16:29:40.596 [Cloud] End of cloud request. 2026-09-23T16:29:41.112 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T16:35:34.989 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T16:35:34.989 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T16:35:34.989 [Cloud] Queued cloud request. 2026-09-23T16:35:34.989 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T16:35:34.989 [Cloud] Dequeued cloud request. 2026-09-23T16:35:34.989 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T16:35:35.176 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{96EBC10E-1A4F-D3D1-C123-E0DB379967A7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 16:35:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T16:35:35.676 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T16:43:03.821 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T16:50:38.232 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T16:50:38.232 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T16:50:38.232 [Cloud] Queued cloud request. 2026-09-23T16:50:38.232 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T16:50:38.232 [Cloud] Dequeued cloud request. 2026-09-23T16:50:38.232 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T16:50:38.451 [Cloud] End of cloud request. 2026-09-23T16:50:38.951 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T16:58:08.829 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T17:10:47.398 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T17:10:47.398 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T17:10:47.398 [Cloud] Queued cloud request. 2026-09-23T17:10:47.398 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T17:10:47.398 [Cloud] Dequeued cloud request. 2026-09-23T17:10:47.398 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T17:10:47.648 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5AE7E517-83B4-158E-4D53-6A2AB4D83119} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 17:10:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T17:10:48.148 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T17:13:13.836 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T17:17:44.494 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T17:17:44.494 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T17:17:44.494 [Cloud] Queued cloud request. 2026-09-23T17:17:44.494 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T17:17:44.494 [Cloud] Dequeued cloud request. 2026-09-23T17:17:44.494 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T17:17:44.635 [Cloud] End of cloud request. 2026-09-23T17:17:45.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T17:25:43.279 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T17:25:43.279 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T17:25:43.279 [Cloud] Queued cloud request. 2026-09-23T17:25:43.279 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T17:25:43.279 [Cloud] Dequeued cloud request. 2026-09-23T17:25:43.279 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T17:25:53.435 [Cloud] End of cloud request. 2026-09-23T17:25:53.935 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T17:28:18.844 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T17:39:40.302 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 30609, Count: 2010, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-23T17:39:40.302 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 19343, Count: 1640, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-23T17:39:40.302 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4389, Count: 385, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T17:39:40.302 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-23T17:39:40.302 ProcessImageName: AgentShellService.exe, Pid: 6904, TotalTime: 697, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-23T17:39:40.302 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 692, Count: 57, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-23T17:39:40.302 ProcessImageName: WmiPrvSE.exe, Pid: 7856, TotalTime: 676, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 5% 2026-09-23T17:39:40.302 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 240, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T17:39:40.302 ProcessImageName: powershell.exe, Pid: 7536, TotalTime: 215, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-23T17:39:40.302 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T17:39:40.302 ProcessImageName: python.exe, Pid: 7684, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-23T17:39:40.302 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 0% 2026-09-23T17:39:40.302 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-23T17:39:40.302 ProcessImageName: DeviceCensus.exe, Pid: 2400, TotalTime: 77, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-23T17:39:40.302 ProcessImageName: taskhostw.exe, Pid: 4840, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 3% 2026-09-23T17:39:40.302 ProcessImageName: cmd.exe, Pid: 7960, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-23T17:39:40.302 ProcessImageName: mysqldump.exe, Pid: 7916, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 18% 2026-09-23T17:39:40.302 ProcessImageName: python.exe, Pid: 4616, TotalTime: 30, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-23T17:39:40.302 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-23T17:39:40.302 ProcessImageName: powershell.exe, Pid: 336, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-23T17:39:40.302 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-23T17:39:40.302 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-23T17:39:40.302 ProcessImageName: ngentask.exe, Pid: 4728, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-23T17:39:40.302 ProcessImageName: taskhostw.exe, Pid: 2224, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-23T17:42:30.412 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T17:42:30.412 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T17:42:30.412 [Cloud] Queued cloud request. 2026-09-23T17:42:30.412 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T17:42:30.412 [Cloud] Dequeued cloud request. 2026-09-23T17:42:30.412 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T17:42:30.568 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{85158B22-7DC7-CCE3-06D1-342EB6963829} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 17:42:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T17:42:31.068 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T17:43:23.850 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T17:47:58.118 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T17:47:58.118 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T17:47:58.118 [Cloud] Queued cloud request. 2026-09-23T17:47:58.118 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T17:47:58.118 [Cloud] Dequeued cloud request. 2026-09-23T17:47:58.118 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T17:47:58.259 [Cloud] End of cloud request. 2026-09-23T17:47:58.775 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T17:52:24.464 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T17:52:24.464 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T17:52:24.464 [Cloud] Queued cloud request. 2026-09-23T17:52:24.464 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T17:52:24.464 [Cloud] Dequeued cloud request. 2026-09-23T17:52:24.464 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T17:52:24.620 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C0BD8A3B-047F-7282-1836-4C916122FBE1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 17:52:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T17:52:25.120 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T17:53:48.933 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T17:53:48.933 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T17:53:48.933 [Cloud] Queued cloud request. 2026-09-23T17:53:48.933 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T17:53:48.933 [Cloud] Dequeued cloud request. 2026-09-23T17:53:48.933 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T17:53:49.152 [Cloud] End of cloud request. 2026-09-23T17:53:49.668 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T17:57:17.529 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T17:57:17.529 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T17:57:17.529 [Cloud] Queued cloud request. 2026-09-23T17:57:17.529 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T17:57:17.529 [Cloud] Dequeued cloud request. 2026-09-23T17:57:17.529 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T17:57:19.826 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AFDE1050-8BEF-2E2E-751B-09E9325FC1F3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 17:57:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T17:57:20.326 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T17:58:28.858 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T18:03:20.110 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T18:03:20.110 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T18:03:20.110 [Cloud] Queued cloud request. 2026-09-23T18:03:20.110 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T18:03:20.110 [Cloud] Dequeued cloud request. 2026-09-23T18:03:20.110 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T18:03:20.282 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{829C749B-D39F-2DE1-C08A-13F172496BB0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 18:03:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T18:03:20.782 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T18:08:26.206 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T18:08:26.206 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T18:08:26.206 [Cloud] Queued cloud request. 2026-09-23T18:08:26.206 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T18:08:26.206 [Cloud] Dequeued cloud request. 2026-09-23T18:08:26.206 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T18:08:26.378 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{48E24C16-4330-844B-8E97-5F1BF3D9BD95} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 18:08:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T18:08:26.894 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T18:13:33.863 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T18:17:43.476 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T18:17:43.476 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T18:17:43.476 [Cloud] Queued cloud request. 2026-09-23T18:17:43.476 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T18:17:43.476 [Cloud] Dequeued cloud request. 2026-09-23T18:17:43.476 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T18:17:44.101 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AAED8310-C502-2C03-CCBC-DEB54B444DD3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 18:17:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T18:17:44.617 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T18:20:27.525 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T18:20:27.525 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T18:20:27.525 [Cloud] Queued cloud request. 2026-09-23T18:20:27.525 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T18:20:27.525 [Cloud] Dequeued cloud request. 2026-09-23T18:20:27.525 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T18:20:27.743 [Cloud] End of cloud request. 2026-09-23T18:20:28.259 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T18:20:49.431 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T18:20:49.431 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T18:20:49.431 [Cloud] Queued cloud request. 2026-09-23T18:20:49.431 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T18:20:49.431 [Cloud] Dequeued cloud request. 2026-09-23T18:20:49.431 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T18:20:49.509 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A42F3F29-1BEC-3E3E-4A0E-D7BC36B543F9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 18:20:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T18:20:50.025 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T18:28:38.872 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T18:36:46.827 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T18:36:46.827 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T18:36:46.827 [Cloud] Queued cloud request. 2026-09-23T18:36:46.827 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T18:36:46.827 [Cloud] Dequeued cloud request. 2026-09-23T18:36:46.827 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T18:36:47.015 [Cloud] End of cloud request. 2026-09-23T18:36:47.515 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T18:43:26.816 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T18:43:26.816 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T18:43:26.816 [Cloud] Queued cloud request. 2026-09-23T18:43:26.816 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T18:43:26.816 [Cloud] Dequeued cloud request. 2026-09-23T18:43:26.816 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T18:43:26.988 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{428800CD-73C1-E9F4-CA6F-FABD9DCE39DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 18:43:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T18:43:27.488 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T18:43:43.879 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T18:58:48.886 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T18:59:44.543 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T18:59:44.543 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T18:59:44.543 [Cloud] Queued cloud request. 2026-09-23T18:59:44.543 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T18:59:44.543 [Cloud] Dequeued cloud request. 2026-09-23T18:59:44.543 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T18:59:44.683 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2854533A-19D1-D5A1-7FC0-92DF609A9F97} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 18:59:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T18:59:45.183 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T19:00:26.355 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T19:00:26.355 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T19:00:26.355 [Cloud] Queued cloud request. 2026-09-23T19:00:26.355 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T19:00:26.355 [Cloud] Dequeued cloud request. 2026-09-23T19:00:26.355 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T19:00:26.449 [Cloud] End of cloud request. 2026-09-23T19:00:26.965 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T19:13:53.893 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T19:17:02.926 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T19:17:02.926 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T19:17:02.926 [Cloud] Queued cloud request. 2026-09-23T19:17:02.926 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T19:17:02.926 [Cloud] Dequeued cloud request. 2026-09-23T19:17:02.926 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T19:17:03.098 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A9572FD4-78BA-853E-297E-BB6C1C5C95DB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 19:17:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T19:17:03.598 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T19:28:58.901 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T19:35:45.325 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T19:35:45.325 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T19:35:45.325 [Cloud] Queued cloud request. 2026-09-23T19:35:45.325 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T19:35:45.325 [Cloud] Dequeued cloud request. 2026-09-23T19:35:45.325 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T19:35:45.512 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{30A6324A-A1AA-796F-26C2-B0B70009B009} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 19:35:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T19:35:45.825 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T19:36:09.496 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T19:36:09.496 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T19:36:09.496 [Cloud] Queued cloud request. 2026-09-23T19:36:09.496 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T19:36:09.496 [Cloud] Dequeued cloud request. 2026-09-23T19:36:09.496 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T19:36:09.590 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7DD46340-FB1F-6AE6-AD28-B74E00FB12B6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 19:36:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T19:36:10.090 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T19:39:13.906 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-23T19:39:13.921 Job Notification: New process added to job (7712) 2026-09-23T19:39:13.937 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-23T19:39:13.937 Aggressive catchup quick scan threshold: 660060936038 / 25920000000000 2026-09-23T19:39:13.937 Job Notification: New process added to job (4984) 2026-09-23T19:39:13.953 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:7712] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:4984]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-23T19:39:14.046 Job Notification: New process added to job (72) 2026-09-23T19:39:14.062 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-23T19:39:14.062 Job Notification: New process added to job (6948) 2026-09-23T19:39:14.093 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:72] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:6948]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-23T19:39:14.265 Job Notification: New process added to job (596) 2026-09-23T19:39:14.296 Task(GetDeviceTicket -AccessKey A55AEA2D-784D-B8B0-25F2-C47CC614F2F5 ) launched as network service 2026-09-23T19:39:14.453 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-23T19:39:14.453 [RTP] Duplicating the current plugin configuration object... 2026-09-23T19:39:14.453 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-23T19:39:14.453 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-23T19:39:14.453 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-23T19:39:14.453 [RTP] No config change detected. Not updating plugin configuration. 2026-09-23T19:39:14.453 [RTP] No config changes found. No configuration switch. 2026-09-23T19:39:14.453 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-23T19:39:14.812 Job Notification: Process exited from job (596) 2026-09-23T19:39:14.968 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-23T19:39:14.968 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T19:39:14.968 [Cloud] Queued cloud request. 2026-09-23T19:39:14.968 [Cloud] Dequeued cloud request. 2026-09-23T19:39:14.968 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T19:39:15.156 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-23T19:39:15.156 [Cloud] End of cloud request. 2026-09-23T19:39:15.484 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T19:39:34.390 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\58C7C4B7-45AC-46E1-BC23-4BA63E0C4BE1fe4.1dd4b9340d45b66 2026-09-23T19:39:34.484 Verifying engine and signature files (source: 0) ... 2026-09-23T19:39:34.484 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E}\mpengine.dll] due to PPL. 2026-09-23T19:39:34.484 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E}\mpasbase.vdm]. File not in cache (0x1) 2026-09-23T19:39:35.484 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E}\mpasbase.vdm] 2026-09-23T19:39:35.484 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-23T19:39:35.515 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E}\mpasdlta.vdm] 2026-09-23T19:39:35.515 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E}\mpavbase.vdm]. File not in cache (0x1) 2026-09-23T19:39:35.937 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E}\mpavbase.vdm] 2026-09-23T19:39:35.937 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-23T19:39:35.968 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E}\mpavdlta.vdm] 2026-09-23T19:39:36.156 [Engine] IsHybridMode: 0 2026-09-23T19:39:36.156 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-23T19:39:36.156 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-F4B8D510C7344552C5393F456FF9229858B05986.bin): 0x00000002 2026-09-23T19:39:36.171 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-F4B8D510C7344552C5393F456FF9229858B05986.bin) 2026-09-23T19:39:36.171 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-23T19:39:36.171 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-23T19:39:36.171 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-23T19:39:36.171 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff 2026-09-23T19:39:40.375 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 31004, Count: 2041, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-23T19:39:40.375 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 21497, Count: 1819, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-23T19:39:40.375 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4389, Count: 385, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T19:39:40.375 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-23T19:39:40.375 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 752, Count: 63, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-23T19:39:40.375 ProcessImageName: AgentShellService.exe, Pid: 6904, TotalTime: 697, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-23T19:39:40.375 ProcessImageName: WmiPrvSE.exe, Pid: 7856, TotalTime: 676, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 5% 2026-09-23T19:39:40.375 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 255, Count: 19, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T19:39:40.375 ProcessImageName: powershell.exe, Pid: 7536, TotalTime: 215, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-23T19:39:40.375 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T19:39:40.375 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 150, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 0% 2026-09-23T19:39:40.375 ProcessImageName: python.exe, Pid: 7684, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-23T19:39:40.375 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-23T19:39:40.375 ProcessImageName: DeviceCensus.exe, Pid: 2400, TotalTime: 77, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-23T19:39:40.375 ProcessImageName: taskhostw.exe, Pid: 4840, TotalTime: 46, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 3% 2026-09-23T19:39:40.375 ProcessImageName: cmd.exe, Pid: 7960, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-23T19:39:40.375 ProcessImageName: mysqldump.exe, Pid: 7916, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 18% 2026-09-23T19:39:40.375 ProcessImageName: python.exe, Pid: 4616, TotalTime: 30, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 1% 2026-09-23T19:39:40.375 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\Smtp-access.tab, EstimatedImpact: 0% 2026-09-23T19:39:40.375 ProcessImageName: powershell.exe, Pid: 336, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-23T19:39:40.375 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-23T19:39:40.375 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-23T19:39:40.375 ProcessImageName: ngentask.exe, Pid: 4728, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-23T19:39:40.375 ProcessImageName: taskhostw.exe, Pid: 2224, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-23T19:39:48.156 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-23T19:39:48.156 [AutoExclusion] Applied roles from cache. 2026-09-23T19:39:48.156 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-23T19:39:48.265 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF4ABB020, lRefCount: 6, hr=0 2026-09-23T19:39:48.265 [Engine] New active engine 00007FFCF68AB020 replacing engine 00007FFCF4ABB020. Number of active engines: 2 2026-09-23T19:39:48.281 EngineInit:Global ASOC is enabled 2026-09-23T19:39:48.281 EngineInit:ASOO is enabled for developer volumes 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.375 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-23T19:39:48.406 MpWriteUupSignatureVersion 1.459.362.0, hr = 0 2026-09-23T19:39:48.406 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-23T19:39:48.437 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-23T19:39:48.437 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-23T19:39:48.437 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-23T19:39:48.437 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-23T19:39:48.453 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-23T19:39:48.453 [Plugin] Initializing RTP plugin state... 2026-09-23T19:39:48.453 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-23T19:39:48.453 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎22‎-‎2026 21:39:40 Last Perf:‎09‎-‎22‎-‎2026 21:39:39 First RTP Scan:‎09‎-‎22‎-‎2026 21:39:40 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1475 Misses:7174 BM Queue:0,43,0 Proc:0,28,0 File:0,43,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:2465240 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:543238352 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:4231 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:150971 TotalHits:1327999 InstanceCacheInserts:30642 InstanceCacheUpdates:0 InstanceCacheDeletes:16989 InstanceCacheHits:703 InstanceCacheMisses:99135 InstanceCacheOverflows:12907 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:4ms (7135/1462) Success: 1462, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-23T19:39:48.453 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E} 2026-09-23T19:39:48.453 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A}\mpasbase.vdm in use, hr=0x80070020 2026-09-23T19:39:48.453 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{857E13B8-0CDE-4A78-A7C0-4A607298ACB6} removed 2026-09-23T19:39:48.453 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-23T19:39:48.453 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-23T19:39:48.453 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-23T19:39:48.453 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-23T19:39:48.453 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-23T19:39:48.453 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-23-2026 19:39:48 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-23-2026 19:39:48 2026-09-23T19:39:48.468 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-23T19:39:48.468 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-23T19:39:48.468 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-23T19:39:48.468 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-23T19:39:48.468 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T19:39:48.468 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-23T19:39:48.468 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-23T19:39:48.468 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-23T19:39:48.468 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-23T19:39:48.468 MdCoreSvc is supported in this platform and OS Signature updated on 09-23-2026 19:39:48 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.362.0 AV Signature Version: 1.459.362.0 ************************************************************ 2026-09-23T19:39:48.484 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-23T19:39:48.484 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\58C7C4B7-45AC-46E1-BC23-4BA63E0C4BE1fe4.1dd4b9340d45b66 2026-09-23T19:39:48.499 Process scan (postsignatureupdatescan) started. 2026-09-23T19:39:48.531 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-23T19:39:48.531 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-23-2026 19:39:48 ************************************************************ 2026-09-23T19:39:48.687 Job Notification: Process exited from job (72) 2026-09-23T19:39:48.703 Job Notification: Process exited from job (6948) 2026-09-23T19:39:48.727 Job Notification: Process exited from job (7712) 2026-09-23T19:39:48.734 Job Notification: Process exited from job (4984) 2026-09-23T19:39:48.781 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-23T19:39:48.781 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-23T19:39:48.781 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-23T19:39:48.781 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-23T19:39:48.781 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-23T19:39:48.828 [Engine] Engine 00007FFCF4ABB020 no longer in use. Number of active engines: 1 2026-09-23T19:39:48.828 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-23T19:39:48.828 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-23T19:39:48.927 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-23T19:39:48.927 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-23T19:39:48.927 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-23T19:39:49.453 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 31004, Count: 2041, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-23T19:39:49.453 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 21497, Count: 1819, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-23T19:39:49.453 ProcessImageName: AgentShell.exe, Pid: 7668, TotalTime: 4389, Count: 385, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T19:39:49.453 ProcessImageName: powershell.exe, Pid: 4232, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-23T19:39:49.453 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 752, Count: 63, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-23T19:39:49.453 ProcessImageName: AgentShellService.exe, Pid: 6904, TotalTime: 697, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 51% 2026-09-23T19:39:49.453 ProcessImageName: WmiPrvSE.exe, Pid: 7856, TotalTime: 676, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\http.sys, EstimatedImpact: 5% 2026-09-23T19:39:49.453 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 255, Count: 19, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T19:39:49.453 ProcessImageName: powershell.exe, Pid: 7536, TotalTime: 215, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-23T19:39:49.453 ProcessImageName: WmiPrvSE.exe, Pid: 4104, TotalTime: 185, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T19:39:49.453 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 150, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-1f403-0.MAI, EstimatedImpact: 0% 2026-09-23T19:39:49.453 ProcessImageName: python.exe, Pid: 7684, TotalTime: 150, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-23T19:39:49.453 ProcessImageName: taskhostw.exe, Pid: 3500, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-23T19:39:49.453 ProcessImageName: DeviceCensus.exe, Pid: 2400, TotalTime: 77, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 8% 2026-09-23T19:39:49.531 [Engine] RSIG_UNLOADENGINE, 00007FFCF4ABB020, err=0x0 2026-09-23T19:39:49.562 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7114251D-C8DB-47B2-B8AC-B50677E4809A} removed 2026-09-23T19:40:02.562 Process scan (postsignatureupdatescan) completed. 2026-09-23T19:44:03.907 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T19:44:48.313 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-23T19:59:08.915 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T20:00:33.899 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T20:00:33.899 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T20:00:33.899 [Cloud] Queued cloud request. 2026-09-23T20:00:33.899 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T20:00:33.899 [Cloud] Dequeued cloud request. 2026-09-23T20:00:33.899 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T20:00:34.055 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B230881B-7523-582A-C629-EDFCB8FB6293} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 20:00:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T20:00:34.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T20:14:13.922 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T20:26:32.379 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T20:26:32.379 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T20:26:32.379 [Cloud] Queued cloud request. 2026-09-23T20:26:32.379 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T20:26:32.379 [Cloud] Dequeued cloud request. 2026-09-23T20:26:32.379 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T20:26:32.519 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C40FDE67-13DB-B025-484B-D9609990E8A4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 20:26:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T20:26:33.019 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T20:29:18.929 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T20:44:19.764 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T20:44:19.764 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T20:44:19.764 [Cloud] Queued cloud request. 2026-09-23T20:44:19.764 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T20:44:20.030 [Cloud] Dequeued cloud request. 2026-09-23T20:44:20.030 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T20:44:20.874 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06062083-A580-B360-7C57-2E3F51AAE3A9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 20:44:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T20:44:21.374 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T20:44:23.936 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T20:59:28.943 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T21:00:56.710 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T21:00:56.710 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T21:00:56.710 [Cloud] Queued cloud request. 2026-09-23T21:00:56.710 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T21:00:56.710 [Cloud] Dequeued cloud request. 2026-09-23T21:00:56.710 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T21:00:56.897 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C6B73CB-51F4-F21C-E445-B86EF4FCE883} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 21:00:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T21:00:57.397 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T21:08:55.710 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\IDR_XML_DEFAULT_TRANSFORM[1]. Process: \Device\HarddiskVolume2\Windows\System32\taskhostw.exe, Status: 0xc0000001, State: 0, ScanRequest #2495483, FileId: 0x1a000000033f3e, Reason: OnClose, IoStatusBlockForNewFile: 0x3, DesiredAccess:0x0, FileAttributes:0x2020, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-23T21:08:58.617 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T21:08:58.617 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T21:08:58.617 [Cloud] Queued cloud request. 2026-09-23T21:08:58.617 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T21:08:58.617 [Cloud] Dequeued cloud request. 2026-09-23T21:08:58.617 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T21:08:58.773 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6C4F53A1-F2F7-CB94-F67E-879C06221A47} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 21:08:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T21:08:59.273 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T21:14:33.945 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T21:21:28.906 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T21:21:28.906 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T21:21:28.906 [Cloud] Queued cloud request. 2026-09-23T21:21:28.906 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T21:21:28.906 [Cloud] Dequeued cloud request. 2026-09-23T21:21:28.906 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T21:21:29.047 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{77D21B7D-0F47-7DB5-5F26-9468A8377F5B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 21:21:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T21:21:29.547 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T21:21:58.000 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T21:21:58.000 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T21:21:58.000 [Cloud] Queued cloud request. 2026-09-23T21:21:58.000 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T21:21:58.000 [Cloud] Dequeued cloud request. 2026-09-23T21:21:58.000 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T21:21:58.078 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{86652762-FA13-3728-4585-E27AE04E29C3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 21:21:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T21:21:58.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T21:29:38.957 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T21:39:48.322 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 2069, Count: 115, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\inc\functions.inc.php, EstimatedImpact: 0% 2026-09-23T21:39:48.322 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2025, Count: 178, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T21:39:48.322 ProcessImageName: powershell.exe, Pid: 6100, TotalTime: 1604, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-23T21:39:48.322 ProcessImageName: WmiPrvSE.exe, Pid: 5796, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 40% 2026-09-23T21:39:48.322 ProcessImageName: WmiPrvSE.exe, Pid: 6984, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T21:39:48.322 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 75, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-23T21:39:48.322 ProcessImageName: taskhostw.exe, Pid: 1608, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 21% 2026-09-23T21:39:48.322 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T21:39:48.322 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-23T21:39:48.322 ProcessImageName: taskhostw.exe, Pid: 1724, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 4% 2026-09-23T21:39:48.322 ProcessImageName: ngentask.exe, Pid: 7548, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-23T21:44:43.963 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T21:59:48.971 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T22:07:39.881 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:07:39.881 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:07:39.881 [Cloud] Queued cloud request. 2026-09-23T22:07:39.881 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:07:39.881 [Cloud] Dequeued cloud request. 2026-09-23T22:07:39.881 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{F801ED2C-3BFE-0DF8-0B12-8A4D46D588C3} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 22:07:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T22:07:50.021 [Cloud] End of cloud request. 2026-09-23T22:07:50.521 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:10:41.069 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:10:41.069 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:10:41.069 [Cloud] Queued cloud request. 2026-09-23T22:10:41.069 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:10:41.069 [Cloud] Dequeued cloud request. 2026-09-23T22:10:41.069 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:10:41.257 [Cloud] End of cloud request. 2026-09-23T22:10:41.772 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:14:53.975 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T22:16:12.712 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:16:12.712 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:16:12.712 [Cloud] Queued cloud request. 2026-09-23T22:16:12.712 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:16:12.712 [Cloud] Dequeued cloud request. 2026-09-23T22:16:12.712 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:16:12.900 [Cloud] End of cloud request. 2026-09-23T22:16:13.400 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:18:09.557 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:18:09.557 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:18:09.557 [Cloud] Queued cloud request. 2026-09-23T22:18:09.557 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:18:09.557 [Cloud] Dequeued cloud request. 2026-09-23T22:18:09.557 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:18:09.729 [Cloud] End of cloud request. 2026-09-23T22:18:10.229 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:21:30.683 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:21:30.683 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:21:30.683 [Cloud] Queued cloud request. 2026-09-23T22:21:30.683 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:21:30.683 [Cloud] Dequeued cloud request. 2026-09-23T22:21:30.683 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:21:30.824 [Cloud] End of cloud request. 2026-09-23T22:21:31.339 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:23:09.058 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:23:09.058 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:23:09.058 [Cloud] Queued cloud request. 2026-09-23T22:23:09.058 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:23:09.058 [Cloud] Dequeued cloud request. 2026-09-23T22:23:09.058 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:23:09.199 [Cloud] End of cloud request. 2026-09-23T22:23:09.714 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:27:04.606 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:27:04.606 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:27:04.606 [Cloud] Queued cloud request. 2026-09-23T22:27:04.606 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:27:04.606 [Cloud] Dequeued cloud request. 2026-09-23T22:27:04.606 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:27:04.746 [Cloud] End of cloud request. 2026-09-23T22:27:05.246 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:27:32.920 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:27:32.920 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:27:32.920 [Cloud] Queued cloud request. 2026-09-23T22:27:32.920 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:27:32.920 [Cloud] Dequeued cloud request. 2026-09-23T22:27:32.920 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:27:33.014 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2B9401C1-FF45-3CD2-F2AA-F5299D0A6B7C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 22:27:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T22:27:33.530 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:29:09.687 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:29:09.687 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:29:09.687 [Cloud] Queued cloud request. 2026-09-23T22:29:09.687 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:29:09.687 [Cloud] Dequeued cloud request. 2026-09-23T22:29:09.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:29:09.828 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2DF411EF-D60C-0E32-8ED4-7B0022EBED9A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 22:29:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T22:29:10.328 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:29:58.985 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T22:33:52.892 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:33:52.892 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:33:52.892 [Cloud] Queued cloud request. 2026-09-23T22:33:52.892 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:33:52.892 [Cloud] Dequeued cloud request. 2026-09-23T22:33:52.892 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:33:53.095 [Cloud] End of cloud request. 2026-09-23T22:33:53.595 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:37:03.550 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:37:03.550 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:37:03.550 [Cloud] Queued cloud request. 2026-09-23T22:37:03.550 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:37:03.550 [Cloud] Dequeued cloud request. 2026-09-23T22:37:03.550 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:37:04.800 [Cloud] End of cloud request. 2026-09-23T22:37:05.300 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:38:27.051 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:38:27.051 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:38:27.051 [Cloud] Queued cloud request. 2026-09-23T22:38:27.051 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:38:27.051 [Cloud] Dequeued cloud request. 2026-09-23T22:38:27.051 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:38:27.207 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5EC758E3-6171-5B5B-5CE7-94DCE4EF4700} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 22:38:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T22:38:27.723 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:38:38.441 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:38:38.441 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:38:38.441 [Cloud] Queued cloud request. 2026-09-23T22:38:38.441 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:38:38.441 [Cloud] Dequeued cloud request. 2026-09-23T22:38:38.441 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:38:38.520 [Cloud] End of cloud request. 2026-09-23T22:38:39.020 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:38:45.785 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:38:45.785 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:38:45.785 [Cloud] Queued cloud request. 2026-09-23T22:38:45.785 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:38:45.785 [Cloud] Dequeued cloud request. 2026-09-23T22:38:45.785 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:38:45.863 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{14CE0B03-B2F7-F812-D821-983C62591B7C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 22:38:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T22:38:46.363 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:38:56.957 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:38:56.957 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:38:56.957 [Cloud] Queued cloud request. 2026-09-23T22:38:56.957 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:38:56.957 [Cloud] Dequeued cloud request. 2026-09-23T22:38:56.957 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:38:57.035 [Cloud] End of cloud request. 2026-09-23T22:38:57.535 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:39:35.098 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:39:35.098 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:39:35.098 [Cloud] Queued cloud request. 2026-09-23T22:39:35.098 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:39:35.098 [Cloud] Dequeued cloud request. 2026-09-23T22:39:35.098 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:39:35.238 [Cloud] End of cloud request. 2026-09-23T22:39:35.738 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:40:40.442 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:40:40.442 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:40:40.442 [Cloud] Queued cloud request. 2026-09-23T22:40:40.442 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:40:40.442 [Cloud] Dequeued cloud request. 2026-09-23T22:40:40.442 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:40:40.599 [Cloud] End of cloud request. 2026-09-23T22:40:41.114 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:41:26.802 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:41:26.802 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:41:26.802 [Cloud] Queued cloud request. 2026-09-23T22:41:26.802 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:41:26.802 [Cloud] Dequeued cloud request. 2026-09-23T22:41:26.802 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:41:26.912 [Cloud] End of cloud request. 2026-09-23T22:41:27.412 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:42:20.459 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:42:20.459 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:42:20.459 [Cloud] Queued cloud request. 2026-09-23T22:42:20.459 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:42:20.459 [Cloud] Dequeued cloud request. 2026-09-23T22:42:20.459 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:42:20.537 [Cloud] End of cloud request. 2026-09-23T22:42:21.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:43:41.912 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:43:41.912 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:43:41.912 [Cloud] Queued cloud request. 2026-09-23T22:43:41.912 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:43:41.912 [Cloud] Dequeued cloud request. 2026-09-23T22:43:41.912 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:43:42.396 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6C979515-A005-D04F-C7B0-908001538038} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 22:43:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T22:43:42.896 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T22:45:03.990 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T22:57:36.966 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T22:57:36.966 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T22:57:36.966 [Cloud] Queued cloud request. 2026-09-23T22:57:36.966 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T22:57:36.966 [Cloud] Dequeued cloud request. 2026-09-23T22:57:36.966 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T22:57:37.153 [Cloud] End of cloud request. 2026-09-23T22:57:37.653 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T23:00:08.998 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T23:00:38.217 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T23:00:38.217 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T23:00:38.217 [Cloud] Queued cloud request. 2026-09-23T23:00:38.217 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T23:00:38.217 [Cloud] Dequeued cloud request. 2026-09-23T23:00:38.217 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T23:00:38.420 [Cloud] End of cloud request. 2026-09-23T23:00:38.935 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T23:03:42.373 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T23:03:42.373 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T23:03:42.373 [Cloud] Queued cloud request. 2026-09-23T23:03:42.373 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T23:03:42.373 [Cloud] Dequeued cloud request. 2026-09-23T23:03:42.373 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T23:03:46.560 [Cloud] End of cloud request. 2026-09-23T23:03:47.060 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T23:15:14.005 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T23:21:59.867 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T23:21:59.867 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T23:21:59.867 [Cloud] Queued cloud request. 2026-09-23T23:21:59.867 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T23:21:59.867 [Cloud] Dequeued cloud request. 2026-09-23T23:21:59.867 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T23:22:00.023 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AC83F42C-8B30-0E0C-EB4E-09D1B5F396E0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 23:22:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T23:22:00.523 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T23:27:27.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T23:27:27.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T23:27:27.604 [Cloud] Queued cloud request. 2026-09-23T23:27:27.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T23:27:27.604 [Cloud] Dequeued cloud request. 2026-09-23T23:27:27.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T23:27:27.744 [Cloud] End of cloud request. 2026-09-23T23:27:28.260 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T23:30:19.011 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T23:30:28.308 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T23:30:28.308 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T23:30:28.308 [Cloud] Queued cloud request. 2026-09-23T23:30:28.308 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T23:30:28.308 [Cloud] Dequeued cloud request. 2026-09-23T23:30:28.308 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T23:30:38.386 [Cloud] End of cloud request. 2026-09-23T23:30:38.886 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T23:31:03.136 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T23:31:03.136 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T23:31:03.136 [Cloud] Queued cloud request. 2026-09-23T23:31:03.136 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T23:31:03.136 [Cloud] Dequeued cloud request. 2026-09-23T23:31:03.136 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T23:31:03.230 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4DA24CD1-3C60-6F97-C7E8-825D5A6E21EE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 23:31:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T23:31:03.730 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T23:33:12.995 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T23:33:12.995 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T23:33:12.995 [Cloud] Queued cloud request. 2026-09-23T23:33:12.995 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T23:33:12.995 [Cloud] Dequeued cloud request. 2026-09-23T23:33:12.995 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T23:33:13.448 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9A7E98BA-C5A0-F17B-B47F-26C551561A4B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 23:33:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T23:33:13.948 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T23:35:29.715 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T23:35:29.715 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T23:35:29.715 [Cloud] Queued cloud request. 2026-09-23T23:35:29.715 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T23:35:29.715 [Cloud] Dequeued cloud request. 2026-09-23T23:35:29.715 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T23:35:29.918 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{54CF6E29-1790-7F17-D20C-965277F183EB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 23:35:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T23:35:30.418 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T23:36:14.278 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T23:36:14.278 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T23:36:14.278 [Cloud] Queued cloud request. 2026-09-23T23:36:14.278 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T23:36:14.278 [Cloud] Dequeued cloud request. 2026-09-23T23:36:14.278 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T23:36:14.356 [Cloud] End of cloud request. 2026-09-23T23:36:14.856 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-23T23:39:48.391 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 5584, Count: 397, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\inc\functions.inc.php, EstimatedImpact: 0% 2026-09-23T23:39:48.391 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2588, Count: 220, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-23T23:39:48.391 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 2437, Count: 182, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-23T23:39:48.391 ProcessImageName: powershell.exe, Pid: 6100, TotalTime: 1604, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-23T23:39:48.391 ProcessImageName: AgentShellService.exe, Pid: 3188, TotalTime: 865, Count: 31, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-23T23:39:48.391 ProcessImageName: WmiPrvSE.exe, Pid: 5664, TotalTime: 631, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 11% 2026-09-23T23:39:48.391 ProcessImageName: WmiPrvSE.exe, Pid: 5796, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 40% 2026-09-23T23:39:48.391 ProcessImageName: WmiPrvSE.exe, Pid: 6984, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-23T23:39:48.391 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 90, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-23T23:39:48.391 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-23T23:39:48.391 ProcessImageName: powershell.exe, Pid: 6636, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB2D5.tmp, EstimatedImpact: 0% 2026-09-23T23:39:48.391 ProcessImageName: taskhostw.exe, Pid: 1608, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 21% 2026-09-23T23:39:48.391 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-23T23:39:48.391 ProcessImageName: taskhostw.exe, Pid: 1724, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 4% 2026-09-23T23:39:48.391 ProcessImageName: ngentask.exe, Pid: 7548, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-23T23:45:24.017 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-23T23:46:33.862 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-23T23:46:33.862 [Cloud] Start of cloud request. Passive mode: 0 2026-09-23T23:46:33.862 [Cloud] Queued cloud request. 2026-09-23T23:46:33.862 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-23T23:46:33.862 [Cloud] Dequeued cloud request. 2026-09-23T23:46:33.862 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-23T23:46:34.018 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A2E1883D-DE23-4631-4ECC-F6E03B0CDBE9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-23-2026 23:46:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-23T23:46:34.518 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T00:00:29.025 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T00:11:41.357 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T00:11:41.357 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T00:11:41.357 [Cloud] Queued cloud request. 2026-09-24T00:11:41.357 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T00:11:41.357 [Cloud] Dequeued cloud request. 2026-09-24T00:11:41.357 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T00:11:41.576 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8EFFA4E9-129F-7A02-B17B-425DBEE675FB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 00:11:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T00:11:42.076 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T00:15:34.029 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T00:23:15.362 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T00:23:15.362 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T00:23:15.362 [Cloud] Queued cloud request. 2026-09-24T00:23:15.362 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T00:23:15.362 [Cloud] Dequeued cloud request. 2026-09-24T00:23:15.362 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T00:23:15.518 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C9E31C7D-3729-57DD-C519-C5D54C42E790} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 00:23:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T00:23:16.034 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{20E2FD17-FCCC-88EB-38E5-1944E6F4176E} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-24-2026 00:30:16 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T00:30:17.365 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T00:30:17.365 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T00:30:17.365 [Cloud] Queued cloud request. 2026-09-24T00:30:17.365 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T00:30:17.365 [Cloud] Dequeued cloud request. 2026-09-24T00:30:17.365 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T00:30:17.646 [Cloud] End of cloud request. 2026-09-24T00:30:18.162 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T00:30:39.037 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T00:31:35.896 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T00:31:35.896 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T00:31:35.896 [Cloud] Queued cloud request. 2026-09-24T00:31:35.896 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T00:31:36.052 [Cloud] Dequeued cloud request. 2026-09-24T00:31:36.052 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T00:31:36.193 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{56F1A413-8ADC-B5D7-6F6C-00DB35088A66} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 00:31:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T00:31:36.709 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T00:34:09.459 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T00:34:09.459 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T00:34:09.459 [Cloud] Queued cloud request. 2026-09-24T00:34:09.459 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T00:34:09.459 [Cloud] Dequeued cloud request. 2026-09-24T00:34:09.459 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T00:34:19.600 [Cloud] End of cloud request. 2026-09-24T00:34:20.100 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T00:36:16.116 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T00:36:16.116 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T00:36:16.116 [Cloud] Queued cloud request. 2026-09-24T00:36:16.116 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T00:36:16.116 [Cloud] Dequeued cloud request. 2026-09-24T00:36:16.116 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T00:36:16.304 [Cloud] End of cloud request. 2026-09-24T00:36:16.804 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T00:45:44.042 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T01:00:02.098 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573019, FileId: 0x4b000000033ef3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.098 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573018, FileId: 0x45000000036287, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.129 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573028, FileId: 0x4d000000033ef3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.129 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573027, FileId: 0x47000000036287, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.145 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573033, FileId: 0x49000000036287, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.145 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573034, FileId: 0x4f000000033ef3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.160 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573039, FileId: 0x4b000000036287, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.160 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573040, FileId: 0x51000000033ef3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.176 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573045, FileId: 0x4d000000036287, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.176 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573046, FileId: 0x53000000033ef3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.192 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573051, FileId: 0x4f000000036287, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.192 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573052, FileId: 0x55000000033ef3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.207 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573057, FileId: 0x57000000033ef3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.207 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573058, FileId: 0x51000000036287, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.223 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573064, FileId: 0x59000000033ef3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.223 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573063, FileId: 0x53000000036287, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.223 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573069, FileId: 0x5b000000033ef3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.223 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573070, FileId: 0x55000000036287, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.238 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573075, FileId: 0x57000000036287, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.238 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573076, FileId: 0x5d000000033ef3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.254 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573081, FileId: 0x59000000036287, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.254 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573082, FileId: 0x5f000000033ef3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.270 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573088, FileId: 0x61000000033ef3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:02.270 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20c2f-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #2573087, FileId: 0x5b000000036287, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-24T01:00:49.051 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T01:15:54.055 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T01:19:07.840 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:72781B17-58E9-4080-8E7D-E413E25D9256, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-24T01:19:07.840 Scheduled scan with Id 72781B17-58E9-4080-8E7D-E413E25D9256 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-24T01:19:07.840 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-24T01:19:07.840 [SFC] System file cache build is not needed (already completed) 2026-09-24T01:19:29.669 Engine:Triggered AR EMS scan 2026-09-24T01:19:29.669 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.684 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.700 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.700 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.716 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.731 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.731 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.747 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.762 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.762 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.778 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.778 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.794 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.794 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.794 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.809 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.809 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.825 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.825 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.840 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.840 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.840 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.856 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.856 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.856 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.872 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.887 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.903 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.903 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.903 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.903 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.919 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.934 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.950 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.950 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.965 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.981 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.981 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.997 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.997 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.997 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:29.997 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.012 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.012 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.028 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.044 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.044 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.059 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.075 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.075 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.075 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.090 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.090 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.106 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.106 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.106 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.122 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.122 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.153 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.153 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:19:30.169 Engine:EMS scan for process: svchost pid: 6256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-24T01:20:10.466 QuickScan:ScanID:72781B17-58E9-4080-8E7D-E413E25D9256: Quick scan finished with error 0 2026-09-24T01:20:10.981 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-24T01:20:10.981 [RTP] Duplicating the current plugin configuration object... 2026-09-24T01:20:10.981 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-24T01:20:10.981 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-24T01:20:10.981 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-24T01:20:10.981 [RTP] No config change detected. Not updating plugin configuration. 2026-09-24T01:20:10.981 [RTP] No config changes found. No configuration switch. 2026-09-24T01:20:10.981 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-24T01:30:59.064 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T01:39:48.442 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 7810, Count: 512, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-24T01:39:48.442 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 4571, Count: 366, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-24T01:39:48.442 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2588, Count: 220, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-24T01:39:48.442 ProcessImageName: powershell.exe, Pid: 6100, TotalTime: 1604, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-24T01:39:48.442 ProcessImageName: AgentShellService.exe, Pid: 3188, TotalTime: 865, Count: 31, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-24T01:39:48.442 ProcessImageName: WmiPrvSE.exe, Pid: 5664, TotalTime: 631, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 11% 2026-09-24T01:39:48.442 ProcessImageName: WmiPrvSE.exe, Pid: 5796, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 40% 2026-09-24T01:39:48.442 ProcessImageName: WmiPrvSE.exe, Pid: 6984, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-24T01:39:48.442 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 196, Count: 17, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-24T01:39:48.442 ProcessImageName: python.exe, Pid: 8072, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-24T01:39:48.442 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 90, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-24T01:39:48.442 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20be0-0.MAI, EstimatedImpact: 0% 2026-09-24T01:39:48.442 ProcessImageName: powershell.exe, Pid: 6636, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB2D5.tmp, EstimatedImpact: 0% 2026-09-24T01:39:48.442 ProcessImageName: mysqldump.exe, Pid: 6776, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 19% 2026-09-24T01:39:48.442 ProcessImageName: taskhostw.exe, Pid: 1608, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 21% 2026-09-24T01:39:48.442 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-24T01:39:48.442 ProcessImageName: taskhostw.exe, Pid: 1724, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 4% 2026-09-24T01:39:48.442 ProcessImageName: DeviceCensus.exe, Pid: 7464, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 3% 2026-09-24T01:39:48.442 ProcessImageName: cmd.exe, Pid: 5084, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-24T01:39:48.442 ProcessImageName: ngentask.exe, Pid: 7548, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-24T01:43:51.365 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T01:43:51.365 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T01:43:51.365 [Cloud] Queued cloud request. 2026-09-24T01:43:51.365 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T01:43:51.365 [Cloud] Dequeued cloud request. 2026-09-24T01:43:51.365 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T01:43:51.521 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{922ED917-EA5E-E17F-2D8F-CDA09646757B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 01:43:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T01:43:52.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T01:46:04.070 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T01:52:32.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T01:52:32.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T01:52:32.604 [Cloud] Queued cloud request. 2026-09-24T01:52:32.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T01:52:32.604 [Cloud] Dequeued cloud request. 2026-09-24T01:52:32.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T01:52:36.369 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2201F71E-CB65-AEBB-E672-4D8C227677B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 01:52:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T01:52:36.869 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T02:01:09.077 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T02:16:14.082 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T02:31:19.090 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T02:46:24.096 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T02:49:49.301 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T02:49:49.301 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T02:49:49.301 [Cloud] Queued cloud request. 2026-09-24T02:49:49.301 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T02:49:49.301 [Cloud] Dequeued cloud request. 2026-09-24T02:49:49.301 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T02:49:49.488 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0F87F7F7-5FEB-059C-98C8-6D2A3D231B3A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 02:49:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T02:49:49.988 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T02:55:05.988 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T02:55:05.988 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T02:55:05.988 [Cloud] Queued cloud request. 2026-09-24T02:55:05.988 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T02:55:05.988 [Cloud] Dequeued cloud request. 2026-09-24T02:55:05.988 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T02:55:06.176 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{384660A4-67EE-6131-F61F-F286B61E97CA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 02:55:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T02:55:06.691 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T03:01:29.102 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T03:07:07.056 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-24T03:07:07.056 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-24T03:07:07.056 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-24T03:07:07.056 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-24T03:07:07.056 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-24T03:07:07.072 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-24T03:07:07.125 [AutoPurge] Cleanup Routine tasks have started. 2026-09-24T03:07:07.150 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-24T03:07:07.150 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-24T03:07:07.150 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-24-2026 03:07:07 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-24-2026 03:07:07 2026-09-24T03:07:07.150 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-24T03:07:07.150 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-24T03:07:07.150 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-24T03:07:07.150 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-24T03:07:07.168 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-24T03:07:07.168 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-24T03:07:07.181 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-24T03:07:07.243 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-24T03:07:07.243 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-24T03:07:07.275 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-24T03:07:07.275 [AutoPurge] Removing expired default signature package ... 2026-09-24T03:07:07.493 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-24T03:07:07.525 Job Notification: New process added to job (4772) 2026-09-24T03:07:07.650 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-24T03:07:08.150 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:07:08.447 Job Notification: Process exited from job (4772) 2026-09-24T03:07:08.493 [AutoPurge] Verification Routine tasks have ended. 2026-09-24T03:07:08.759 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-24T03:07:08.868 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-24T03:07:09.322 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-24T03:07:09.400 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-24T03:07:09.556 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-24T03:07:11.181 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:11.540 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-24T03:07:11.650 Engine:Setting original file name "dual_engine_adapter.dll" for "c:\program files (x86)\microsoft\edgecore\153.0.4234.48\dual_engine_adapter_x64.dll", hr=0x0 2026-09-24T03:07:11.837 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-24T03:07:11.853 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:12.072 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-24T03:07:12.728 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-24T03:07:13.337 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-24T03:07:13.478 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-24T03:07:13.619 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-24T03:07:13.853 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:07:13.994 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-24T03:07:14.337 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-24T03:07:14.462 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-24T03:07:14.634 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:14.744 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:14.806 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:14.822 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-24T03:07:14.978 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:07:15.041 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-24T03:07:15.072 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-24T03:07:15.119 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-24T03:07:15.244 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-24T03:07:15.619 Engine:Setting original file name "mini_installer.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{56eb18f8-b008-4cbd-b6d2-8c97fe7e9062}\153.0.4234.48\microsoftedge_x64_153.0.4234.48_153.0.4234.32.exe", hr=0x0 2026-09-24T03:07:15.775 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:15.822 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-24T03:07:16.244 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:07:16.369 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-24T03:07:16.947 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-24T03:07:17.384 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:17.556 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:07:17.869 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-24T03:07:18.322 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-24T03:07:18.416 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-24T03:07:18.791 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.271.7\microsoftedgeupdatesetup_x86_1.3.271.7.exe", hr=0x0 2026-09-24T03:07:18.900 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-24T03:07:19.025 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:19.681 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:07:19.806 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-24T03:07:19.806 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-24T03:07:19.853 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-24T03:07:20.025 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-24T03:07:20.103 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-24T03:07:20.166 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:20.260 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-24T03:07:20.494 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-24T03:07:20.916 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-24T03:07:21.150 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-24T03:07:21.651 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-24T03:07:22.916 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-24T03:07:23.401 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-24T03:07:23.432 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-24T03:07:23.463 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-24T03:07:23.463 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-24T03:07:23.479 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-24T03:07:23.604 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-24T03:07:23.776 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-24T03:07:23.807 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:23.870 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-24T03:07:24.291 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-24T03:07:24.338 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-24T03:07:24.354 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-24T03:07:24.401 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-24T03:07:24.885 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:25.057 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:25.088 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-24T03:07:25.151 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-24T03:07:25.167 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:25.604 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-24T03:07:25.932 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-24T03:07:25.948 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:26.667 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-24T03:07:26.682 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-24T03:07:27.292 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:07:27.620 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-24T03:07:28.057 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-24T03:07:28.229 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:28.417 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:28.573 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-24T03:07:28.792 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-24T03:07:28.870 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-24T03:07:28.948 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:29.433 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-24T03:07:29.808 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-24T03:07:29.839 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-24T03:07:29.901 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:07:30.198 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:07:30.417 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-24T03:07:30.542 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-24T03:07:30.667 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-24T03:07:30.698 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-24T03:07:30.776 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-24T03:07:31.339 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-24T03:07:31.777 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-24T03:07:31.902 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-24T03:07:31.995 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-24T03:07:32.573 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-24T03:07:32.620 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:32.933 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-24T03:07:33.027 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-24T03:07:33.042 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-24T03:07:33.073 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-24T03:07:33.198 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-24T03:07:33.245 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-24T03:07:33.292 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-24T03:07:33.620 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-24T03:07:33.636 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-24T03:07:33.980 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-24T03:07:34.152 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:34.261 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-24T03:07:34.277 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-24T03:07:34.542 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:07:34.777 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-24T03:07:35.183 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:07:35.511 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-24T03:07:35.683 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-24T03:07:36.027 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-24T03:07:36.042 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:36.246 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-24T03:07:36.355 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-24T03:07:36.855 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-24T03:07:36.902 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-24T03:07:37.058 Engine:Setting original file name "notification_helper.exe" for "c:\program files (x86)\microsoft\edge\application\153.0.4234.48\notification_click_helper.exe", hr=0x0 2026-09-24T03:07:37.152 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:37.152 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-24T03:07:37.386 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-24T03:07:37.449 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-24T03:07:37.652 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:07:38.167 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:07:38.293 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-24T03:07:38.355 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-24T03:07:39.011 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-24T03:07:39.011 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-24T03:07:39.246 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-24T03:07:39.418 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-24T03:07:39.714 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-24T03:07:40.402 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:07:40.636 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-24T03:07:41.074 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-24T03:07:41.386 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-24T03:07:41.527 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-24T03:07:41.558 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:41.574 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-24T03:07:41.668 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-24T03:07:41.902 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-24T03:07:42.277 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-24T03:07:42.355 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-24T03:07:42.621 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-24T03:07:42.871 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-24T03:07:42.918 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-24T03:07:43.215 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:07:43.418 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-24T03:07:43.590 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-24T03:07:44.386 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:07:44.465 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-24T03:07:44.527 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-24T03:07:44.590 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-24T03:07:45.590 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-24T03:07:45.652 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-24T03:07:45.762 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-24T03:07:45.918 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-24T03:07:46.121 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-24T03:07:46.293 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-24T03:07:46.965 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-24T03:07:46.996 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-24T03:07:47.027 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-24T03:07:47.090 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-24T03:07:47.183 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-24T03:07:47.496 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-24T03:07:47.637 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-24T03:07:47.652 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-24T03:07:47.683 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-24T03:07:47.762 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:47.793 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-24T03:07:47.840 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-24T03:07:48.199 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-24T03:07:48.340 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-24T03:07:48.621 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-24T03:07:48.746 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:48.965 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-24T03:07:49.340 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-24T03:07:49.418 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-24T03:07:49.637 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-24T03:07:49.902 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-24T03:07:49.949 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-24T03:07:50.027 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:07:50.199 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:07:50.402 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-24T03:07:50.465 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-24T03:07:50.637 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:07:50.793 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-24T03:07:50.871 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:07:51.137 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:07:51.168 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-24T03:07:51.215 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-24T03:07:51.402 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-24T03:07:51.434 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-24T03:07:51.434 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-24T03:07:51.840 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-24T03:07:51.918 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:51.949 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-24T03:07:52.027 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:07:52.199 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:07:52.324 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-24T03:07:52.449 Engine:Setting original file name "CopilotUpdate.exe" for "c:\windows\systemtemp\copilotupdate.exe.old{9c304e8d-10bc-445a-8771-81a12ae6dd9b}", hr=0x0 2026-09-24T03:07:52.887 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-24T03:07:53.012 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-24T03:07:53.059 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-24T03:07:53.215 Engine:Setting original file name "Vulkan Runtime" for "c:\program files (x86)\microsoft\edgecore\153.0.4234.48\vulkan-1.dll", hr=0x0 2026-09-24T03:07:53.355 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-24T03:07:53.387 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-24T03:07:53.434 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-24T03:07:53.777 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-24T03:07:53.824 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-24T03:07:54.137 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-24T03:07:54.199 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-24T03:07:54.262 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-24T03:07:54.262 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:54.277 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:54.324 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:07:54.324 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-24T03:07:54.340 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:54.949 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-24T03:07:55.262 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-24T03:07:55.512 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:07:55.605 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-24T03:07:55.855 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:55.871 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:07:55.980 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-24T03:07:56.277 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:56.309 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-24T03:07:56.481 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-24T03:07:56.496 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-24T03:07:56.606 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-24T03:07:56.668 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-24T03:07:56.668 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-24T03:07:56.934 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-24T03:07:56.965 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-24T03:07:56.965 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-24T03:07:57.106 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-24T03:07:57.293 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:57.496 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-24T03:07:57.824 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\systemapps\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-24T03:07:57.949 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-24T03:07:58.074 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-24T03:07:58.262 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-24T03:07:58.418 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-24T03:07:58.434 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-24T03:07:58.449 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:07:58.699 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-24T03:07:58.715 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-24T03:07:58.918 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-24T03:07:59.043 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-24T03:07:59.059 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-24T03:07:59.777 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:07:59.777 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-24T03:07:59.871 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-24T03:07:59.981 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:07:59.996 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:08:00.856 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:08:01.262 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-24T03:08:01.449 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:01.465 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-24T03:08:01.668 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:01.699 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-24T03:08:01.824 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-24T03:08:01.949 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-24T03:08:02.012 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-24T03:08:02.340 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-24T03:08:02.387 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:08:02.699 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:08:02.715 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:02.793 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-24T03:08:03.418 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-24T03:08:03.949 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-24T03:08:03.981 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:04.043 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-24T03:08:04.152 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:08:04.340 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:04.418 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-24T03:08:04.746 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-24T03:08:05.277 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:05.293 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-24T03:08:05.543 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:08:05.684 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-24T03:08:05.887 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-24T03:08:05.902 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:06.184 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-24T03:08:06.574 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-24T03:08:06.606 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:06.715 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:06.840 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-24T03:08:06.871 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-24T03:08:07.246 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-24T03:08:07.356 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:07.543 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-24T03:08:07.574 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-24T03:08:07.590 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:07.637 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:08:07.840 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-24T03:08:07.903 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:08:08.371 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-24T03:08:08.465 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-24T03:08:09.012 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-24T03:08:09.059 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-24T03:08:09.137 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-24T03:08:09.231 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-24T03:08:09.278 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:08:09.309 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-24T03:08:09.371 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-24T03:08:09.856 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-24T03:08:10.028 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-24T03:08:10.309 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-24T03:08:10.309 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-24T03:08:10.653 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-24T03:08:10.653 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:10.996 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-24T03:08:11.356 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-24T03:08:11.637 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-24T03:08:11.731 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-24T03:08:11.793 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-24T03:08:11.871 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:08:12.090 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-24T03:08:12.153 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-24T03:08:12.199 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-24T03:08:12.293 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-24T03:08:12.653 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-24T03:08:12.699 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:08:12.809 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:08:13.153 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-24T03:08:13.246 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:08:13.434 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-24T03:08:13.668 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-24T03:08:13.949 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-24T03:08:13.949 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:14.356 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-24T03:08:14.356 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-24T03:08:14.403 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-24T03:08:14.699 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-24T03:08:14.981 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-24T03:08:14.996 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-24T03:08:15.324 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-24T03:08:15.418 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-24T03:08:15.543 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-24T03:08:15.637 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:08:15.653 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-24T03:08:15.809 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-24T03:08:16.012 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-24T03:08:16.184 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-24T03:08:16.278 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-24T03:08:16.434 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-24T03:08:17.840 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-24T03:08:18.262 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-24T03:08:18.434 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-24T03:08:18.684 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:08:18.934 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-24T03:08:19.168 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-24T03:08:19.449 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-24T03:08:19.715 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-24T03:08:19.824 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-24T03:08:19.856 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-24T03:08:19.871 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-24T03:08:20.012 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-24T03:08:20.293 Engine:Setting original file name " " for "c:\program files (x86)\microsoft\edgecore\153.0.4234.48\dxcompiler.dll", hr=0x0 2026-09-24T03:08:20.512 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-24T03:08:20.543 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:20.543 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-24T03:08:20.621 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-24T03:08:20.653 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-24T03:08:20.762 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-24T03:08:21.153 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-24T03:08:21.231 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-24T03:08:21.434 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-24T03:08:21.449 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:21.559 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-24T03:08:21.574 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-24T03:08:21.793 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-24T03:08:21.840 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:08:22.106 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-24T03:08:22.434 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-24T03:08:22.903 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:08:23.403 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-24T03:08:23.481 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-24T03:08:23.949 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-24T03:08:24.340 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:08:24.449 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:24.731 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-24T03:08:24.996 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-24T03:08:25.074 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-24T03:08:25.231 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-24T03:08:25.387 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-24T03:08:25.840 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-24T03:08:26.637 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-24T03:08:26.731 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-24T03:08:26.825 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-24T03:08:27.434 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-24T03:08:27.731 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-24T03:08:28.028 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-24T03:08:28.090 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-24T03:08:28.184 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-24T03:08:28.199 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-24T03:08:28.699 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-24T03:08:28.824 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-24T03:08:28.840 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:28.871 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-24T03:08:29.153 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-24T03:08:29.168 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:08:29.387 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-24T03:08:29.606 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-24T03:08:29.965 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-24T03:08:30.512 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-24T03:08:30.606 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:08:30.809 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:31.012 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-24T03:08:31.371 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:31.449 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-24T03:08:31.637 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-24T03:08:31.809 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-24T03:08:31.949 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:32.074 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-24T03:08:32.324 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-24T03:08:32.668 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-24T03:08:32.715 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-24T03:08:32.746 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-24T03:08:32.903 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:32.934 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-24T03:08:33.324 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-24T03:08:33.481 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-24T03:08:33.621 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:34.559 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-24T03:08:35.121 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-24T03:08:35.231 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-24T03:08:35.278 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-24T03:08:35.324 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-24T03:08:35.637 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:35.699 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-24T03:08:35.903 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-24T03:08:35.996 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-24T03:08:36.074 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-24T03:08:36.153 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:36.231 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-24T03:08:36.465 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-24T03:08:36.543 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-24T03:08:36.918 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-24T03:08:36.981 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-24T03:08:37.059 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-24T03:08:37.074 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-24T03:08:37.090 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-24T03:08:37.106 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-24T03:08:37.231 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-24T03:08:37.246 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:08:37.262 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-24T03:08:37.309 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-24T03:08:37.684 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-24T03:08:37.715 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-24T03:08:38.074 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:08:38.137 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-24T03:08:38.168 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-24T03:08:38.184 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-24T03:08:39.074 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-24T03:08:39.215 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:08:39.403 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:08:39.403 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-24T03:08:39.668 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-24T03:08:39.887 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-24T03:08:40.028 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-24T03:08:40.106 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:40.809 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-24T03:08:40.840 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-24T03:08:40.981 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-24T03:08:40.996 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-24T03:08:41.012 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:08:41.496 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:08:41.512 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-24T03:08:41.637 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-24T03:08:41.653 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-24T03:08:41.809 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-24T03:08:42.215 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-24T03:08:42.590 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-24T03:08:42.856 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:43.246 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-24T03:08:43.465 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-24T03:08:43.512 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-24T03:08:43.668 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-24T03:08:43.684 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-24T03:08:43.778 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-24T03:08:43.871 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-24T03:08:43.949 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-24T03:08:43.949 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:08:44.199 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-24T03:08:44.262 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-24T03:08:44.559 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-24T03:08:44.668 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-24T03:08:44.824 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-24T03:08:44.856 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:08:44.996 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\de-de\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:45.137 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-console-l1-1-0.dll", hr=0x0 2026-09-24T03:08:45.293 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0 2026-09-24T03:08:45.309 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-registry-l2-1-0.dll", hr=0x0 2026-09-24T03:08:45.590 Engine:Setting original file name "MrmCore.dll" for "c:\windows\winsxs\wow64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.20348.5020_none_9e6a80bbc86408d7\mrmcorer.dll", hr=0x0 2026-09-24T03:08:45.606 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:45.809 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_en-gb_56416fd74780e848\vsswmi.dll.mui", hr=0x0 2026-09-24T03:08:45.824 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\es-es\aerolite.msstyles.mui", hr=0x0 2026-09-24T03:08:45.981 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_7573f1c6d4639f87\penimc.dll", hr=0x0 2026-09-24T03:08:46.012 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.data.winmd", hr=0x0 2026-09-24T03:08:46.168 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\de-de\ndisimplatcim.dll.mui", hr=0x0 2026-09-24T03:08:46.246 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_4e347e352039867c\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:46.356 Engine:Setting original file name "winsqlite3" for "c:\windows\winsxs\wow64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.20348.4647_none_c9096b99901f19cd\winsqlite3.dll", hr=0x0 2026-09-24T03:08:46.403 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0 2026-09-24T03:08:46.403 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000c.dll", hr=0x0 2026-09-24T03:08:46.903 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-1-0.dll", hr=0x0 2026-09-24T03:08:46.903 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata000a.dll", hr=0x0 2026-09-24T03:08:47.184 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-2-0.dll", hr=0x0 2026-09-24T03:08:47.278 Engine:Setting original file name "wmic.exe" for "c:\windows\winsxs\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.20348.2849_none_54405a5933961199\wmic.exe", hr=0x0 2026-09-24T03:08:47.465 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.storage.winmd", hr=0x0 2026-09-24T03:08:47.809 Engine:Setting original file name "CRYPT32.DLL" for "c:\windows\systemresources\crypt32.dll.mun", hr=0x0 2026-09-24T03:08:48.074 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_7d8ffbc5cb37c8e0\bootmgr.exe.mui", hr=0x0 2026-09-24T03:08:48.137 Engine:Setting original file name "mstsc.exe" for "c:\windows\systemresources\mstsc.exe.mun", hr=0x0 2026-09-24T03:08:48.356 Engine:Setting original file name "SYSTEMCPL.DLL" for "c:\windows\systemresources\systemcpl.dll.mun", hr=0x0 2026-09-24T03:08:48.403 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0 2026-09-24T03:08:48.574 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1e6e07718388e886\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:48.637 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0 2026-09-24T03:08:49.309 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0 2026-09-24T03:08:49.309 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mpg4decd_31bf3856ad364e35_10.0.20348.2849_none_08e768f194682e23\mpg4decd.dll", hr=0x0 2026-09-24T03:08:49.324 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0 2026-09-24T03:08:49.356 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0 2026-09-24T03:08:49.559 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-1.dll", hr=0x0 2026-09-24T03:08:49.559 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\naturallanguage6.dll", hr=0x0 2026-09-24T03:08:50.012 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0 2026-09-24T03:08:50.278 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0 2026-09-24T03:08:50.543 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ja-jp_5634cc97d85965d9\bootmgr_ex.efi.mui", hr=0x0 2026-09-24T03:08:50.543 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0 2026-09-24T03:08:50.762 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_d7c56d20c9fb1c22\diagpackage.dll.mui", hr=0x0 2026-09-24T03:08:50.762 OriginalFileName Maintenance::28410 files in Moac, 0 skipped (cached), 542 filename set 2026-09-24T03:08:50.762 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-24T03:16:34.108 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T03:17:30.500 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T03:17:30.500 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T03:17:30.500 [Cloud] Queued cloud request. 2026-09-24T03:17:30.500 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T03:17:30.500 [Cloud] Dequeued cloud request. 2026-09-24T03:17:30.500 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T03:17:30.687 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BEA6E279-801C-2CB4-24C7-9ADBA27A621F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 03:17:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T03:17:31.188 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-24T03:17:31.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T03:17:31.219 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-24T03:17:31.219 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-24T03:17:31.219 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-24T03:17:31.219 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-24T03:17:31.219 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-24T03:17:31.219 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-24T03:17:31.219 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-24T03:17:31.219 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-24T03:17:31.219 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-24T03:17:31.219 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-24T03:17:31.219 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-24T03:17:31.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T03:17:31.219 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-24T03:17:31.219 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-24T03:17:31.219 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-24T03:17:31.219 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-24T03:17:31.219 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-24T03:17:31.219 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-24T03:17:31.219 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-24T03:17:31.219 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-24T03:17:31.219 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-24T03:17:31.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T03:17:31.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T03:17:31.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T03:17:33.797 [RTP] Duplicating the current plugin configuration object... 2026-09-24T03:17:33.797 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-24T03:17:33.797 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-24T03:17:33.797 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-24T03:17:33.797 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-24T03:17:33.797 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-24T03:19:47.907 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T03:19:47.907 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T03:19:47.907 [Cloud] Queued cloud request. 2026-09-24T03:19:47.907 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T03:19:47.907 [Cloud] Dequeued cloud request. 2026-09-24T03:19:47.907 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T03:19:48.079 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8B5FB53D-F9B0-04C2-2FF3-08AA98ED0A82} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 03:19:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T03:19:48.579 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T03:22:56.876 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T03:22:56.876 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T03:22:56.876 [Cloud] Queued cloud request. 2026-09-24T03:22:56.876 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T03:22:56.876 [Cloud] Dequeued cloud request. 2026-09-24T03:22:56.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T03:22:58.189 [Cloud] End of cloud request. 2026-09-24T03:22:58.689 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T03:31:39.115 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T03:39:48.494 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 11784, Count: 788, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-24T03:39:48.494 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 6755, Count: 558, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-24T03:39:48.494 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2588, Count: 220, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-24T03:39:48.494 ProcessImageName: powershell.exe, Pid: 6100, TotalTime: 1604, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-24T03:39:48.494 ProcessImageName: AgentShellService.exe, Pid: 3188, TotalTime: 865, Count: 31, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-24T03:39:48.494 ProcessImageName: WmiPrvSE.exe, Pid: 5664, TotalTime: 631, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 11% 2026-09-24T03:39:48.494 ProcessImageName: WmiPrvSE.exe, Pid: 5796, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 40% 2026-09-24T03:39:48.494 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 286, Count: 23, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-24T03:39:48.494 ProcessImageName: WmiPrvSE.exe, Pid: 6984, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-24T03:39:48.494 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 120, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-24T03:39:48.494 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 109, Count: 2, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-24T03:39:48.494 ProcessImageName: python.exe, Pid: 8072, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-24T03:39:48.494 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20be0-0.MAI, EstimatedImpact: 0% 2026-09-24T03:39:48.494 ProcessImageName: powershell.exe, Pid: 6636, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB2D5.tmp, EstimatedImpact: 0% 2026-09-24T03:39:48.494 ProcessImageName: mysqldump.exe, Pid: 6776, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 19% 2026-09-24T03:39:48.494 ProcessImageName: taskhostw.exe, Pid: 1608, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 21% 2026-09-24T03:39:48.494 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-24T03:39:48.494 ProcessImageName: taskhostw.exe, Pid: 1724, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 4% 2026-09-24T03:39:48.494 ProcessImageName: DeviceCensus.exe, Pid: 7464, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 3% 2026-09-24T03:39:48.494 ProcessImageName: cmd.exe, Pid: 5084, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-24T03:39:48.494 ProcessImageName: ngentask.exe, Pid: 7548, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-24T03:40:15.744 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T03:40:15.744 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T03:40:15.744 [Cloud] Queued cloud request. 2026-09-24T03:40:15.744 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T03:40:15.744 [Cloud] Dequeued cloud request. 2026-09-24T03:40:15.744 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T03:40:15.932 [Cloud] End of cloud request. 2026-09-24T03:40:16.447 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T03:46:44.121 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T03:47:44.341 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T03:47:44.341 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T03:47:44.341 [Cloud] Queued cloud request. 2026-09-24T03:47:44.341 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T03:47:44.341 [Cloud] Dequeued cloud request. 2026-09-24T03:47:44.341 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T03:47:44.529 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{100AA71F-88A3-4518-890F-689C384B4E76} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 03:47:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T03:47:45.044 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T03:53:10.374 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T03:53:10.374 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T03:53:10.374 [Cloud] Queued cloud request. 2026-09-24T03:53:10.374 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T03:53:10.374 [Cloud] Dequeued cloud request. 2026-09-24T03:53:10.374 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T03:53:10.561 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B41A6625-4EA9-B86D-BE6B-3DAC56AE6E26} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 03:53:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T03:53:11.077 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T04:00:31.393 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T04:00:31.393 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T04:00:31.393 [Cloud] Queued cloud request. 2026-09-24T04:00:31.393 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T04:00:31.393 [Cloud] Dequeued cloud request. 2026-09-24T04:00:31.393 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T04:00:31.580 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E34C3813-8658-8B05-04DC-D59F9AF3FA92} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 04:00:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T04:00:32.080 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T04:01:49.127 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T04:10:26.616 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T04:10:26.616 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T04:10:26.616 [Cloud] Queued cloud request. 2026-09-24T04:10:26.616 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T04:10:26.616 [Cloud] Dequeued cloud request. 2026-09-24T04:10:26.616 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T04:10:26.757 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7878B149-416A-D2CD-201F-FFB23A819F45} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 04:10:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T04:10:27.257 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T04:16:54.132 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T04:23:20.293 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T04:23:20.293 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T04:23:20.293 [Cloud] Queued cloud request. 2026-09-24T04:23:20.293 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T04:23:20.293 [Cloud] Dequeued cloud request. 2026-09-24T04:23:20.293 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T04:23:22.840 [Cloud] End of cloud request. 2026-09-24T04:23:23.340 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T04:26:05.059 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T04:26:05.059 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T04:26:05.059 [Cloud] Queued cloud request. 2026-09-24T04:26:05.059 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T04:26:05.059 [Cloud] Dequeued cloud request. 2026-09-24T04:26:05.059 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T04:26:05.199 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D79CF20C-CB1E-BEEC-2933-3B88EBE4C623} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 04:26:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T04:26:05.715 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T04:27:37.763 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T04:27:37.763 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T04:27:37.763 [Cloud] Queued cloud request. 2026-09-24T04:27:37.763 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T04:27:37.763 [Cloud] Dequeued cloud request. 2026-09-24T04:27:37.763 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T04:27:37.904 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E0D4FDBE-3F51-EC54-297F-4F08E487C2DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 04:27:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T04:27:38.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T04:28:02.326 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T04:28:02.326 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T04:28:02.326 [Cloud] Queued cloud request. 2026-09-24T04:28:02.326 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T04:28:02.326 [Cloud] Dequeued cloud request. 2026-09-24T04:28:02.326 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T04:28:02.405 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7783C8C3-32FD-BADA-CFF0-251E3D744C0E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 04:28:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T04:28:02.920 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T04:31:59.140 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T04:32:49.671 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T04:32:49.671 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T04:32:49.671 [Cloud] Queued cloud request. 2026-09-24T04:32:49.671 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T04:32:49.906 [Cloud] Dequeued cloud request. 2026-09-24T04:32:49.906 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T04:32:50.062 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0D09DA84-B0AF-BB50-F1F1-EB0C09C79BC7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 04:32:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T04:32:50.562 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T04:43:46.942 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T04:43:46.942 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T04:43:46.942 [Cloud] Queued cloud request. 2026-09-24T04:43:46.942 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T04:43:46.942 [Cloud] Dequeued cloud request. 2026-09-24T04:43:46.942 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T04:43:47.082 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{62FB8239-D7C9-317C-DFD7-D8A83118C6C8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 04:43:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T04:43:47.582 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T04:47:04.145 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T04:52:58.257 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T04:52:58.257 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T04:52:58.257 [Cloud] Queued cloud request. 2026-09-24T04:52:58.257 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T04:52:58.257 [Cloud] Dequeued cloud request. 2026-09-24T04:52:58.257 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T04:52:58.445 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B36F4EC2-35A7-1E73-885E-A7491581CBCE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 04:52:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T04:52:58.945 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T05:02:09.153 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T05:04:25.091 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T05:04:25.091 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T05:04:25.091 [Cloud] Queued cloud request. 2026-09-24T05:04:25.091 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T05:04:25.091 [Cloud] Dequeued cloud request. 2026-09-24T05:04:25.091 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T05:04:25.263 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{82DA5C47-B239-A870-D230-A2B9E1A16EB0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 05:04:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T05:04:25.778 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T05:05:20.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T05:05:20.700 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T05:05:20.700 [Cloud] Queued cloud request. 2026-09-24T05:05:20.700 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T05:05:20.700 [Cloud] Dequeued cloud request. 2026-09-24T05:05:20.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T05:05:21.091 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{649A3A71-9D8E-4356-AE0B-9C53E6112843} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 05:05:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T05:05:21.606 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T05:07:09.106 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T05:07:09.106 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T05:07:09.106 [Cloud] Queued cloud request. 2026-09-24T05:07:09.106 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T05:07:09.106 [Cloud] Dequeued cloud request. 2026-09-24T05:07:09.106 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T05:07:09.309 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{61F3C63F-2260-C2D3-1588-771ABA794BB1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 05:07:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T05:07:09.825 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T05:08:40.750 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T05:08:40.750 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T05:08:40.750 [Cloud] Queued cloud request. 2026-09-24T05:08:40.750 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T05:08:40.750 [Cloud] Dequeued cloud request. 2026-09-24T05:08:40.750 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T05:08:40.921 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{48818925-C163-9D05-0240-A116C5E52E52} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 05:08:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T05:08:41.421 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T05:17:14.157 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T05:20:43.521 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T05:20:43.521 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T05:20:43.521 [Cloud] Queued cloud request. 2026-09-24T05:20:43.521 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T05:20:43.521 [Cloud] Dequeued cloud request. 2026-09-24T05:20:43.521 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T05:20:43.708 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0DD3DD57-9526-2B9B-942D-E660C2B1527E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 05:20:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T05:20:44.224 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T05:25:20.036 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T05:25:20.036 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T05:25:20.036 [Cloud] Queued cloud request. 2026-09-24T05:25:20.036 [Cloud] Dequeued cloud request. 2026-09-24T05:25:20.036 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T05:25:20.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T05:25:20.224 [Cloud] End of cloud request. 2026-09-24T05:25:20.724 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T05:32:19.165 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T05:39:48.560 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 13215, Count: 921, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-24T05:39:48.560 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 8893, Count: 737, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-24T05:39:48.560 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2588, Count: 220, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-24T05:39:48.560 ProcessImageName: powershell.exe, Pid: 6100, TotalTime: 1604, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-24T05:39:48.560 ProcessImageName: AgentShellService.exe, Pid: 3188, TotalTime: 865, Count: 31, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-24T05:39:48.560 ProcessImageName: php.exe, Pid: 4540, TotalTime: 849, Count: 20, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 28% 2026-09-24T05:39:48.560 ProcessImageName: WmiPrvSE.exe, Pid: 5664, TotalTime: 631, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 11% 2026-09-24T05:39:48.560 ProcessImageName: WmiPrvSE.exe, Pid: 5796, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 40% 2026-09-24T05:39:48.560 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 361, Count: 29, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-24T05:39:48.560 ProcessImageName: WmiPrvSE.exe, Pid: 6984, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-24T05:39:48.560 ProcessImageName: cmd.exe, Pid: 4956, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 64% 2026-09-24T05:39:48.560 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-24T05:39:48.560 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 109, Count: 2, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-24T05:39:48.560 ProcessImageName: python.exe, Pid: 8072, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-24T05:39:48.560 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 90, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-24T05:39:48.560 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20be0-0.MAI, EstimatedImpact: 0% 2026-09-24T05:39:48.560 ProcessImageName: powershell.exe, Pid: 6636, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB2D5.tmp, EstimatedImpact: 0% 2026-09-24T05:39:48.560 ProcessImageName: mysqldump.exe, Pid: 6776, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 19% 2026-09-24T05:39:48.560 ProcessImageName: taskhostw.exe, Pid: 1608, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 21% 2026-09-24T05:39:48.560 ProcessImageName: taskhostw.exe, Pid: 1724, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 4% 2026-09-24T05:39:48.560 ProcessImageName: DeviceCensus.exe, Pid: 7464, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 3% 2026-09-24T05:39:48.560 ProcessImageName: cmd.exe, Pid: 5084, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-24T05:39:48.560 ProcessImageName: ngentask.exe, Pid: 7548, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-24T05:39:48.560 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-24T05:46:27.218 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T05:46:27.218 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T05:46:27.218 [Cloud] Queued cloud request. 2026-09-24T05:46:27.218 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T05:46:27.218 [Cloud] Dequeued cloud request. 2026-09-24T05:46:27.218 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T05:46:27.437 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{251BF191-96C1-9DAC-97D7-741453B0516C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 05:46:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T05:46:27.937 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T05:47:24.172 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T05:58:40.646 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T05:58:40.646 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T05:58:40.646 [Cloud] Queued cloud request. 2026-09-24T05:58:40.646 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T05:58:40.646 [Cloud] Dequeued cloud request. 2026-09-24T05:58:40.646 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T05:58:40.802 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C3CF88A6-1EFB-12C0-07B1-5A6E6E0B22E3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 05:58:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T05:58:41.318 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:02:29.178 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T06:04:10.490 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:04:10.490 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:04:10.490 [Cloud] Queued cloud request. 2026-09-24T06:04:10.490 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:04:10.490 [Cloud] Dequeued cloud request. 2026-09-24T06:04:10.490 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:04:10.662 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ABB0A8B0-5C91-391F-495E-ECC591B18CB9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 06:04:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T06:04:11.162 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:04:51.990 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:04:51.990 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:04:51.990 [Cloud] Queued cloud request. 2026-09-24T06:04:51.990 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:04:51.990 [Cloud] Dequeued cloud request. 2026-09-24T06:04:51.990 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:04:52.084 [Cloud] End of cloud request. 2026-09-24T06:04:52.584 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:10:13.416 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:10:13.416 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:10:13.416 [Cloud] Queued cloud request. 2026-09-24T06:10:13.416 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:10:13.416 [Cloud] Dequeued cloud request. 2026-09-24T06:10:13.416 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:10:13.573 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4160756B-081F-05A6-E50C-204215460E0B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 06:10:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T06:10:14.073 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:15:49.731 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:15:49.731 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:15:49.731 [Cloud] Queued cloud request. 2026-09-24T06:15:49.731 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:15:49.731 [Cloud] Dequeued cloud request. 2026-09-24T06:15:49.731 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:15:49.903 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B115D00E-FF75-356E-1961-AE249724E478} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 06:15:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T06:15:50.403 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:16:45.622 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:16:45.622 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:16:45.622 [Cloud] Queued cloud request. 2026-09-24T06:16:45.622 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:16:45.622 [Cloud] Dequeued cloud request. 2026-09-24T06:16:45.622 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:16:45.700 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0179DF97-3C80-725C-376A-EB7F2592C7BC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 06:16:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T06:16:46.200 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:17:34.185 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T06:17:56.467 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:17:56.467 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:17:56.467 [Cloud] Queued cloud request. 2026-09-24T06:17:56.467 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:17:56.467 [Cloud] Dequeued cloud request. 2026-09-24T06:17:56.467 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:17:56.623 [Cloud] End of cloud request. 2026-09-24T06:17:57.139 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:20:56.889 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:20:56.889 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:20:56.889 [Cloud] Queued cloud request. 2026-09-24T06:20:56.889 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:20:56.889 [Cloud] Dequeued cloud request. 2026-09-24T06:20:56.889 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:20:57.077 [Cloud] End of cloud request. 2026-09-24T06:20:57.592 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:27:44.143 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:27:44.143 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:27:44.143 [Cloud] Queued cloud request. 2026-09-24T06:27:44.143 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:27:44.143 [Cloud] Dequeued cloud request. 2026-09-24T06:27:44.143 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:27:44.377 [Cloud] End of cloud request. 2026-09-24T06:27:44.893 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:32:19.191 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:32:19.191 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:32:19.191 [Cloud] Queued cloud request. 2026-09-24T06:32:19.191 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:32:19.191 [Cloud] Dequeued cloud request. 2026-09-24T06:32:19.191 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:32:19.566 [Cloud] End of cloud request. 2026-09-24T06:32:20.081 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:32:39.191 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T06:35:57.754 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:35:57.754 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:35:57.754 [Cloud] Queued cloud request. 2026-09-24T06:35:57.754 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:35:57.754 [Cloud] Dequeued cloud request. 2026-09-24T06:35:57.754 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:35:58.004 [Cloud] End of cloud request. 2026-09-24T06:35:58.504 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:46:53.385 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:46:53.385 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:46:53.385 [Cloud] Queued cloud request. 2026-09-24T06:46:53.385 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:46:53.385 [Cloud] Dequeued cloud request. 2026-09-24T06:46:53.385 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:46:53.650 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{680F5B64-962F-594A-2982-4899E992E419} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 06:46:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T06:46:54.166 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:47:44.198 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T06:48:30.276 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:48:30.276 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:48:30.276 [Cloud] Queued cloud request. 2026-09-24T06:48:30.276 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:48:30.276 [Cloud] Dequeued cloud request. 2026-09-24T06:48:30.276 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:48:30.417 [Cloud] End of cloud request. 2026-09-24T06:48:30.917 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:48:46.198 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:48:46.198 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:48:46.198 [Cloud] Queued cloud request. 2026-09-24T06:48:46.198 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:48:46.198 [Cloud] Dequeued cloud request. 2026-09-24T06:48:46.198 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:48:46.464 [Cloud] End of cloud request. 2026-09-24T06:48:46.964 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:51:46.808 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:51:46.808 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:51:46.808 [Cloud] Queued cloud request. 2026-09-24T06:51:46.808 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:51:46.808 [Cloud] Dequeued cloud request. 2026-09-24T06:51:46.808 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:51:46.964 [Cloud] End of cloud request. 2026-09-24T06:51:47.480 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:56:15.060 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:56:15.060 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:56:15.060 [Cloud] Queued cloud request. 2026-09-24T06:56:15.060 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:56:15.060 [Cloud] Dequeued cloud request. 2026-09-24T06:56:15.060 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:56:15.216 [Cloud] End of cloud request. 2026-09-24T06:56:15.716 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T06:56:45.248 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T06:56:45.248 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T06:56:45.248 [Cloud] Queued cloud request. 2026-09-24T06:56:45.248 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T06:56:45.248 [Cloud] Dequeued cloud request. 2026-09-24T06:56:45.248 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T06:56:45.341 [Cloud] End of cloud request. 2026-09-24T06:56:45.841 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T07:02:49.204 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T07:07:14.361 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T07:07:14.361 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T07:07:14.361 [Cloud] Queued cloud request. 2026-09-24T07:07:14.361 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T07:07:14.361 [Cloud] Dequeued cloud request. 2026-09-24T07:07:14.361 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T07:07:15.173 [Cloud] End of cloud request. 2026-09-24T07:07:15.689 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T07:07:54.472 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T07:07:54.472 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T07:07:54.472 [Cloud] Queued cloud request. 2026-09-24T07:07:54.472 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T07:07:54.472 [Cloud] Dequeued cloud request. 2026-09-24T07:07:54.472 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T07:07:55.035 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{24A40464-DC4D-C63E-B3C2-0F09AAFEEF40} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 07:07:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T07:07:55.535 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T07:09:28.551 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T07:09:28.551 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T07:09:28.551 [Cloud] Queued cloud request. 2026-09-24T07:09:28.551 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T07:09:28.551 [Cloud] Dequeued cloud request. 2026-09-24T07:09:28.551 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T07:09:28.988 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1AF25A41-4487-F50A-FC9A-C57D6CA748E6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 07:09:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T07:09:29.488 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T07:17:16.382 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T07:17:16.382 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T07:17:16.382 [Cloud] Queued cloud request. 2026-09-24T07:17:16.382 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T07:17:16.382 [Cloud] Dequeued cloud request. 2026-09-24T07:17:16.382 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T07:17:17.054 [Cloud] End of cloud request. 2026-09-24T07:17:17.554 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T07:17:54.211 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T07:32:59.216 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T07:35:41.716 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T07:35:41.716 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T07:35:41.716 [Cloud] Queued cloud request. 2026-09-24T07:35:41.716 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T07:35:41.716 [Cloud] Dequeued cloud request. 2026-09-24T07:35:41.716 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T07:35:41.919 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4124D163-0967-68A2-81FC-01184A18870A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 07:35:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T07:35:42.419 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T07:35:53.279 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T07:35:53.279 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T07:35:53.279 [Cloud] Queued cloud request. 2026-09-24T07:35:53.279 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T07:35:53.279 [Cloud] Dequeued cloud request. 2026-09-24T07:35:53.279 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T07:35:53.373 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A2018074-33CC-7B12-7240-5937A11753D3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 07:35:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T07:35:53.889 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T07:39:48.627 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 14238, Count: 976, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-24T07:39:48.627 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 11014, Count: 916, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-24T07:39:48.627 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2588, Count: 220, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-24T07:39:48.627 ProcessImageName: powershell.exe, Pid: 6100, TotalTime: 1604, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-24T07:39:48.627 ProcessImageName: AgentShellService.exe, Pid: 3188, TotalTime: 865, Count: 31, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-24T07:39:48.627 ProcessImageName: php.exe, Pid: 4540, TotalTime: 849, Count: 20, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 28% 2026-09-24T07:39:48.627 ProcessImageName: WmiPrvSE.exe, Pid: 5664, TotalTime: 631, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 11% 2026-09-24T07:39:48.627 ProcessImageName: WmiPrvSE.exe, Pid: 5796, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 40% 2026-09-24T07:39:48.627 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 407, Count: 33, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-24T07:39:48.627 ProcessImageName: powershell.exe, Pid: 7992, TotalTime: 277, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-24T07:39:48.627 ProcessImageName: WmiPrvSE.exe, Pid: 6984, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-24T07:39:48.627 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 150, Count: 11, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-24T07:39:48.627 ProcessImageName: cmd.exe, Pid: 4956, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 64% 2026-09-24T07:39:48.627 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 109, Count: 2, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-24T07:39:48.627 ProcessImageName: python.exe, Pid: 8072, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-24T07:39:48.627 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 90, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-24T07:39:48.627 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20be0-0.MAI, EstimatedImpact: 0% 2026-09-24T07:39:48.627 ProcessImageName: python.exe, Pid: 2968, TotalTime: 61, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 2% 2026-09-24T07:39:48.627 ProcessImageName: powershell.exe, Pid: 6636, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB2D5.tmp, EstimatedImpact: 0% 2026-09-24T07:39:48.627 ProcessImageName: mysqldump.exe, Pid: 6776, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 19% 2026-09-24T07:39:48.627 ProcessImageName: taskhostw.exe, Pid: 1608, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 21% 2026-09-24T07:39:48.627 ProcessImageName: taskhostw.exe, Pid: 1724, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 4% 2026-09-24T07:39:48.627 ProcessImageName: DeviceCensus.exe, Pid: 7464, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 3% 2026-09-24T07:39:48.627 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0% 2026-09-24T07:39:48.627 ProcessImageName: cmd.exe, Pid: 5084, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-24T07:39:48.627 ProcessImageName: ngentask.exe, Pid: 7548, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-24T07:39:48.627 ProcessImageName: svchost.exe, Pid: 2544, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0% 2026-09-24T07:39:48.627 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-24T07:47:10.754 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T07:47:10.754 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T07:47:10.754 [Cloud] Queued cloud request. 2026-09-24T07:47:10.754 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T07:47:10.754 [Cloud] Dequeued cloud request. 2026-09-24T07:47:10.754 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T07:47:20.910 [Cloud] End of cloud request. 2026-09-24T07:47:21.426 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T07:48:04.224 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T08:03:05.994 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T08:03:05.994 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T08:03:05.994 [Cloud] Queued cloud request. 2026-09-24T08:03:05.994 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T08:03:05.994 [Cloud] Dequeued cloud request. 2026-09-24T08:03:05.994 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T08:03:07.197 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{820A2C95-7665-46D3-8BFA-A9C1B52724C1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 08:03:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T08:03:07.698 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T08:03:09.229 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T08:15:45.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T08:15:45.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T08:15:45.297 [Cloud] Queued cloud request. 2026-09-24T08:15:45.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T08:15:45.297 [Cloud] Dequeued cloud request. 2026-09-24T08:15:45.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T08:15:45.609 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{22E16812-DF9F-CA08-D399-B488A264DD23} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 08:15:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T08:15:46.109 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T08:18:07.689 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T08:18:07.689 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T08:18:07.689 [Cloud] Queued cloud request. 2026-09-24T08:18:07.689 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T08:18:07.689 [Cloud] Dequeued cloud request. 2026-09-24T08:18:07.689 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T08:18:08.001 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{029864EC-E65F-8055-6C99-FF913090DD6A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 08:18:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T08:18:08.517 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T08:18:14.236 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T08:24:48.565 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T08:24:48.565 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T08:24:48.565 [Cloud] Queued cloud request. 2026-09-24T08:24:48.565 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T08:24:48.565 [Cloud] Dequeued cloud request. 2026-09-24T08:24:48.565 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T08:24:48.830 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C4224C5A-1B30-D4F7-AB8C-92DA50BB0369} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 08:24:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T08:24:49.330 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T08:31:28.803 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T08:31:28.803 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T08:31:28.803 [Cloud] Queued cloud request. 2026-09-24T08:31:28.803 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T08:31:28.803 [Cloud] Dequeued cloud request. 2026-09-24T08:31:28.803 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T08:31:29.459 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FCC9D53A-A7ED-3026-E310-D8DC03F6BB2F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 08:31:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T08:31:29.975 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T08:33:19.241 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T08:48:24.248 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T09:03:08.582 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T09:03:08.582 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T09:03:08.582 [Cloud] Queued cloud request. 2026-09-24T09:03:08.582 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T09:03:08.582 [Cloud] Dequeued cloud request. 2026-09-24T09:03:08.582 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T09:03:08.816 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D593696B-3510-A67E-F5C6-5D51B35722D2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 09:03:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T09:03:09.332 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T09:03:29.254 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T09:18:18.635 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T09:18:18.635 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T09:18:18.635 [Cloud] Queued cloud request. 2026-09-24T09:18:18.635 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T09:18:18.635 [Cloud] Dequeued cloud request. 2026-09-24T09:18:18.635 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T09:18:19.901 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BECBD29D-30F1-A456-CC77-1F9840CB2BBD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 09:18:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T09:18:20.417 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T09:18:34.260 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T09:25:18.246 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T09:25:18.246 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T09:25:18.246 [Cloud] Queued cloud request. 2026-09-24T09:25:18.246 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T09:25:18.246 [Cloud] Dequeued cloud request. 2026-09-24T09:25:18.246 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T09:25:18.418 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2192667F-16CF-2BF2-F550-AFA403BAA4FD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 09:25:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T09:25:18.918 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T09:33:39.266 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T09:39:26.535 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T09:39:26.535 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T09:39:26.535 [Cloud] Queued cloud request. 2026-09-24T09:39:26.535 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T09:39:26.535 [Cloud] Dequeued cloud request. 2026-09-24T09:39:26.535 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T09:39:26.785 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AF7DD8E7-4EA4-C8F4-A6BA-F6CEA2DCF102} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 09:39:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T09:39:27.300 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T09:39:48.675 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 24549, Count: 1746, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-24T09:39:48.675 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 13072, Count: 1081, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-24T09:39:48.675 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2588, Count: 220, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-24T09:39:48.675 ProcessImageName: powershell.exe, Pid: 6100, TotalTime: 1604, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-24T09:39:48.675 ProcessImageName: AgentShellService.exe, Pid: 3188, TotalTime: 865, Count: 31, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-24T09:39:48.675 ProcessImageName: php.exe, Pid: 4540, TotalTime: 849, Count: 20, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 28% 2026-09-24T09:39:48.675 ProcessImageName: WmiPrvSE.exe, Pid: 5664, TotalTime: 631, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 11% 2026-09-24T09:39:48.675 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 453, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-24T09:39:48.675 ProcessImageName: WmiPrvSE.exe, Pid: 5796, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 40% 2026-09-24T09:39:48.675 ProcessImageName: powershell.exe, Pid: 7992, TotalTime: 277, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-24T09:39:48.675 ProcessImageName: WmiPrvSE.exe, Pid: 6984, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-24T09:39:48.675 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 165, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-24T09:39:48.675 ProcessImageName: cmd.exe, Pid: 4956, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 64% 2026-09-24T09:39:48.675 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 66, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20be0-0.MAI, EstimatedImpact: 0% 2026-09-24T09:39:48.675 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 109, Count: 2, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-24T09:39:48.675 ProcessImageName: python.exe, Pid: 8072, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-24T09:39:48.675 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 90, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-24T09:39:48.675 ProcessImageName: python.exe, Pid: 2968, TotalTime: 61, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 2% 2026-09-24T09:39:48.675 ProcessImageName: powershell.exe, Pid: 6636, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB2D5.tmp, EstimatedImpact: 0% 2026-09-24T09:39:48.675 ProcessImageName: mysqldump.exe, Pid: 6776, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 19% 2026-09-24T09:39:48.675 ProcessImageName: taskhostw.exe, Pid: 1608, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 21% 2026-09-24T09:39:48.675 ProcessImageName: taskhostw.exe, Pid: 1724, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 4% 2026-09-24T09:39:48.675 ProcessImageName: DeviceCensus.exe, Pid: 7464, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 3% 2026-09-24T09:39:48.675 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0% 2026-09-24T09:39:48.675 ProcessImageName: cmd.exe, Pid: 5084, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-24T09:39:48.675 ProcessImageName: ngentask.exe, Pid: 7548, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-24T09:39:48.675 ProcessImageName: svchost.exe, Pid: 2544, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0% 2026-09-24T09:39:48.675 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-24T09:40:03.675 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T09:40:03.675 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T09:40:03.675 [Cloud] Queued cloud request. 2026-09-24T09:40:03.675 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T09:40:03.675 [Cloud] Dequeued cloud request. 2026-09-24T09:40:03.675 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T09:40:03.769 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8FC5B875-EF0B-9EEE-2708-462CCA4FC02B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 09:40:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T09:40:04.285 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T09:43:19.394 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T09:43:19.394 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T09:43:19.394 [Cloud] Queued cloud request. 2026-09-24T09:43:19.394 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T09:43:19.566 [Cloud] Dequeued cloud request. 2026-09-24T09:43:19.566 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T09:43:19.769 [Cloud] End of cloud request. 2026-09-24T09:43:20.285 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T09:48:44.274 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T09:49:00.946 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T09:49:00.946 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T09:49:00.946 [Cloud] Queued cloud request. 2026-09-24T09:49:00.946 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T09:49:00.946 [Cloud] Dequeued cloud request. 2026-09-24T09:49:00.946 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T09:49:01.227 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8A9C9B8E-CC42-0619-E455-60451FDBBC6C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 09:49:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T09:49:01.743 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T09:49:25.227 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T09:49:25.227 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T09:49:25.227 [Cloud] Queued cloud request. 2026-09-24T09:49:25.227 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T09:49:25.227 [Cloud] Dequeued cloud request. 2026-09-24T09:49:25.227 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T09:49:26.305 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DFDB8A9B-FE89-6517-8FC2-06F04614909D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 09:49:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T09:49:26.821 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T09:53:55.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T09:53:55.604 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T09:53:55.604 [Cloud] Queued cloud request. 2026-09-24T09:53:55.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T09:53:55.604 [Cloud] Dequeued cloud request. 2026-09-24T09:53:55.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T09:53:55.838 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5127497A-9D9F-5332-50C7-CF24F009B77C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 09:53:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T09:53:56.338 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T09:54:32.635 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T09:54:32.635 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T09:54:32.635 [Cloud] Queued cloud request. 2026-09-24T09:54:32.635 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T09:54:32.635 [Cloud] Dequeued cloud request. 2026-09-24T09:54:32.635 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T09:54:33.698 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C4AA88F9-9779-8D40-67F2-0141B1CA8594} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 09:54:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T09:54:34.198 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T09:59:56.763 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T09:59:56.763 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T09:59:56.763 [Cloud] Queued cloud request. 2026-09-24T09:59:56.763 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T09:59:56.763 [Cloud] Dequeued cloud request. 2026-09-24T09:59:56.763 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T09:59:56.966 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A556E5E6-8F1C-3CE4-CA97-2CAAE1699A4B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 09:59:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T09:59:57.466 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T10:03:49.279 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T10:04:55.529 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T10:04:55.529 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T10:04:55.529 [Cloud] Queued cloud request. 2026-09-24T10:04:55.529 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T10:04:55.529 [Cloud] Dequeued cloud request. 2026-09-24T10:04:55.529 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T10:04:55.685 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{64C7A8BB-10CD-D489-10C4-4777352A1541} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 10:04:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T10:04:56.185 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T10:18:54.287 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T10:33:59.292 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T10:41:46.140 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T10:41:46.140 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T10:41:46.140 [Cloud] Queued cloud request. 2026-09-24T10:41:46.140 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T10:41:46.140 [Cloud] Dequeued cloud request. 2026-09-24T10:41:46.140 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T10:41:56.296 [Cloud] End of cloud request. 2026-09-24T10:41:56.796 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T10:49:04.300 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T11:04:09.305 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T11:04:37.681 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T11:04:37.681 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T11:04:37.681 [Cloud] Queued cloud request. 2026-09-24T11:04:37.681 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T11:04:37.681 [Cloud] Dequeued cloud request. 2026-09-24T11:04:37.681 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T11:04:37.868 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25176774-BEF1-6C16-0FB6-78A43C156F94} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 11:04:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T11:04:38.368 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T11:07:55.808 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T11:07:55.808 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T11:07:55.808 [Cloud] Queued cloud request. 2026-09-24T11:07:55.808 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T11:07:55.808 [Cloud] Dequeued cloud request. 2026-09-24T11:07:55.808 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T11:07:55.995 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7D9DA068-C18D-0A6F-60BC-6E24CD94B8C9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 11:07:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T11:07:56.511 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T11:19:14.312 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T11:20:06.797 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T11:20:06.797 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T11:20:06.797 [Cloud] Queued cloud request. 2026-09-24T11:20:06.797 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T11:20:06.797 [Cloud] Dequeued cloud request. 2026-09-24T11:20:06.797 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T11:20:16.923 [Cloud] End of cloud request. 2026-09-24T11:20:17.423 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T11:23:49.876 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T11:23:49.876 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T11:23:49.876 [Cloud] Queued cloud request. 2026-09-24T11:23:49.876 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T11:23:49.876 [Cloud] Dequeued cloud request. 2026-09-24T11:23:49.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T11:23:50.079 [Cloud] End of cloud request. 2026-09-24T11:23:50.595 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T11:26:50.189 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T11:26:50.189 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T11:26:50.189 [Cloud] Queued cloud request. 2026-09-24T11:26:50.189 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T11:26:50.189 [Cloud] Dequeued cloud request. 2026-09-24T11:26:50.189 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T11:26:50.423 [Cloud] End of cloud request. 2026-09-24T11:26:50.923 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T11:34:19.317 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T11:39:48.744 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 25945, Count: 1889, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-24T11:39:48.744 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 15207, Count: 1261, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-24T11:39:48.744 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2588, Count: 220, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-24T11:39:48.744 ProcessImageName: powershell.exe, Pid: 6100, TotalTime: 1604, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-24T11:39:48.744 ProcessImageName: AgentShellService.exe, Pid: 3188, TotalTime: 865, Count: 31, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-24T11:39:48.744 ProcessImageName: php.exe, Pid: 4540, TotalTime: 849, Count: 20, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 28% 2026-09-24T11:39:48.744 ProcessImageName: WmiPrvSE.exe, Pid: 5664, TotalTime: 631, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 11% 2026-09-24T11:39:48.744 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 453, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-24T11:39:48.744 ProcessImageName: WmiPrvSE.exe, Pid: 5796, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 40% 2026-09-24T11:39:48.744 ProcessImageName: powershell.exe, Pid: 7992, TotalTime: 277, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-24T11:39:48.744 ProcessImageName: WmiPrvSE.exe, Pid: 6984, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-24T11:39:48.744 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-24T11:39:48.744 ProcessImageName: cmd.exe, Pid: 4956, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 64% 2026-09-24T11:39:48.744 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 66, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20be0-0.MAI, EstimatedImpact: 0% 2026-09-24T11:39:48.744 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 109, Count: 2, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-24T11:39:48.744 ProcessImageName: python.exe, Pid: 8072, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-24T11:39:48.744 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 90, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-24T11:39:48.744 ProcessImageName: python.exe, Pid: 2968, TotalTime: 61, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 2% 2026-09-24T11:39:48.744 ProcessImageName: powershell.exe, Pid: 6636, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB2D5.tmp, EstimatedImpact: 0% 2026-09-24T11:39:48.744 ProcessImageName: mysqldump.exe, Pid: 6776, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 19% 2026-09-24T11:39:48.744 ProcessImageName: taskhostw.exe, Pid: 1608, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 21% 2026-09-24T11:39:48.744 ProcessImageName: taskhostw.exe, Pid: 1724, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 4% 2026-09-24T11:39:48.744 ProcessImageName: DeviceCensus.exe, Pid: 7464, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 3% 2026-09-24T11:39:48.744 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0% 2026-09-24T11:39:48.744 ProcessImageName: cmd.exe, Pid: 5084, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-24T11:39:48.744 ProcessImageName: ngentask.exe, Pid: 7548, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-24T11:39:48.744 ProcessImageName: svchost.exe, Pid: 2544, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0% 2026-09-24T11:39:48.744 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-24T11:41:50.666 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T11:41:50.666 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T11:41:50.666 [Cloud] Queued cloud request. 2026-09-24T11:41:50.666 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T11:41:50.666 [Cloud] Dequeued cloud request. 2026-09-24T11:41:50.666 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T11:42:00.026 [Cloud] End of cloud request. 2026-09-24T11:42:00.526 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T11:49:24.326 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T11:51:34.498 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T11:51:34.498 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T11:51:34.498 [Cloud] Queued cloud request. 2026-09-24T11:51:34.498 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T11:51:34.498 [Cloud] Dequeued cloud request. 2026-09-24T11:51:34.498 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T11:51:34.670 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3A4C9B65-A483-ED3D-C965-59534D528728} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 11:51:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T11:51:35.186 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T11:58:27.236 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T11:58:27.236 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T11:58:27.236 [Cloud] Queued cloud request. 2026-09-24T11:58:27.236 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T11:58:27.236 [Cloud] Dequeued cloud request. 2026-09-24T11:58:27.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T11:58:27.392 [Cloud] End of cloud request. 2026-09-24T11:58:27.908 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T12:04:29.330 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T12:19:34.339 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T12:25:45.371 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T12:25:45.371 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T12:25:45.371 [Cloud] Queued cloud request. 2026-09-24T12:25:45.371 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T12:25:45.371 [Cloud] Dequeued cloud request. 2026-09-24T12:25:45.371 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T12:25:45.637 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BAA917C0-D3A7-FE1A-BE86-40762F51DA5E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 12:25:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T12:25:46.137 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T12:26:05.981 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T12:26:05.981 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T12:26:05.981 [Cloud] Queued cloud request. 2026-09-24T12:26:05.981 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T12:26:05.981 [Cloud] Dequeued cloud request. 2026-09-24T12:26:05.981 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T12:26:06.106 [Cloud] End of cloud request. 2026-09-24T12:26:06.621 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T12:31:24.891 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T12:31:24.891 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T12:31:24.891 [Cloud] Queued cloud request. 2026-09-24T12:31:24.891 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T12:31:24.891 [Cloud] Dequeued cloud request. 2026-09-24T12:31:24.891 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T12:31:25.079 [Cloud] End of cloud request. 2026-09-24T12:31:25.579 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T12:34:39.346 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T12:38:36.879 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T12:38:36.879 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T12:38:36.879 [Cloud] Queued cloud request. 2026-09-24T12:38:36.879 [Cloud] Dequeued cloud request. 2026-09-24T12:38:36.879 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T12:38:36.879 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T12:38:37.082 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F725D2B8-3EB2-6482-1FDE-F23959EB9E0B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 12:38:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T12:38:37.582 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T12:41:54.973 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T12:41:54.973 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T12:41:54.973 [Cloud] Queued cloud request. 2026-09-24T12:41:54.973 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T12:41:54.973 [Cloud] Dequeued cloud request. 2026-09-24T12:41:54.973 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T12:41:55.223 [Cloud] End of cloud request. 2026-09-24T12:41:55.723 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T12:43:14.848 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T12:43:14.848 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T12:43:14.848 [Cloud] Queued cloud request. 2026-09-24T12:43:14.848 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T12:43:14.848 [Cloud] Dequeued cloud request. 2026-09-24T12:43:14.848 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T12:43:15.051 [Cloud] End of cloud request. 2026-09-24T12:43:15.551 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T12:47:43.164 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T12:47:43.164 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T12:47:43.164 [Cloud] Queued cloud request. 2026-09-24T12:47:43.164 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T12:47:43.164 [Cloud] Dequeued cloud request. 2026-09-24T12:47:43.164 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T12:47:43.351 [Cloud] End of cloud request. 2026-09-24T12:47:43.867 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T12:49:44.352 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T12:51:20.197 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T12:51:20.197 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T12:51:20.197 [Cloud] Queued cloud request. 2026-09-24T12:51:20.197 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T12:51:20.197 [Cloud] Dequeued cloud request. 2026-09-24T12:51:20.197 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T12:51:20.400 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{441C884E-1334-3A7B-0B6D-7628F75884C9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 12:51:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T12:51:20.916 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T13:04:49.357 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T13:19:54.366 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T13:34:59.371 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T13:39:48.812 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27498, Count: 1999, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-24T13:39:48.812 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 17295, Count: 1430, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-24T13:39:48.812 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2588, Count: 220, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-24T13:39:48.812 ProcessImageName: powershell.exe, Pid: 6100, TotalTime: 1604, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-24T13:39:48.812 ProcessImageName: AgentShellService.exe, Pid: 3188, TotalTime: 865, Count: 31, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-24T13:39:48.812 ProcessImageName: php.exe, Pid: 4540, TotalTime: 849, Count: 20, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 28% 2026-09-24T13:39:48.812 ProcessImageName: WmiPrvSE.exe, Pid: 5664, TotalTime: 631, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 11% 2026-09-24T13:39:48.812 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 483, Count: 37, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-24T13:39:48.812 ProcessImageName: WmiPrvSE.exe, Pid: 5796, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 40% 2026-09-24T13:39:48.812 ProcessImageName: WmiPrvSE.exe, Pid: 284, TotalTime: 317, Count: 35, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-24T13:39:48.812 ProcessImageName: powershell.exe, Pid: 7992, TotalTime: 277, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-24T13:39:48.812 ProcessImageName: WmiPrvSE.exe, Pid: 6984, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-24T13:39:48.812 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 210, Count: 15, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-24T13:39:48.812 ProcessImageName: cmd.exe, Pid: 4956, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 64% 2026-09-24T13:39:48.812 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 66, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20be0-0.MAI, EstimatedImpact: 0% 2026-09-24T13:39:48.812 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 109, Count: 2, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-24T13:39:48.812 ProcessImageName: python.exe, Pid: 8072, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-24T13:39:48.812 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 90, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-24T13:39:48.812 ProcessImageName: python.exe, Pid: 2968, TotalTime: 61, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 2% 2026-09-24T13:39:48.812 ProcessImageName: powershell.exe, Pid: 6636, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB2D5.tmp, EstimatedImpact: 0% 2026-09-24T13:39:48.812 ProcessImageName: mysqldump.exe, Pid: 6776, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 19% 2026-09-24T13:39:48.812 ProcessImageName: taskhostw.exe, Pid: 1608, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 21% 2026-09-24T13:39:48.812 ProcessImageName: taskhostw.exe, Pid: 1724, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 4% 2026-09-24T13:39:48.812 ProcessImageName: DeviceCensus.exe, Pid: 7464, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 3% 2026-09-24T13:39:48.812 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0% 2026-09-24T13:39:48.812 ProcessImageName: cmd.exe, Pid: 5084, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-24T13:39:48.812 ProcessImageName: ngentask.exe, Pid: 7548, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-24T13:39:48.812 ProcessImageName: svchost.exe, Pid: 2544, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0% 2026-09-24T13:39:48.812 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-24T13:48:02.816 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T13:48:02.816 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T13:48:02.816 [Cloud] Queued cloud request. 2026-09-24T13:48:02.816 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T13:48:02.816 [Cloud] Dequeued cloud request. 2026-09-24T13:48:02.816 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T13:48:05.660 [Cloud] End of cloud request. 2026-09-24T13:48:06.160 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T13:50:04.379 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T13:59:36.883 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T13:59:36.883 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T13:59:36.883 [Cloud] Queued cloud request. 2026-09-24T13:59:36.883 [Cloud] Dequeued cloud request. 2026-09-24T13:59:36.883 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T13:59:36.883 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T13:59:37.071 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A1739463-B495-90EB-68D6-90C5E27D4E51} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 13:59:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T13:59:37.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T14:05:02.805 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T14:05:02.805 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T14:05:02.805 [Cloud] Queued cloud request. 2026-09-24T14:05:02.805 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T14:05:02.805 [Cloud] Dequeued cloud request. 2026-09-24T14:05:02.805 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T14:05:02.993 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25287A78-9D17-2AD3-6E7D-59D9DFBCA51C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 14:05:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T14:05:03.508 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T14:05:09.383 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T14:19:05.814 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T14:19:05.814 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T14:19:05.814 [Cloud] Queued cloud request. 2026-09-24T14:19:05.814 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T14:19:05.814 [Cloud] Dequeued cloud request. 2026-09-24T14:19:05.814 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T14:19:05.986 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F8BA82B6-E591-B74D-66F7-FD4D8D03798D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 14:19:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T14:19:06.501 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T14:20:14.392 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T14:30:08.022 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T14:30:08.022 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T14:30:08.022 [Cloud] Queued cloud request. 2026-09-24T14:30:08.022 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T14:30:08.022 [Cloud] Dequeued cloud request. 2026-09-24T14:30:08.022 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T14:30:08.225 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A3CE1D73-A04E-AA47-6601-0458F68B7F81} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 14:30:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T14:30:08.725 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T14:35:19.397 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T14:38:55.197 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T14:38:55.197 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T14:38:55.197 [Cloud] Queued cloud request. 2026-09-24T14:38:55.197 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T14:38:55.197 [Cloud] Dequeued cloud request. 2026-09-24T14:38:55.197 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T14:38:55.431 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{29924F7C-9352-2BB2-9A6F-A12DC0F8B8FE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 14:38:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T14:38:55.947 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T14:50:24.405 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T14:53:38.375 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T14:53:38.375 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T14:53:38.375 [Cloud] Queued cloud request. 2026-09-24T14:53:38.375 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T14:53:38.375 [Cloud] Dequeued cloud request. 2026-09-24T14:53:38.375 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T14:53:38.531 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7C14BF26-182B-536F-B53D-CC53CB8AF1A2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 14:53:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T14:53:39.031 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T14:59:29.471 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T14:59:29.471 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T14:59:29.471 [Cloud] Queued cloud request. 2026-09-24T14:59:29.471 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T14:59:29.471 [Cloud] Dequeued cloud request. 2026-09-24T14:59:29.471 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T14:59:29.628 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4FBFBB7E-4534-82BD-169B-B08EA2806554} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 14:59:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T14:59:30.143 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T15:05:29.410 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T15:09:44.210 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T15:09:44.210 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T15:09:44.210 [Cloud] Queued cloud request. 2026-09-24T15:09:44.210 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T15:09:44.210 [Cloud] Dequeued cloud request. 2026-09-24T15:09:44.210 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T15:09:45.320 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EF784E61-C112-4E3F-281E-955AFF9070B3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 15:09:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T15:09:45.820 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T15:19:41.981 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T15:19:41.981 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T15:19:41.981 [Cloud] Queued cloud request. 2026-09-24T15:19:41.981 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T15:19:41.981 [Cloud] Dequeued cloud request. 2026-09-24T15:19:41.981 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T15:19:42.137 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{94C0F463-55EF-462D-4D15-ADE072686B8E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 15:19:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T15:19:42.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T15:20:34.418 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T15:23:29.574 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T15:23:29.574 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T15:23:29.574 [Cloud] Queued cloud request. 2026-09-24T15:23:29.574 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T15:23:29.574 [Cloud] Dequeued cloud request. 2026-09-24T15:23:29.574 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T15:23:29.762 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0BEE6300-CDEE-377E-86DA-EDC7B2178417} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 15:23:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T15:23:30.262 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T15:35:39.423 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T15:39:48.879 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 28170, Count: 2048, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-24T15:39:48.879 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 19464, Count: 1600, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-24T15:39:48.879 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2588, Count: 220, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-24T15:39:48.879 ProcessImageName: powershell.exe, Pid: 6100, TotalTime: 1604, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-24T15:39:48.879 ProcessImageName: AgentShellService.exe, Pid: 3188, TotalTime: 865, Count: 31, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-24T15:39:48.879 ProcessImageName: php.exe, Pid: 4540, TotalTime: 849, Count: 20, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 28% 2026-09-24T15:39:48.879 ProcessImageName: WmiPrvSE.exe, Pid: 5664, TotalTime: 631, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 11% 2026-09-24T15:39:48.879 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 573, Count: 43, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-24T15:39:48.879 ProcessImageName: WmiPrvSE.exe, Pid: 5796, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 40% 2026-09-24T15:39:48.879 ProcessImageName: WmiPrvSE.exe, Pid: 284, TotalTime: 317, Count: 35, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-24T15:39:48.879 ProcessImageName: powershell.exe, Pid: 7992, TotalTime: 277, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-24T15:39:48.879 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 240, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-24T15:39:48.879 ProcessImageName: WmiPrvSE.exe, Pid: 6984, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-24T15:39:48.879 ProcessImageName: cmd.exe, Pid: 4956, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 64% 2026-09-24T15:39:48.879 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 66, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20be0-0.MAI, EstimatedImpact: 0% 2026-09-24T15:39:48.879 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 109, Count: 2, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-24T15:39:48.879 ProcessImageName: python.exe, Pid: 8072, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-24T15:39:48.879 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 90, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-24T15:39:48.879 ProcessImageName: python.exe, Pid: 2968, TotalTime: 61, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 2% 2026-09-24T15:39:48.879 ProcessImageName: powershell.exe, Pid: 6636, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB2D5.tmp, EstimatedImpact: 0% 2026-09-24T15:39:48.879 ProcessImageName: mysqldump.exe, Pid: 6776, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 19% 2026-09-24T15:39:48.879 ProcessImageName: taskhostw.exe, Pid: 1608, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 21% 2026-09-24T15:39:48.879 ProcessImageName: taskhostw.exe, Pid: 1724, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 4% 2026-09-24T15:39:48.879 ProcessImageName: DeviceCensus.exe, Pid: 7464, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 3% 2026-09-24T15:39:48.879 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0% 2026-09-24T15:39:48.879 ProcessImageName: cmd.exe, Pid: 5084, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-24T15:39:48.879 ProcessImageName: ngentask.exe, Pid: 7548, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-24T15:39:48.879 ProcessImageName: svchost.exe, Pid: 2544, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0% 2026-09-24T15:39:48.879 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-24T15:46:01.537 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T15:46:01.537 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T15:46:01.537 [Cloud] Queued cloud request. 2026-09-24T15:46:01.537 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T15:46:01.537 [Cloud] Dequeued cloud request. 2026-09-24T15:46:01.537 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T15:46:01.709 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D7C3E86F-1F34-0EAB-836E-26318A6A0377} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 15:46:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T15:46:02.225 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T15:50:44.432 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T16:04:11.280 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T16:04:11.280 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T16:04:11.280 [Cloud] Queued cloud request. 2026-09-24T16:04:11.280 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T16:04:11.452 [Cloud] Dequeued cloud request. 2026-09-24T16:04:11.452 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T16:04:11.640 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9AFA4176-0686-3C55-C3D1-CAFB547286DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 16:04:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T16:04:12.140 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T16:05:49.437 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T16:11:58.190 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T16:11:58.190 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T16:11:58.190 [Cloud] Queued cloud request. 2026-09-24T16:11:58.190 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T16:11:58.190 [Cloud] Dequeued cloud request. 2026-09-24T16:11:58.190 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T16:11:58.377 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E0DDE9C-3D93-C015-1B4D-E06137790D74} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 16:11:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T16:11:58.877 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T16:16:23.628 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T16:16:23.628 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T16:16:23.628 [Cloud] Queued cloud request. 2026-09-24T16:16:23.628 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T16:16:23.628 [Cloud] Dequeued cloud request. 2026-09-24T16:16:23.628 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T16:16:23.831 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{83110B78-7153-FAA7-5B62-47BC9B9C4C19} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 16:16:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T16:16:24.347 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T16:19:05.491 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T16:19:05.491 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T16:19:05.491 [Cloud] Queued cloud request. 2026-09-24T16:19:05.491 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T16:19:05.491 [Cloud] Dequeued cloud request. 2026-09-24T16:19:05.491 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T16:19:05.678 [Cloud] End of cloud request. 2026-09-24T16:19:06.178 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T16:19:07.382 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T16:19:07.382 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T16:19:07.382 [Cloud] Queued cloud request. 2026-09-24T16:19:07.382 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T16:19:07.382 [Cloud] Dequeued cloud request. 2026-09-24T16:19:07.382 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T16:19:07.460 [Cloud] End of cloud request. 2026-09-24T16:19:07.975 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T16:19:57.335 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T16:19:57.335 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T16:19:57.335 [Cloud] Queued cloud request. 2026-09-24T16:19:57.335 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T16:19:57.335 [Cloud] Dequeued cloud request. 2026-09-24T16:19:57.335 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T16:20:07.382 [Cloud] End of cloud request. 2026-09-24T16:20:07.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T16:20:54.445 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T16:23:28.085 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T16:23:28.085 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T16:23:28.085 [Cloud] Queued cloud request. 2026-09-24T16:23:28.085 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T16:23:28.085 [Cloud] Dequeued cloud request. 2026-09-24T16:23:28.085 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T16:23:38.226 [Cloud] End of cloud request. 2026-09-24T16:23:38.726 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T16:24:44.054 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T16:24:44.054 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T16:24:44.054 [Cloud] Queued cloud request. 2026-09-24T16:24:44.054 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T16:24:44.054 [Cloud] Dequeued cloud request. 2026-09-24T16:24:44.054 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T16:24:44.242 [Cloud] End of cloud request. 2026-09-24T16:24:44.757 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T16:27:45.557 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T16:27:45.557 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T16:27:45.557 [Cloud] Queued cloud request. 2026-09-24T16:27:45.557 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T16:27:45.557 [Cloud] Dequeued cloud request. 2026-09-24T16:27:45.557 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T16:27:50.151 [Cloud] End of cloud request. 2026-09-24T16:27:50.651 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T16:35:59.449 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T16:38:05.499 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T16:38:05.499 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T16:38:05.499 [Cloud] Queued cloud request. 2026-09-24T16:38:05.499 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T16:38:05.499 [Cloud] Dequeued cloud request. 2026-09-24T16:38:05.499 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T16:38:05.671 [Cloud] End of cloud request. 2026-09-24T16:38:06.187 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T16:51:04.457 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T16:59:13.008 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T16:59:13.008 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T16:59:13.008 [Cloud] Queued cloud request. 2026-09-24T16:59:13.008 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T16:59:13.008 [Cloud] Dequeued cloud request. 2026-09-24T16:59:13.008 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T16:59:13.180 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E1F2AFAB-7DCF-4857-FEC3-53FCD50CEB61} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 16:59:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T16:59:13.696 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:01:14.587 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:01:14.587 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:01:14.587 [Cloud] Queued cloud request. 2026-09-24T17:01:14.587 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:01:14.587 [Cloud] Dequeued cloud request. 2026-09-24T17:01:14.603 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:01:14.837 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{549693E8-3E03-3772-1456-94368F22DAD1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 17:01:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T17:01:15.493 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:06:09.463 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T17:10:56.310 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:10:56.310 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:10:56.310 [Cloud] Queued cloud request. 2026-09-24T17:10:56.310 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:10:56.310 [Cloud] Dequeued cloud request. 2026-09-24T17:10:56.310 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:10:56.466 [Cloud] End of cloud request. 2026-09-24T17:10:56.966 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:12:50.576 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:12:50.576 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:12:50.576 [Cloud] Queued cloud request. 2026-09-24T17:12:50.576 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:12:50.576 [Cloud] Dequeued cloud request. 2026-09-24T17:12:50.576 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:12:50.716 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DED85907-1461-C5BF-788D-E6388BBC954C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 17:12:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T17:12:51.232 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:13:29.857 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:13:29.857 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:13:29.857 [Cloud] Queued cloud request. 2026-09-24T17:13:29.857 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:13:29.857 [Cloud] Dequeued cloud request. 2026-09-24T17:13:29.857 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:13:29.935 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FC818257-0F64-E12B-6582-084B964931AD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 17:13:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T17:13:30.451 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:14:05.982 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:14:05.982 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:14:05.982 [Cloud] Queued cloud request. 2026-09-24T17:14:05.982 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:14:05.982 [Cloud] Dequeued cloud request. 2026-09-24T17:14:05.982 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:14:06.060 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{58187BE0-3A4F-2004-C985-C8F5938F459A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 17:14:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T17:14:06.560 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:14:33.638 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:14:33.638 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:14:33.638 [Cloud] Queued cloud request. 2026-09-24T17:14:33.638 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:14:33.638 [Cloud] Dequeued cloud request. 2026-09-24T17:14:33.638 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:14:35.138 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{488B72B6-6C30-29F3-DE16-9CD9A85CED1C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 17:14:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T17:14:35.638 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:21:14.471 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T17:24:34.753 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:24:34.753 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:24:34.753 [Cloud] Queued cloud request. 2026-09-24T17:24:34.753 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:24:34.753 [Cloud] Dequeued cloud request. 2026-09-24T17:24:34.753 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:24:34.987 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F7DF06D1-6D7E-D6BC-2E78-3A55500B2529} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 17:24:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T17:24:35.503 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:31:17.209 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:31:17.209 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:31:17.209 [Cloud] Queued cloud request. 2026-09-24T17:31:17.209 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:31:17.209 [Cloud] Dequeued cloud request. 2026-09-24T17:31:17.209 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:31:27.350 [Cloud] End of cloud request. 2026-09-24T17:31:27.866 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:34:22.741 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:34:22.741 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:34:22.741 [Cloud] Queued cloud request. 2026-09-24T17:34:22.741 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:34:22.741 [Cloud] Dequeued cloud request. 2026-09-24T17:34:22.741 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:34:22.928 [Cloud] End of cloud request. 2026-09-24T17:34:23.444 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:35:49.085 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:35:49.085 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:35:49.085 [Cloud] Queued cloud request. 2026-09-24T17:35:49.085 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:35:49.085 [Cloud] Dequeued cloud request. 2026-09-24T17:35:49.085 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:35:59.178 [Cloud] End of cloud request. 2026-09-24T17:35:59.678 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:36:19.475 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T17:39:48.932 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 29013, Count: 2086, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-24T17:39:48.932 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 21601, Count: 1771, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-24T17:39:48.932 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2588, Count: 220, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-24T17:39:48.932 ProcessImageName: powershell.exe, Pid: 6100, TotalTime: 1604, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-24T17:39:48.932 ProcessImageName: AgentShellService.exe, Pid: 3188, TotalTime: 865, Count: 31, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-24T17:39:48.932 ProcessImageName: php.exe, Pid: 4540, TotalTime: 849, Count: 20, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 28% 2026-09-24T17:39:48.932 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 755, Count: 53, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-24T17:39:48.932 ProcessImageName: WmiPrvSE.exe, Pid: 5664, TotalTime: 631, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 11% 2026-09-24T17:39:48.932 ProcessImageName: WmiPrvSE.exe, Pid: 5796, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 40% 2026-09-24T17:39:48.932 ProcessImageName: WmiPrvSE.exe, Pid: 284, TotalTime: 317, Count: 35, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-24T17:39:48.932 ProcessImageName: powershell.exe, Pid: 7992, TotalTime: 277, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-24T17:39:48.932 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 255, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-24T17:39:48.932 ProcessImageName: WmiPrvSE.exe, Pid: 6984, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-24T17:39:48.932 ProcessImageName: cmd.exe, Pid: 4956, TotalTime: 140, Count: 2, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\PHP53\php.exe, EstimatedImpact: 64% 2026-09-24T17:39:48.932 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 66, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-20be0-0.MAI, EstimatedImpact: 0% 2026-09-24T17:39:48.932 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 109, Count: 2, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-24T17:39:48.932 ProcessImageName: python.exe, Pid: 8072, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 4% 2026-09-24T17:39:48.932 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 90, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-24T17:39:48.932 ProcessImageName: python.exe, Pid: 2968, TotalTime: 61, Count: 14, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 2% 2026-09-24T17:39:48.932 ProcessImageName: powershell.exe, Pid: 6636, TotalTime: 61, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpB2D5.tmp, EstimatedImpact: 0% 2026-09-24T17:39:48.932 ProcessImageName: mysqldump.exe, Pid: 6776, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\niki_dr.sql, EstimatedImpact: 19% 2026-09-24T17:39:48.932 ProcessImageName: taskhostw.exe, Pid: 1608, TotalTime: 46, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 21% 2026-09-24T17:39:48.932 ProcessImageName: taskhostw.exe, Pid: 1724, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 4% 2026-09-24T17:39:48.932 ProcessImageName: DeviceCensus.exe, Pid: 7464, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\config.json, EstimatedImpact: 3% 2026-09-24T17:39:48.932 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0% 2026-09-24T17:39:48.932 ProcessImageName: cmd.exe, Pid: 5084, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-24T17:39:48.932 ProcessImageName: ngentask.exe, Pid: 7548, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 13% 2026-09-24T17:39:48.932 ProcessImageName: svchost.exe, Pid: 2544, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0% 2026-09-24T17:39:48.932 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-24T17:46:34.777 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:46:34.777 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:46:34.777 [Cloud] Queued cloud request. 2026-09-24T17:46:34.777 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:46:34.777 [Cloud] Dequeued cloud request. 2026-09-24T17:46:34.777 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:46:34.948 [Cloud] End of cloud request. 2026-09-24T17:46:35.448 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:49:41.530 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:49:41.530 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:49:41.530 [Cloud] Queued cloud request. 2026-09-24T17:49:41.530 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:49:41.530 [Cloud] Dequeued cloud request. 2026-09-24T17:49:41.530 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:49:41.686 [Cloud] End of cloud request. 2026-09-24T17:49:42.186 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T17:51:24.483 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T17:58:39.612 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T17:58:39.612 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T17:58:39.612 [Cloud] Queued cloud request. 2026-09-24T17:58:39.612 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T17:58:39.612 [Cloud] Dequeued cloud request. 2026-09-24T17:58:39.612 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T17:58:39.815 [Cloud] End of cloud request. 2026-09-24T17:58:40.331 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T18:04:26.958 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T18:04:26.958 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T18:04:26.958 [Cloud] Queued cloud request. 2026-09-24T18:04:26.958 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T18:04:26.958 [Cloud] Dequeued cloud request. 2026-09-24T18:04:26.958 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T18:04:27.130 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{41B17376-D5BE-042D-6077-E1686C742960} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 18:04:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T18:04:27.646 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T18:06:29.490 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T18:13:48.257 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T18:13:48.257 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T18:13:48.257 [Cloud] Queued cloud request. 2026-09-24T18:13:48.257 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T18:13:48.257 [Cloud] Dequeued cloud request. 2026-09-24T18:13:48.257 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T18:13:48.413 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{95D1E32A-C1D1-743F-388F-B4A72473E53C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 18:13:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T18:13:48.913 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T18:21:34.496 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T18:22:46.121 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T18:22:46.121 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T18:22:46.121 [Cloud] Queued cloud request. 2026-09-24T18:22:46.121 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T18:22:46.121 [Cloud] Dequeued cloud request. 2026-09-24T18:22:46.121 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T18:22:46.262 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A59F3746-E9B6-A020-05C7-3A23BCC3EEA5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 18:22:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T18:22:46.762 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T18:24:01.654 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T18:24:01.654 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T18:24:01.654 [Cloud] Queued cloud request. 2026-09-24T18:24:01.654 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T18:24:01.654 [Cloud] Dequeued cloud request. 2026-09-24T18:24:01.654 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T18:24:01.794 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8F6AE9AB-02CD-97B5-95B5-62C606305F50} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 18:24:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T18:24:02.310 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T18:25:00.764 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T18:25:00.764 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T18:25:00.764 [Cloud] Queued cloud request. 2026-09-24T18:25:00.764 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T18:25:00.764 [Cloud] Dequeued cloud request. 2026-09-24T18:25:00.764 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T18:25:00.842 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AD4265AC-4242-8DD3-A77E-334CE43C0FA6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 18:25:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T18:25:01.358 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T18:30:42.031 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T18:30:42.031 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T18:30:42.031 [Cloud] Queued cloud request. 2026-09-24T18:30:42.031 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T18:30:42.031 [Cloud] Dequeued cloud request. 2026-09-24T18:30:42.031 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T18:30:42.188 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{159DADA7-B343-310A-A6F3-0F5A87FDB72E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 18:30:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T18:30:42.688 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T18:36:39.501 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T18:51:44.510 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T19:00:20.936 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:00:20.936 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:00:20.936 [Cloud] Queued cloud request. 2026-09-24T19:00:20.936 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:00:20.936 [Cloud] Dequeued cloud request. 2026-09-24T19:00:20.936 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:00:26.529 [Cloud] End of cloud request. 2026-09-24T19:00:27.029 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:06:49.515 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T19:07:03.562 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:07:03.562 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:07:03.562 [Cloud] Queued cloud request. 2026-09-24T19:07:03.562 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:07:03.562 [Cloud] Dequeued cloud request. 2026-09-24T19:07:03.562 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:07:03.718 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FAD0FD6C-E2B3-2C1D-114D-2850329FD405} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 19:07:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T19:07:04.218 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:09:17.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:09:17.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:09:17.049 [Cloud] Queued cloud request. 2026-09-24T19:09:17.049 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:09:17.049 [Cloud] Dequeued cloud request. 2026-09-24T19:09:17.049 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:09:17.471 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{43378588-CD1D-9FDA-17BB-593CEB933DE5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 19:09:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T19:09:17.971 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:14:36.192 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:14:36.192 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:14:36.192 [Cloud] Queued cloud request. 2026-09-24T19:14:36.192 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:14:36.192 [Cloud] Dequeued cloud request. 2026-09-24T19:14:36.192 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:14:36.364 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DD32CEEB-F712-7B64-0C11-0252FE86F4B6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 19:14:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T19:14:36.864 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:20:06.053 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:20:06.053 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:20:06.053 [Cloud] Queued cloud request. 2026-09-24T19:20:06.053 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:20:06.053 [Cloud] Dequeued cloud request. 2026-09-24T19:20:06.053 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:20:06.303 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C369A3AC-2757-FC91-F37A-96012B682100} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 19:20:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T19:20:06.803 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:21:54.522 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T19:25:24.695 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:25:24.695 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:25:24.695 [Cloud] Queued cloud request. 2026-09-24T19:25:24.695 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:25:24.695 [Cloud] Dequeued cloud request. 2026-09-24T19:25:24.695 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:25:25.054 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F66C6589-3215-DF60-007F-866FB179C61F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 19:25:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T19:25:25.570 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:26:39.148 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:26:39.148 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:26:39.148 [Cloud] Queued cloud request. 2026-09-24T19:26:39.148 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:26:39.148 [Cloud] Dequeued cloud request. 2026-09-24T19:26:39.148 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:26:39.289 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25FCD3A7-6FB2-17A9-6664-0563CFAC54B7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 19:26:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T19:26:39.789 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:30:20.652 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:30:20.652 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:30:20.652 [Cloud] Queued cloud request. 2026-09-24T19:30:20.652 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:30:20.652 [Cloud] Dequeued cloud request. 2026-09-24T19:30:20.652 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:30:20.808 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{235AFA87-9D24-B2CD-521F-0E963033B0A6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 19:30:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T19:30:21.308 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:35:56.793 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:35:56.793 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:35:56.793 [Cloud] Queued cloud request. 2026-09-24T19:35:56.793 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:35:56.793 [Cloud] Dequeued cloud request. 2026-09-24T19:35:56.793 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:35:56.934 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{24E74B1B-5199-AEF6-9F0D-62066B648D0D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 19:35:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T19:35:57.434 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:36:59.528 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T19:39:14.531 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-24T19:39:14.562 Job Notification: New process added to job (7556) 2026-09-24T19:39:14.578 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-24T19:39:14.578 Aggressive catchup quick scan threshold: 660067381345 / 25920000000000 2026-09-24T19:39:14.578 Job Notification: New process added to job (4944) 2026-09-24T19:39:14.578 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:7556] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:4944]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-24T19:39:14.703 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-24T19:39:14.703 Job Notification: New process added to job (7072) 2026-09-24T19:39:14.703 Job Notification: New process added to job (7628) 2026-09-24T19:39:14.781 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:7072] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7628]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-24T19:39:14.906 Job Notification: New process added to job (6436) 2026-09-24T19:39:14.968 Task(GetDeviceTicket -AccessKey F8E9458E-FEAF-9E60-1A88-7D5CDF4BB75C ) launched as network service 2026-09-24T19:39:15.109 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-24T19:39:15.109 [RTP] Duplicating the current plugin configuration object... 2026-09-24T19:39:15.109 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-24T19:39:15.109 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-24T19:39:15.109 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-24T19:39:15.109 [RTP] No config change detected. Not updating plugin configuration. 2026-09-24T19:39:15.109 [RTP] No config changes found. No configuration switch. 2026-09-24T19:39:15.109 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-24T19:39:15.546 Job Notification: Process exited from job (6436) 2026-09-24T19:39:15.703 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-24T19:39:15.703 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:39:15.703 [Cloud] Queued cloud request. 2026-09-24T19:39:15.703 [Cloud] Dequeued cloud request. 2026-09-24T19:39:15.703 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:39:15.843 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-24T19:39:15.843 [Cloud] End of cloud request. 2026-09-24T19:39:16.218 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:39:26.546 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\59DB537C-BC3E-49DA-A7A7-8A245D19256B17f4.1dd4c5c674c0141 2026-09-24T19:39:26.656 Verifying engine and signature files (source: 0) ... 2026-09-24T19:39:26.656 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817}\mpengine.dll] due to PPL. 2026-09-24T19:39:26.656 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817}\mpasbase.vdm]. File not in cache (0x1) 2026-09-24T19:39:27.640 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817}\mpasbase.vdm] 2026-09-24T19:39:27.640 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-24T19:39:27.687 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817}\mpasdlta.vdm] 2026-09-24T19:39:27.687 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817}\mpavbase.vdm]. File not in cache (0x1) 2026-09-24T19:39:28.109 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817}\mpavbase.vdm] 2026-09-24T19:39:28.109 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-24T19:39:28.140 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817}\mpavdlta.vdm] 2026-09-24T19:39:28.328 [Engine] IsHybridMode: 0 2026-09-24T19:39:28.328 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-24T19:39:28.343 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-E39BB1F5FB996A9382D4CE061F568F2B5F1B4C88.bin): 0x00000002 2026-09-24T19:39:28.343 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-E39BB1F5FB996A9382D4CE061F568F2B5F1B4C88.bin) 2026-09-24T19:39:28.343 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-24T19:39:28.343 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-24T19:39:28.343 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-24T19:39:28.343 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-24T19:39:41.187 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-24T19:39:41.187 [AutoExclusion] Applied roles from cache. 2026-09-24T19:39:41.187 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-24T19:39:41.281 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF68AB020, lRefCount: 6, hr=0 2026-09-24T19:39:41.281 [Engine] New active engine 00007FFCF4ABB020 replacing engine 00007FFCF68AB020. Number of active engines: 2 2026-09-24T19:39:41.296 EngineInit:Global ASOC is enabled 2026-09-24T19:39:41.296 EngineInit:ASOO is enabled for developer volumes 2026-09-24T19:39:41.374 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-24T19:39:41.374 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.374 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-24T19:39:41.374 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-24T19:39:41.374 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-24T19:39:41.374 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.374 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.374 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.374 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-24T19:39:41.390 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.390 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-24T19:39:41.390 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.390 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.390 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.390 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.390 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.390 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.390 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.390 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-24T19:39:41.421 MpWriteUupSignatureVersion 1.459.384.0, hr = 0 2026-09-24T19:39:41.421 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-24T19:39:41.453 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-24T19:39:41.453 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-24T19:39:41.453 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-24T19:39:41.453 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-24T19:39:41.468 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-24T19:39:41.468 [Plugin] Initializing RTP plugin state... 2026-09-24T19:39:41.468 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-24T19:39:41.468 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎23‎-‎2026 21:39:48 Last Perf:‎09‎-‎23‎-‎2026 21:39:48 First RTP Scan:‎09‎-‎23‎-‎2026 21:39:48 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1499 Misses:7855 BM Queue:0,40,0 Proc:0,26,0 File:0,40,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:2944239 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:641240378 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:3634 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:169580 TotalHits:1567102 InstanceCacheInserts:30886 InstanceCacheUpdates:0 InstanceCacheDeletes:17159 InstanceCacheHits:761 InstanceCacheMisses:106414 InstanceCacheOverflows:12907 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:4ms (7185/1492) Success: 1492, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-24T19:39:41.468 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817} 2026-09-24T19:39:41.468 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C7F66D24-8493-49A9-96FF-12FEB0319A2A} removed 2026-09-24T19:39:41.468 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E}\mpasbase.vdm in use, hr=0x80070020 2026-09-24T19:39:41.468 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-24T19:39:41.468 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-24T19:39:41.468 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-24T19:39:41.468 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-24T19:39:41.468 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-24T19:39:41.468 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-24-2026 19:39:41 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-24-2026 19:39:41 2026-09-24T19:39:41.484 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-24T19:39:41.484 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-24T19:39:41.484 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-24T19:39:41.484 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-24T19:39:41.484 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:39:41.499 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-24T19:39:41.499 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-24T19:39:41.499 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-24T19:39:41.499 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-24T19:39:41.499 MdCoreSvc is supported in this platform and OS Signature updated on 09-24-2026 19:39:41 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.384.0 AV Signature Version: 1.459.384.0 ************************************************************ 2026-09-24T19:39:41.499 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-24T19:39:41.499 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\59DB537C-BC3E-49DA-A7A7-8A245D19256B17f4.1dd4c5c674c0141 2026-09-24T19:39:41.531 Process scan (postsignatureupdatescan) started. 2026-09-24T19:39:41.562 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-24T19:39:41.562 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-24-2026 19:39:41 ************************************************************ 2026-09-24T19:39:41.781 Job Notification: Process exited from job (7072) 2026-09-24T19:39:41.781 Job Notification: Process exited from job (7556) 2026-09-24T19:39:41.796 Job Notification: Process exited from job (4944) 2026-09-24T19:39:41.796 Job Notification: Process exited from job (7628) 2026-09-24T19:39:41.890 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-24T19:39:41.890 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-24T19:39:41.890 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-24T19:39:41.890 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-24T19:39:41.890 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-24T19:39:41.906 [Engine] Engine 00007FFCF68AB020 no longer in use. Number of active engines: 1 2026-09-24T19:39:41.906 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-24T19:39:41.906 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-24T19:39:41.926 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-24T19:39:41.926 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-24T19:39:41.926 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-24T19:39:42.546 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 29794, Count: 2123, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\favicon.ico, EstimatedImpact: 0% 2026-09-24T19:39:42.546 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 23785, Count: 1946, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-24T19:39:42.546 ProcessImageName: AgentShell.exe, Pid: 4744, TotalTime: 2588, Count: 220, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-24T19:39:42.546 ProcessImageName: powershell.exe, Pid: 6100, TotalTime: 1604, Count: 107, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 34% 2026-09-24T19:39:42.546 ProcessImageName: AgentShellService.exe, Pid: 3188, TotalTime: 865, Count: 31, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 52% 2026-09-24T19:39:42.546 ProcessImageName: php.exe, Pid: 4540, TotalTime: 849, Count: 20, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 28% 2026-09-24T19:39:42.546 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 845, Count: 62, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-24T19:39:42.546 ProcessImageName: WmiPrvSE.exe, Pid: 5664, TotalTime: 631, Count: 20, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 11% 2026-09-24T19:39:42.546 ProcessImageName: WmiPrvSE.exe, Pid: 5796, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 40% 2026-09-24T19:39:42.546 ProcessImageName: WmiPrvSE.exe, Pid: 284, TotalTime: 317, Count: 35, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 33% 2026-09-24T19:39:42.546 ProcessImageName: powershell.exe, Pid: 7992, TotalTime: 277, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-24T19:39:42.546 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 270, Count: 19, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-24T19:39:42.546 ProcessImageName: WmiPrvSE.exe, Pid: 6984, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-24T19:39:42.627 [Engine] RSIG_UNLOADENGINE, 00007FFCF68AB020, err=0x0 2026-09-24T19:39:42.656 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E4154495-9DB8-495B-B639-C45A4462742E} removed Internal signature match:subtype=Lowfi, sigseq=0x0000157E67AA49DF, sigsha=cd8f16a9d4beb15e15e36fc9a546c2d5bfbafd06, cached=false, source=0, resourceid=0x0d0ba041 2026-09-24T19:39:56.359 Process scan (postsignatureupdatescan) completed. 2026-09-24T19:44:41.329 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-24T19:48:12.160 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:48:12.160 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:48:12.160 [Cloud] Queued cloud request. 2026-09-24T19:48:12.160 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:48:12.160 [Cloud] Dequeued cloud request. 2026-09-24T19:48:12.160 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:48:12.301 [Cloud] End of cloud request. 2026-09-24T19:48:12.816 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:50:38.051 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:50:38.051 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:50:38.051 [Cloud] Queued cloud request. 2026-09-24T19:50:38.051 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:50:38.051 [Cloud] Dequeued cloud request. 2026-09-24T19:50:38.051 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:50:38.222 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D244310C-3B85-1653-4366-237B438F5E6B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 19:50:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T19:50:38.722 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:51:56.332 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:51:56.332 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:51:56.332 [Cloud] Queued cloud request. 2026-09-24T19:51:56.332 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:51:56.332 [Cloud] Dequeued cloud request. 2026-09-24T19:51:56.332 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:51:56.472 [Cloud] End of cloud request. 2026-09-24T19:51:56.972 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T19:52:04.535 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T19:55:14.787 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T19:55:14.787 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T19:55:14.787 [Cloud] Queued cloud request. 2026-09-24T19:55:14.787 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T19:55:14.787 [Cloud] Dequeued cloud request. 2026-09-24T19:55:14.787 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T19:55:14.928 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{91536378-B8E2-3C5C-9BEF-75187982C93B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 19:55:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T19:55:15.443 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T20:07:09.542 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T20:10:21.497 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T20:10:21.497 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T20:10:21.497 [Cloud] Queued cloud request. 2026-09-24T20:10:21.497 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T20:10:21.497 [Cloud] Dequeued cloud request. 2026-09-24T20:10:21.497 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{71621227-05E1-9730-E33C-2F334BB6FF6B} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 20:10:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T20:10:28.388 [Cloud] End of cloud request. 2026-09-24T20:10:28.888 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T20:11:35.920 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T20:11:35.920 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T20:11:35.920 [Cloud] Queued cloud request. 2026-09-24T20:11:35.920 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T20:11:35.920 [Cloud] Dequeued cloud request. 2026-09-24T20:11:35.920 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T20:11:36.092 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EB525BDD-BDD5-502A-18B7-775F41F67465} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 20:11:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T20:11:36.607 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T20:16:50.170 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T20:16:50.170 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T20:16:50.170 [Cloud] Queued cloud request. 2026-09-24T20:16:50.170 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T20:16:50.170 [Cloud] Dequeued cloud request. 2026-09-24T20:16:50.170 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T20:16:50.358 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AFD03C5B-A7D2-3897-BD2A-8CC569AAA11B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 20:16:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T20:16:50.858 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T20:22:14.548 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T20:29:13.740 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T20:29:13.740 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T20:29:13.740 [Cloud] Queued cloud request. 2026-09-24T20:29:13.740 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T20:29:13.740 [Cloud] Dequeued cloud request. 2026-09-24T20:29:13.740 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T20:29:13.928 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5BC5F02D-DD6C-06B8-48E6-E069DB02EFFE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 20:29:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T20:29:14.428 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T20:30:57.037 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T20:30:57.037 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T20:30:57.037 [Cloud] Queued cloud request. 2026-09-24T20:30:57.037 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T20:30:57.037 [Cloud] Dequeued cloud request. 2026-09-24T20:30:57.037 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T20:30:57.224 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{36CA662D-5A38-13C1-5F59-65C9C15918AC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 20:30:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T20:30:57.724 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T20:37:19.554 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T20:52:24.562 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T20:55:41.376 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T20:55:41.376 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T20:55:41.376 [Cloud] Queued cloud request. 2026-09-24T20:55:41.376 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T20:55:41.376 [Cloud] Dequeued cloud request. 2026-09-24T20:55:41.376 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T20:55:41.564 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{78F7BC66-9AB4-88B7-961F-A5B2602253F0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 20:55:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T20:55:42.064 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T21:07:29.569 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{AA31B1D0-25A9-E276-98EB-70637DC18245} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-24-2026 21:12:03 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T21:12:04.444 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T21:12:04.444 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T21:12:04.444 [Cloud] Queued cloud request. 2026-09-24T21:12:04.444 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T21:12:04.444 [Cloud] Dequeued cloud request. 2026-09-24T21:12:04.444 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T21:12:04.756 [Cloud] End of cloud request. 2026-09-24T21:12:05.272 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T21:17:24.164 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T21:17:24.164 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T21:17:24.164 [Cloud] Queued cloud request. 2026-09-24T21:17:24.164 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T21:17:24.164 [Cloud] Dequeued cloud request. 2026-09-24T21:17:24.164 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T21:17:24.305 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F667B4CC-3303-FA55-FE18-5739D96B6F02} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 21:17:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T21:17:24.821 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T21:22:34.575 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T21:26:35.747 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T21:26:35.747 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T21:26:35.747 [Cloud] Queued cloud request. 2026-09-24T21:26:35.747 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T21:26:35.747 [Cloud] Dequeued cloud request. 2026-09-24T21:26:35.747 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T21:26:35.966 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C824A366-D2CA-376E-54FE-E6CC86005645} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 21:26:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T21:26:36.466 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T21:37:39.582 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T21:38:22.848 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T21:38:22.848 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T21:38:22.848 [Cloud] Queued cloud request. 2026-09-24T21:38:22.848 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T21:38:22.848 [Cloud] Dequeued cloud request. 2026-09-24T21:38:22.848 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T21:38:23.004 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{34890CF6-531A-1DEF-C1A2-112E66AA67EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 21:38:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T21:38:23.504 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T21:39:41.333 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 19120, Count: 1262, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-24T21:39:41.333 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 2009, Count: 178, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-24T21:39:41.333 ProcessImageName: powershell.exe, Pid: 4772, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 34% 2026-09-24T21:39:41.333 ProcessImageName: WmiPrvSE.exe, Pid: 7876, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-24T21:39:41.333 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-24T21:39:41.333 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-224d3-0.MAI, EstimatedImpact: 0% 2026-09-24T21:39:41.333 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-24T21:39:41.333 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-24T21:39:41.333 ProcessImageName: taskhostw.exe, Pid: 6780, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-24T21:48:04.258 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T21:48:04.258 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T21:48:04.258 [Cloud] Queued cloud request. 2026-09-24T21:48:04.258 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T21:48:04.258 [Cloud] Dequeued cloud request. 2026-09-24T21:48:04.258 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T21:48:04.399 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9751C273-7996-5AE7-2819-AD52A3F1C8DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 21:48:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T21:48:04.914 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T21:52:44.588 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T21:55:57.494 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T21:55:57.494 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T21:55:57.494 [Cloud] Queued cloud request. 2026-09-24T21:55:57.494 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T21:55:57.494 [Cloud] Dequeued cloud request. 2026-09-24T21:55:57.494 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T21:55:58.260 [Cloud] End of cloud request. 2026-09-24T21:55:58.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T21:56:04.166 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T21:56:04.166 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T21:56:04.166 [Cloud] Queued cloud request. 2026-09-24T21:56:04.166 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T21:56:04.166 [Cloud] Dequeued cloud request. 2026-09-24T21:56:04.166 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T21:56:04.244 [Cloud] End of cloud request. 2026-09-24T21:56:04.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T21:59:04.966 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T21:59:04.966 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T21:59:04.966 [Cloud] Queued cloud request. 2026-09-24T21:59:04.966 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T21:59:04.966 [Cloud] Dequeued cloud request. 2026-09-24T21:59:04.966 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T21:59:05.169 [Cloud] End of cloud request. 2026-09-24T21:59:05.669 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T22:07:49.594 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T22:10:30.377 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T22:10:30.377 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T22:10:30.377 [Cloud] Queued cloud request. 2026-09-24T22:10:30.377 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T22:10:30.564 [Cloud] Dequeued cloud request. 2026-09-24T22:10:30.564 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T22:10:30.752 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06CC9001-1007-6FD9-D3DE-3E31173E3218} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 22:10:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T22:10:31.267 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T22:14:10.066 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T22:14:10.066 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T22:14:10.066 [Cloud] Queued cloud request. 2026-09-24T22:14:10.066 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T22:14:10.066 [Cloud] Dequeued cloud request. 2026-09-24T22:14:10.066 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T22:14:10.206 [Cloud] End of cloud request. 2026-09-24T22:14:10.706 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T22:14:38.956 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T22:14:38.956 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T22:14:38.956 [Cloud] Queued cloud request. 2026-09-24T22:14:38.956 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T22:14:38.956 [Cloud] Dequeued cloud request. 2026-09-24T22:14:38.956 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T22:14:39.284 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1DA38BAC-F463-92E4-3FC4-DC5AD6112226} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 22:14:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T22:14:39.800 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T22:22:54.599 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T22:26:58.602 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T22:26:58.602 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T22:26:58.602 [Cloud] Queued cloud request. 2026-09-24T22:26:58.602 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T22:26:58.602 [Cloud] Dequeued cloud request. 2026-09-24T22:26:58.602 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T22:26:58.789 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EA94F574-B849-255C-0F21-DF6E75F05E39} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 22:26:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T22:26:59.289 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T22:34:17.104 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T22:34:17.104 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T22:34:17.104 [Cloud] Queued cloud request. 2026-09-24T22:34:17.104 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T22:34:17.104 [Cloud] Dequeued cloud request. 2026-09-24T22:34:17.104 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T22:34:17.292 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{889311A6-34F9-AB53-AAE4-128247F132D7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 22:34:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T22:34:17.807 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T22:37:59.607 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T22:53:04.613 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T23:08:09.620 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T23:15:13.043 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T23:15:13.043 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T23:15:13.043 [Cloud] Queued cloud request. 2026-09-24T23:15:13.043 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T23:15:13.043 [Cloud] Dequeued cloud request. 2026-09-24T23:15:13.043 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T23:15:13.247 [Cloud] End of cloud request. 2026-09-24T23:15:13.762 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T23:20:14.750 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T23:20:14.750 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T23:20:14.750 [Cloud] Queued cloud request. 2026-09-24T23:20:14.750 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T23:20:14.750 [Cloud] Dequeued cloud request. 2026-09-24T23:20:14.750 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T23:20:14.953 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{83EEA23F-C4B2-1B92-F56B-FC136BC052A4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 23:20:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T23:20:15.453 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T23:23:14.625 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T23:27:11.017 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T23:27:11.017 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T23:27:11.017 [Cloud] Queued cloud request. 2026-09-24T23:27:11.017 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T23:27:11.017 [Cloud] Dequeued cloud request. 2026-09-24T23:27:11.017 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T23:27:11.282 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9B4E7DCC-8FD6-275D-E411-B6E3C82DE494} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 23:27:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T23:27:11.782 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T23:34:21.958 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T23:34:21.958 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T23:34:21.958 [Cloud] Queued cloud request. 2026-09-24T23:34:21.958 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T23:34:21.958 [Cloud] Dequeued cloud request. 2026-09-24T23:34:21.958 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T23:34:32.083 [Cloud] End of cloud request. 2026-09-24T23:34:32.598 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T23:35:47.428 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-24T23:35:47.428 [Cloud] Start of cloud request. Passive mode: 0 2026-09-24T23:35:47.428 [Cloud] Queued cloud request. 2026-09-24T23:35:47.428 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-24T23:35:47.428 [Cloud] Dequeued cloud request. 2026-09-24T23:35:47.428 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-24T23:35:47.631 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A242DF1D-96FC-D5C8-CD5B-747EAA96FB03} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-24-2026 23:35:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-24T23:35:48.131 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-24T23:38:19.633 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-24T23:39:41.398 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 20383, Count: 1296, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-24T23:39:41.398 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 4410, Count: 374, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-24T23:39:41.398 ProcessImageName: powershell.exe, Pid: 4772, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 34% 2026-09-24T23:39:41.398 ProcessImageName: WmiPrvSE.exe, Pid: 6604, TotalTime: 767, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-24T23:39:41.398 ProcessImageName: WmiPrvSE.exe, Pid: 7876, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-24T23:39:41.398 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-24T23:39:41.398 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-24T23:39:41.398 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 75, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-24T23:39:41.398 ProcessImageName: powershell.exe, Pid: 7568, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rafkkzgf.gfa.ps1, EstimatedImpact: 0% 2026-09-24T23:39:41.398 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-224d3-0.MAI, EstimatedImpact: 0% 2026-09-24T23:39:41.398 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-24T23:39:41.398 ProcessImageName: taskhostw.exe, Pid: 6780, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-24T23:53:24.638 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T00:08:29.645 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T00:13:06.131 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T00:13:06.131 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T00:13:06.131 [Cloud] Queued cloud request. 2026-09-25T00:13:06.131 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T00:13:06.131 [Cloud] Dequeued cloud request. 2026-09-25T00:13:06.131 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T00:13:06.287 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FB2E049D-BBD5-5363-5143-7277B2C9CE41} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 00:13:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T00:13:06.803 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T00:14:09.381 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T00:14:09.381 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T00:14:09.381 [Cloud] Queued cloud request. 2026-09-25T00:14:09.381 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T00:14:09.381 [Cloud] Dequeued cloud request. 2026-09-25T00:14:09.381 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T00:14:09.522 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{15512D4D-C080-9369-FD91-4AB920BE44E0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 00:14:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T00:14:10.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T00:23:34.649 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T00:26:16.214 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T00:26:16.214 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T00:26:16.214 [Cloud] Queued cloud request. 2026-09-25T00:26:16.214 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T00:26:16.214 [Cloud] Dequeued cloud request. 2026-09-25T00:26:16.214 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T00:26:16.402 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{424B33CF-91E7-4DBE-7928-673449AB0699} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 00:26:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T00:26:16.902 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T00:27:11.324 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T00:27:11.324 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T00:27:11.324 [Cloud] Queued cloud request. 2026-09-25T00:27:11.324 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T00:27:11.324 [Cloud] Dequeued cloud request. 2026-09-25T00:27:11.324 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T00:27:11.402 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{69ACCA0D-2498-BDED-7AFF-DDD05901E917} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 00:27:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T00:27:11.918 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T00:30:41.748 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T00:30:41.748 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T00:30:41.748 [Cloud] Queued cloud request. 2026-09-25T00:30:41.748 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T00:30:41.748 [Cloud] Dequeued cloud request. 2026-09-25T00:30:41.748 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T00:30:51.889 [Cloud] End of cloud request. 2026-09-25T00:30:52.389 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T00:38:39.658 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T00:53:02.882 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T00:53:02.882 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T00:53:02.882 [Cloud] Queued cloud request. 2026-09-25T00:53:02.882 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T00:53:02.882 [Cloud] Dequeued cloud request. 2026-09-25T00:53:02.882 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T00:53:03.023 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{42CED0DF-8D08-F52E-365F-70D57587C620} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 00:53:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T00:53:03.538 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T00:53:44.663 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T00:58:20.854 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T00:58:20.854 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T00:58:20.854 [Cloud] Queued cloud request. 2026-09-25T00:58:20.854 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T00:58:20.854 [Cloud] Dequeued cloud request. 2026-09-25T00:58:20.854 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T00:58:21.010 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F4E17887-8D25-B831-87EF-EFAE8C0C86E6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 00:58:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T00:58:21.510 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T01:00:02.058 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051743, FileId: 0x33000000037757, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.058 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051744, FileId: 0x3700000003767a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.073 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051749, FileId: 0x3900000003767a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.073 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051750, FileId: 0x35000000037757, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.089 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051756, FileId: 0x3b00000003767a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.089 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051755, FileId: 0x37000000037757, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.105 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051762, FileId: 0x3d00000003767a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.105 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051761, FileId: 0x39000000037757, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.105 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051768, FileId: 0x3f00000003767a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.105 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051767, FileId: 0x3b000000037757, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.120 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051774, FileId: 0x4100000003767a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.120 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051773, FileId: 0x3d000000037757, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.136 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051780, FileId: 0x4300000003767a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.136 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051779, FileId: 0x3f000000037757, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.151 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051785, FileId: 0x4500000003767a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.151 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051786, FileId: 0x41000000037757, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.151 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051792, FileId: 0x4700000003767a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.151 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051791, FileId: 0x43000000037757, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.167 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051797, FileId: 0x45000000037757, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.167 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051798, FileId: 0x4900000003767a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.183 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051803, FileId: 0x47000000037757, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.183 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051804, FileId: 0x4b00000003767a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.198 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051809, FileId: 0x4d00000003767a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:02.198 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-22698-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3051810, FileId: 0x49000000037757, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T01:00:37.667 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T01:00:37.667 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T01:00:37.667 [Cloud] Queued cloud request. 2026-09-25T01:00:37.667 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T01:00:37.667 [Cloud] Dequeued cloud request. 2026-09-25T01:00:37.667 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T01:00:37.824 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8CD4E5E2-4F77-5E7D-21C4-16DAA0D5564C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 01:00:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T01:00:38.324 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T01:08:49.671 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T01:19:07.847 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:1077882B-B32D-4757-977E-06F096C1D960, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-25T01:19:07.847 Scheduled scan with Id 1077882B-B32D-4757-977E-06F096C1D960 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-25T01:19:07.847 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-25T01:19:07.847 [SFC] System file cache build is not needed (already completed) Internal signature match:subtype=Lowfi, sigseq=0x0000157E67AA49DF, sigsha=cd8f16a9d4beb15e15e36fc9a546c2d5bfbafd06, cached=false, source=0, resourceid=0x0d0ba041 2026-09-25T01:19:28.988 Engine:Triggered AR EMS scan 2026-09-25T01:19:29.004 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.019 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.019 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.035 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.035 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.050 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.050 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.066 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.066 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.066 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.082 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.082 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.082 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.082 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.097 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.097 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.113 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.113 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.113 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.113 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.129 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.129 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.129 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.129 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.144 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.144 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.160 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.160 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.175 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.175 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.175 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.175 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.191 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.191 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.191 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.207 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.207 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.222 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.222 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.222 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.222 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.238 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.238 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.238 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.238 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.254 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.254 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.269 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.269 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.285 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.285 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.285 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.285 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.300 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.300 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.300 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.316 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.316 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.332 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.347 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:19:29.347 Engine:EMS scan for process: svchost pid: 7672, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-25T01:20:07.801 QuickScan:ScanID:1077882B-B32D-4757-977E-06F096C1D960: Quick scan finished with error 0 2026-09-25T01:20:08.317 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-25T01:20:08.317 [RTP] Duplicating the current plugin configuration object... 2026-09-25T01:20:08.317 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-25T01:20:08.317 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-25T01:20:08.317 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-25T01:20:08.317 [RTP] No config change detected. Not updating plugin configuration. 2026-09-25T01:20:08.317 [RTP] No config changes found. No configuration switch. 2026-09-25T01:20:08.317 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-25T01:23:54.677 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T01:26:31.147 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T01:26:31.147 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T01:26:31.147 [Cloud] Queued cloud request. 2026-09-25T01:26:31.147 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T01:26:31.147 [Cloud] Dequeued cloud request. 2026-09-25T01:26:31.147 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T01:26:31.553 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F0B5AA50-E8AB-E1EB-01E0-ACC1FA2FE487} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 01:26:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T01:26:32.053 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T01:38:59.684 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T01:39:41.450 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 20781, Count: 1314, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-25T01:39:41.450 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 6506, Count: 553, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-25T01:39:41.450 ProcessImageName: powershell.exe, Pid: 4772, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 34% 2026-09-25T01:39:41.450 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 892, Count: 49, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-25T01:39:41.450 ProcessImageName: WmiPrvSE.exe, Pid: 6604, TotalTime: 767, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-25T01:39:41.450 ProcessImageName: AgentShellService.exe, Pid: 7784, TotalTime: 711, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-25T01:39:41.450 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 346, Count: 27, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-25T01:39:41.450 ProcessImageName: WmiPrvSE.exe, Pid: 7876, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-25T01:39:41.450 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 105, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-25T01:39:41.450 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-25T01:39:41.450 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-224d3-0.MAI, EstimatedImpact: 0% 2026-09-25T01:39:41.450 ProcessImageName: powershell.exe, Pid: 7568, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rafkkzgf.gfa.ps1, EstimatedImpact: 0% 2026-09-25T01:39:41.450 ProcessImageName: DeviceCensus.exe, Pid: 6936, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-25T01:39:41.450 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-25T01:39:41.450 ProcessImageName: mysqldump.exe, Pid: 7124, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-25T01:39:41.450 ProcessImageName: cmd.exe, Pid: 6784, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-25T01:39:41.450 ProcessImageName: powershell.exe, Pid: 6788, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp9A15.tmp, EstimatedImpact: 0% 2026-09-25T01:39:41.450 ProcessImageName: taskhostw.exe, Pid: 6780, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-25T01:54:04.688 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T02:09:09.696 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T02:09:57.994 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-25T02:09:58.072 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-25T02:09:58.072 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-25T02:09:58.072 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-25T02:09:58.072 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-25T02:09:58.072 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-25T02:09:58.072 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-25T02:09:58.087 [AutoPurge] Cleanup Routine tasks have started. 2026-09-25T02:09:58.134 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-25T02:09:58.134 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-25T02:09:58.134 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-25-2026 02:09:58 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-25-2026 02:09:58 2026-09-25T02:09:58.134 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-25T02:09:58.134 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-25T02:09:58.134 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-25T02:09:58.134 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-25T02:09:58.134 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-25T02:09:58.134 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-25T02:09:58.244 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-25T02:09:58.244 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-25T02:09:58.275 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-25T02:09:58.275 [AutoPurge] Removing expired default signature package ... 2026-09-25T02:09:58.556 Job Notification: New process added to job (348) 2026-09-25T02:09:58.806 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-25T02:09:58.822 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-25T02:09:58.822 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-25T02:09:58.822 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-25T02:09:58.822 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-25T02:09:58.822 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-25T02:09:58.822 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-25T02:09:58.822 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-25T02:09:58.822 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-25T02:09:58.822 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-25T02:09:58.822 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-25T02:09:58.822 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-25T02:09:58.822 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-25T02:09:58.822 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-25T02:09:58.822 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-25T02:09:58.822 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-25T02:09:58.822 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-25T02:09:58.822 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-25T02:09:58.822 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-25T02:09:58.822 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-25T02:09:58.822 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-25T02:09:58.822 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T02:09:58.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T02:09:58.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T02:09:58.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T02:09:58.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T02:09:59.431 Job Notification: Process exited from job (348) 2026-09-25T02:09:59.494 [AutoPurge] Verification Routine tasks have ended. 2026-09-25T02:10:01.416 [RTP] Duplicating the current plugin configuration object... 2026-09-25T02:10:01.416 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-25T02:10:01.416 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-25T02:10:01.416 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-25T02:10:01.416 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-25T02:10:01.416 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-25T02:17:24.465 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T02:17:24.465 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T02:17:24.465 [Cloud] Queued cloud request. 2026-09-25T02:17:24.465 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T02:17:24.465 [Cloud] Dequeued cloud request. 2026-09-25T02:17:24.465 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T02:17:24.653 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8E3ABA75-7857-8C1E-C9B1-798DC5F59D1A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 02:17:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T02:17:25.153 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T02:17:34.497 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T02:17:34.497 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T02:17:34.497 [Cloud] Queued cloud request. 2026-09-25T02:17:34.497 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T02:17:34.497 [Cloud] Dequeued cloud request. 2026-09-25T02:17:34.497 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T02:17:34.575 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{59BF4891-D460-D380-B9DB-FB00D5095459} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 02:17:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T02:17:35.091 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T02:18:42.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T02:18:42.700 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T02:18:42.700 [Cloud] Queued cloud request. 2026-09-25T02:18:42.700 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T02:18:42.700 [Cloud] Dequeued cloud request. 2026-09-25T02:18:42.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T02:18:42.966 [Cloud] End of cloud request. 2026-09-25T02:18:43.466 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T02:21:44.044 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T02:21:44.044 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T02:21:44.044 [Cloud] Queued cloud request. 2026-09-25T02:21:44.044 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T02:21:44.044 [Cloud] Dequeued cloud request. 2026-09-25T02:21:44.044 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T02:21:44.466 [Cloud] End of cloud request. 2026-09-25T02:21:44.966 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T02:24:14.701 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T02:34:29.783 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T02:34:29.783 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T02:34:29.783 [Cloud] Queued cloud request. 2026-09-25T02:34:29.783 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T02:34:29.783 [Cloud] Dequeued cloud request. 2026-09-25T02:34:29.783 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T02:34:36.393 [Cloud] End of cloud request. 2026-09-25T02:34:36.908 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T02:39:19.709 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T02:46:17.461 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T02:46:17.461 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T02:46:17.461 [Cloud] Queued cloud request. 2026-09-25T02:46:17.461 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T02:46:17.461 [Cloud] Dequeued cloud request. 2026-09-25T02:46:17.461 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T02:46:17.649 [Cloud] End of cloud request. 2026-09-25T02:46:18.165 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T02:54:24.713 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T03:00:57.701 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T03:00:57.701 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T03:00:57.701 [Cloud] Queued cloud request. 2026-09-25T03:00:57.701 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T03:00:57.701 [Cloud] Dequeued cloud request. 2026-09-25T03:00:57.701 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T03:00:57.889 [Cloud] End of cloud request. 2026-09-25T03:00:58.389 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T03:01:09.248 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T03:01:09.248 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T03:01:09.248 [Cloud] Queued cloud request. 2026-09-25T03:01:09.248 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T03:01:09.248 [Cloud] Dequeued cloud request. 2026-09-25T03:01:09.248 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T03:01:09.326 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B16566EA-114A-F774-7F08-94CE8B273DA0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 03:01:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T03:01:09.826 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T03:09:29.722 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T03:15:14.847 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T03:15:14.847 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T03:15:14.847 [Cloud] Queued cloud request. 2026-09-25T03:15:14.847 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T03:15:14.847 [Cloud] Dequeued cloud request. 2026-09-25T03:15:14.847 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T03:15:24.941 [Cloud] End of cloud request. 2026-09-25T03:15:25.441 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T03:24:34.726 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T03:39:39.733 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T03:39:41.515 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27766, Count: 1821, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-25T03:39:41.515 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 6506, Count: 553, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-25T03:39:41.515 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 3045, Count: 237, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-25T03:39:41.515 ProcessImageName: powershell.exe, Pid: 4772, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 34% 2026-09-25T03:39:41.515 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 1390, Count: 268, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\Messages\D7BCBA44705C4E659EA38FA66ACDD27A.MAI, EstimatedImpact: 0% 2026-09-25T03:39:41.515 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 957, Count: 108, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\7F5005A1990545DCAF83F9B7CE14EDEE.MAI, EstimatedImpact: 8% 2026-09-25T03:39:41.515 ProcessImageName: taskhostw.exe, Pid: 4672, TotalTime: 781, Count: 2, MaxTime: 750, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 15% 2026-09-25T03:39:41.515 ProcessImageName: php.exe, Pid: 6332, TotalTime: 773, Count: 21, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-25T03:39:41.515 ProcessImageName: WmiPrvSE.exe, Pid: 6604, TotalTime: 767, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-25T03:39:41.515 ProcessImageName: AgentShellService.exe, Pid: 7784, TotalTime: 711, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-25T03:39:41.515 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 406, Count: 33, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-25T03:39:41.515 ProcessImageName: WmiPrvSE.exe, Pid: 2176, TotalTime: 316, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-25T03:39:41.515 ProcessImageName: WmiPrvSE.exe, Pid: 7876, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-25T03:39:41.515 ProcessImageName: python.exe, Pid: 1428, TotalTime: 180, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 7% 2026-09-25T03:39:41.515 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 150, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-25T03:39:41.515 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\7F134E415EE54C3AA718869E1E41C578.MAI, EstimatedImpact: 1% 2026-09-25T03:39:41.515 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-25T03:39:41.515 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-224d3-0.MAI, EstimatedImpact: 0% 2026-09-25T03:39:41.515 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-25T03:39:41.515 ProcessImageName: powershell.exe, Pid: 7568, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rafkkzgf.gfa.ps1, EstimatedImpact: 0% 2026-09-25T03:39:41.515 ProcessImageName: DeviceCensus.exe, Pid: 6936, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-25T03:39:41.515 ProcessImageName: mysqldump.exe, Pid: 7124, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-25T03:39:41.515 ProcessImageName: cmd.exe, Pid: 6784, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-25T03:39:41.515 ProcessImageName: powershell.exe, Pid: 6788, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp9A15.tmp, EstimatedImpact: 0% 2026-09-25T03:39:41.515 ProcessImageName: taskhostw.exe, Pid: 6780, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-25T03:39:41.515 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-25T03:54:05.848 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T03:54:05.848 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T03:54:05.848 [Cloud] Queued cloud request. 2026-09-25T03:54:05.848 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T03:54:05.848 [Cloud] Dequeued cloud request. 2026-09-25T03:54:05.848 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T03:54:06.035 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7FDBAA0E-7455-A11E-E3F7-BEBA7EABE590} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 03:54:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T03:54:06.535 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T03:54:44.739 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T03:55:45.598 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T03:55:45.598 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T03:55:45.598 [Cloud] Queued cloud request. 2026-09-25T03:55:45.598 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T03:55:45.598 [Cloud] Dequeued cloud request. 2026-09-25T03:55:45.598 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T03:55:45.785 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4992306E-113B-6A51-6945-8ABCFFC8D759} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 03:55:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T03:55:46.285 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T03:56:17.475 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T03:56:17.475 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T03:56:17.475 [Cloud] Queued cloud request. 2026-09-25T03:56:17.475 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T03:56:17.475 [Cloud] Dequeued cloud request. 2026-09-25T03:56:17.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T03:56:17.553 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{408E66E8-3DB6-4D1D-27C9-E3A211BD3F2D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 03:56:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T03:56:18.053 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T04:09:49.746 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T04:13:08.701 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T04:13:08.701 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T04:13:08.701 [Cloud] Queued cloud request. 2026-09-25T04:13:08.701 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T04:13:08.701 [Cloud] Dequeued cloud request. 2026-09-25T04:13:08.701 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T04:13:09.107 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C0517DE4-4FBD-13E0-9085-6701839EEDC0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 04:13:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T04:13:09.607 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T04:15:58.874 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T04:15:58.874 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T04:15:58.874 [Cloud] Queued cloud request. 2026-09-25T04:15:58.874 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T04:15:58.874 [Cloud] Dequeued cloud request. 2026-09-25T04:15:58.874 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T04:16:05.796 [Cloud] End of cloud request. 2026-09-25T04:16:06.296 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T04:19:30.391 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T04:19:30.391 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T04:19:30.391 [Cloud] Queued cloud request. 2026-09-25T04:19:30.391 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T04:19:30.391 [Cloud] Dequeued cloud request. 2026-09-25T04:19:30.391 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T04:19:40.672 [Cloud] End of cloud request. 2026-09-25T04:19:41.188 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T04:24:54.751 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T04:29:29.083 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T04:29:29.083 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T04:29:29.083 [Cloud] Queued cloud request. 2026-09-25T04:29:29.083 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T04:29:29.083 [Cloud] Dequeued cloud request. 2026-09-25T04:29:29.083 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T04:29:29.223 [Cloud] End of cloud request. 2026-09-25T04:29:29.739 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T04:39:59.759 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T04:42:46.024 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T04:42:46.024 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T04:42:46.024 [Cloud] Queued cloud request. 2026-09-25T04:42:46.024 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T04:42:46.024 [Cloud] Dequeued cloud request. 2026-09-25T04:42:46.024 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T04:42:46.165 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2A954264-B856-9948-86D4-9C900ED9CE56} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 04:42:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T04:42:46.665 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T04:42:48.868 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T04:42:48.868 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T04:42:48.868 [Cloud] Queued cloud request. 2026-09-25T04:42:48.868 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T04:42:48.868 [Cloud] Dequeued cloud request. 2026-09-25T04:42:48.868 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T04:42:48.946 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A0D17764-A8C8-D224-D593-DAFFD188C574} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 04:42:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T04:42:49.462 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T04:43:36.665 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T04:43:36.665 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T04:43:36.665 [Cloud] Queued cloud request. 2026-09-25T04:43:36.665 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T04:43:36.665 [Cloud] Dequeued cloud request. 2026-09-25T04:43:36.665 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T04:43:36.759 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{869E8C7A-C670-554B-5F0E-5CFCDE8186D2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 04:43:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T04:43:37.274 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T04:55:04.765 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T05:10:09.771 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T05:17:38.618 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T05:17:38.618 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T05:17:38.618 [Cloud] Queued cloud request. 2026-09-25T05:17:38.618 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T05:17:38.618 [Cloud] Dequeued cloud request. 2026-09-25T05:17:38.618 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T05:17:38.806 [Cloud] End of cloud request. 2026-09-25T05:17:39.322 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T05:25:14.776 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T05:25:21.667 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T05:25:21.667 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T05:25:21.667 [Cloud] Queued cloud request. 2026-09-25T05:25:21.667 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T05:25:21.667 [Cloud] Dequeued cloud request. 2026-09-25T05:25:21.667 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T05:25:21.855 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B9D66225-AB63-A865-53E4-958467B9C2E7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 05:25:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T05:25:22.370 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T05:26:36.652 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T05:26:36.652 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T05:26:36.652 [Cloud] Queued cloud request. 2026-09-25T05:26:36.652 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T05:26:36.652 [Cloud] Dequeued cloud request. 2026-09-25T05:26:36.652 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T05:26:36.824 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8CEB1623-5267-D411-763F-E44741CCB274} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 05:26:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T05:26:37.339 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T05:39:41.565 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 30177, Count: 1993, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-25T05:39:41.565 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 6506, Count: 553, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-25T05:39:41.565 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 5071, Count: 424, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-25T05:39:41.565 ProcessImageName: powershell.exe, Pid: 4772, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 34% 2026-09-25T05:39:41.565 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 1390, Count: 268, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\Messages\D7BCBA44705C4E659EA38FA66ACDD27A.MAI, EstimatedImpact: 0% 2026-09-25T05:39:41.565 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 957, Count: 108, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\7F5005A1990545DCAF83F9B7CE14EDEE.MAI, EstimatedImpact: 8% 2026-09-25T05:39:41.565 ProcessImageName: taskhostw.exe, Pid: 4672, TotalTime: 781, Count: 2, MaxTime: 750, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 15% 2026-09-25T05:39:41.565 ProcessImageName: php.exe, Pid: 6332, TotalTime: 773, Count: 21, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-25T05:39:41.565 ProcessImageName: WmiPrvSE.exe, Pid: 6604, TotalTime: 767, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-25T05:39:41.565 ProcessImageName: AgentShellService.exe, Pid: 7784, TotalTime: 711, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-25T05:39:41.565 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 451, Count: 37, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-25T05:39:41.565 ProcessImageName: WmiPrvSE.exe, Pid: 2176, TotalTime: 316, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-25T05:39:41.565 ProcessImageName: WmiPrvSE.exe, Pid: 7876, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-25T05:39:41.565 ProcessImageName: python.exe, Pid: 1428, TotalTime: 180, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 7% 2026-09-25T05:39:41.565 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 165, Count: 11, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-25T05:39:41.565 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\7F134E415EE54C3AA718869E1E41C578.MAI, EstimatedImpact: 1% 2026-09-25T05:39:41.565 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-25T05:39:41.565 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-224d3-0.MAI, EstimatedImpact: 0% 2026-09-25T05:39:41.565 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-25T05:39:41.565 ProcessImageName: powershell.exe, Pid: 7568, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rafkkzgf.gfa.ps1, EstimatedImpact: 0% 2026-09-25T05:39:41.565 ProcessImageName: DeviceCensus.exe, Pid: 6936, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-25T05:39:41.565 ProcessImageName: mysqldump.exe, Pid: 7124, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-25T05:39:41.565 ProcessImageName: cmd.exe, Pid: 6784, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-25T05:39:41.565 ProcessImageName: powershell.exe, Pid: 6788, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp9A15.tmp, EstimatedImpact: 0% 2026-09-25T05:39:41.565 ProcessImageName: taskhostw.exe, Pid: 6780, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-25T05:39:41.565 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-25T05:39:43.503 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T05:39:43.503 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T05:39:43.503 [Cloud] Queued cloud request. 2026-09-25T05:39:43.503 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T05:39:43.674 [Cloud] Dequeued cloud request. 2026-09-25T05:39:43.674 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T05:39:43.862 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6A65CB8B-56C1-E6F7-365D-B0A4F302A0FB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 05:39:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T05:39:44.362 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T05:40:19.785 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T05:44:33.378 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T05:44:33.378 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T05:44:33.378 [Cloud] Queued cloud request. 2026-09-25T05:44:33.378 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T05:44:33.378 [Cloud] Dequeued cloud request. 2026-09-25T05:44:33.378 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T05:44:33.566 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1DFE426A-CD8F-6854-3337-AC05E3FD0659} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 05:44:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T05:44:34.082 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T05:48:59.663 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T05:48:59.663 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T05:48:59.663 [Cloud] Queued cloud request. 2026-09-25T05:48:59.663 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T05:48:59.663 [Cloud] Dequeued cloud request. 2026-09-25T05:48:59.663 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T05:48:59.835 [Cloud] End of cloud request. 2026-09-25T05:49:00.351 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T05:55:24.789 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T06:02:09.527 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T06:02:09.527 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T06:02:09.527 [Cloud] Queued cloud request. 2026-09-25T06:02:09.527 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T06:02:09.527 [Cloud] Dequeued cloud request. 2026-09-25T06:02:09.527 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T06:02:10.043 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F628533-37B3-EC78-0E5B-261E8FE2E306} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 06:02:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T06:02:10.559 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T06:05:48.902 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T06:05:48.902 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T06:05:48.902 [Cloud] Queued cloud request. 2026-09-25T06:05:48.902 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T06:05:48.902 [Cloud] Dequeued cloud request. 2026-09-25T06:05:48.902 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T06:05:49.090 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2D1D07CC-540F-6472-E049-CF34DCD0E6C3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 06:05:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T06:05:49.590 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T06:06:23.810 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T06:06:23.810 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T06:06:23.810 [Cloud] Queued cloud request. 2026-09-25T06:06:23.810 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T06:06:23.810 [Cloud] Dequeued cloud request. 2026-09-25T06:06:23.810 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T06:06:23.888 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{68091CE0-997C-225F-E7FD-496E7BB0E59B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 06:06:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T06:06:24.388 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T06:08:12.359 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T06:08:12.359 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T06:08:12.359 [Cloud] Queued cloud request. 2026-09-25T06:08:12.359 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T06:08:12.359 [Cloud] Dequeued cloud request. 2026-09-25T06:08:12.359 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T06:08:12.546 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E86D3E5-A0BB-C68B-986E-1A0C796ED7B3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 06:08:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T06:08:13.046 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T06:10:29.796 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T06:11:23.312 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T06:11:23.312 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T06:11:23.312 [Cloud] Queued cloud request. 2026-09-25T06:11:23.312 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T06:11:23.312 [Cloud] Dequeued cloud request. 2026-09-25T06:11:23.312 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T06:11:23.499 [Cloud] End of cloud request. 2026-09-25T06:11:23.999 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T06:25:34.801 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T06:27:30.413 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T06:27:30.413 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T06:27:30.413 [Cloud] Queued cloud request. 2026-09-25T06:27:30.413 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T06:27:30.413 [Cloud] Dequeued cloud request. 2026-09-25T06:27:30.413 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T06:27:30.600 [Cloud] End of cloud request. 2026-09-25T06:27:31.116 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T06:36:01.400 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T06:36:01.400 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T06:36:01.400 [Cloud] Queued cloud request. 2026-09-25T06:36:01.400 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T06:36:01.400 [Cloud] Dequeued cloud request. 2026-09-25T06:36:01.400 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T06:36:01.541 [Cloud] End of cloud request. 2026-09-25T06:36:02.056 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T06:40:39.810 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T06:52:33.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T06:52:33.672 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T06:52:33.672 [Cloud] Queued cloud request. 2026-09-25T06:52:33.672 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T06:52:33.672 [Cloud] Dequeued cloud request. 2026-09-25T06:52:33.672 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T06:52:33.813 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CEB4A89B-88C6-4258-345A-A66D31D3C3FC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 06:52:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T06:52:34.313 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T06:55:44.815 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T06:58:14.052 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T06:58:14.052 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T06:58:14.052 [Cloud] Queued cloud request. 2026-09-25T06:58:14.052 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T06:58:14.052 [Cloud] Dequeued cloud request. 2026-09-25T06:58:14.052 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T06:58:14.208 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F869672C-CB0A-CEFA-0A83-B0053310439F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 06:58:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T06:58:14.723 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T07:10:49.822 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T07:18:31.685 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T07:18:31.685 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T07:18:31.685 [Cloud] Queued cloud request. 2026-09-25T07:18:31.685 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T07:18:31.685 [Cloud] Dequeued cloud request. 2026-09-25T07:18:31.685 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T07:18:41.826 [Cloud] End of cloud request. 2026-09-25T07:18:42.326 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T07:22:43.544 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T07:22:43.544 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T07:22:43.544 [Cloud] Queued cloud request. 2026-09-25T07:22:43.544 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T07:22:43.544 [Cloud] Dequeued cloud request. 2026-09-25T07:22:43.544 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T07:22:43.716 [Cloud] End of cloud request. 2026-09-25T07:22:44.232 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T07:25:44.625 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T07:25:44.625 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T07:25:44.625 [Cloud] Queued cloud request. 2026-09-25T07:25:44.625 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T07:25:44.625 [Cloud] Dequeued cloud request. 2026-09-25T07:25:44.625 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T07:25:44.828 [Cloud] End of cloud request. 2026-09-25T07:25:45.328 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T07:25:54.828 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T07:39:41.615 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 31803, Count: 2078, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-25T07:39:41.615 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 7126, Count: 607, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-25T07:39:41.615 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 6506, Count: 553, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-25T07:39:41.615 ProcessImageName: powershell.exe, Pid: 4772, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 34% 2026-09-25T07:39:41.615 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 1390, Count: 268, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\Messages\D7BCBA44705C4E659EA38FA66ACDD27A.MAI, EstimatedImpact: 0% 2026-09-25T07:39:41.615 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 957, Count: 108, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\7F5005A1990545DCAF83F9B7CE14EDEE.MAI, EstimatedImpact: 8% 2026-09-25T07:39:41.615 ProcessImageName: taskhostw.exe, Pid: 4672, TotalTime: 781, Count: 2, MaxTime: 750, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 15% 2026-09-25T07:39:41.615 ProcessImageName: php.exe, Pid: 6332, TotalTime: 773, Count: 21, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-25T07:39:41.615 ProcessImageName: WmiPrvSE.exe, Pid: 6604, TotalTime: 767, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-25T07:39:41.615 ProcessImageName: AgentShellService.exe, Pid: 7784, TotalTime: 711, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-25T07:39:41.615 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 541, Count: 43, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-25T07:39:41.615 ProcessImageName: WmiPrvSE.exe, Pid: 2176, TotalTime: 316, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-25T07:39:41.615 ProcessImageName: WmiPrvSE.exe, Pid: 7876, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-25T07:39:41.615 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-25T07:39:41.615 ProcessImageName: python.exe, Pid: 1428, TotalTime: 180, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 7% 2026-09-25T07:39:41.615 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\7F134E415EE54C3AA718869E1E41C578.MAI, EstimatedImpact: 1% 2026-09-25T07:39:41.615 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-25T07:39:41.615 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-224d3-0.MAI, EstimatedImpact: 0% 2026-09-25T07:39:41.615 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-25T07:39:41.615 ProcessImageName: powershell.exe, Pid: 7568, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rafkkzgf.gfa.ps1, EstimatedImpact: 0% 2026-09-25T07:39:41.615 ProcessImageName: DeviceCensus.exe, Pid: 6936, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-25T07:39:41.615 ProcessImageName: mysqldump.exe, Pid: 7124, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-25T07:39:41.615 ProcessImageName: cmd.exe, Pid: 6784, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-25T07:39:41.615 ProcessImageName: powershell.exe, Pid: 6788, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp9A15.tmp, EstimatedImpact: 0% 2026-09-25T07:39:41.615 ProcessImageName: taskhostw.exe, Pid: 6780, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-25T07:39:41.615 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-25T07:40:59.835 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T07:56:04.840 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T08:11:09.847 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T08:26:14.853 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T08:31:24.262 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T08:31:24.262 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T08:31:24.262 [Cloud] Queued cloud request. 2026-09-25T08:31:24.262 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T08:31:24.262 [Cloud] Dequeued cloud request. 2026-09-25T08:31:24.262 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T08:31:24.419 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1621AC97-FE24-C3C2-199A-2DA6FADC0BA0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 08:31:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T08:31:24.934 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T08:31:35.918 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T08:31:35.918 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T08:31:35.918 [Cloud] Queued cloud request. 2026-09-25T08:31:35.918 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T08:31:35.918 [Cloud] Dequeued cloud request. 2026-09-25T08:31:35.918 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T08:31:35.997 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{44719128-106D-ECDC-B13C-566BCE4B2792} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 08:31:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T08:31:36.512 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T08:40:08.079 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T08:40:08.079 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T08:40:08.079 [Cloud] Queued cloud request. 2026-09-25T08:40:08.079 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T08:40:08.079 [Cloud] Dequeued cloud request. 2026-09-25T08:40:08.079 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T08:40:08.235 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{20A3FFBC-A578-D168-A250-C85644FD04D9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 08:40:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T08:40:08.735 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T08:41:19.860 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T08:56:21.772 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T08:56:21.772 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T08:56:21.772 [Cloud] Queued cloud request. 2026-09-25T08:56:21.772 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T08:56:21.772 [Cloud] Dequeued cloud request. 2026-09-25T08:56:21.772 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T08:56:21.975 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C391D6EB-6936-6666-76DA-714A60935C57} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 08:56:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T08:56:22.490 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T08:56:24.865 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T08:57:28.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T08:57:28.445 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T08:57:28.445 [Cloud] Queued cloud request. 2026-09-25T08:57:28.445 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T08:57:28.445 [Cloud] Dequeued cloud request. 2026-09-25T08:57:28.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T08:57:28.632 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ABF8B3CC-4CFA-3958-2CD1-02F5E9A14554} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 08:57:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T08:57:29.132 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:07:46.309 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T09:07:46.309 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T09:07:46.309 [Cloud] Queued cloud request. 2026-09-25T09:07:46.309 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T09:07:46.309 [Cloud] Dequeued cloud request. 2026-09-25T09:07:46.309 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T09:07:46.466 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{59207868-6959-34F2-3E40-95619098B3E2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 09:07:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T09:07:46.981 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:11:29.872 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T09:13:26.669 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T09:13:26.669 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T09:13:26.669 [Cloud] Queued cloud request. 2026-09-25T09:13:26.669 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T09:13:26.826 [Cloud] Dequeued cloud request. 2026-09-25T09:13:26.826 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T09:13:26.997 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BD70F1E7-EE75-C909-CCA3-A43C954900CD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 09:13:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T09:13:27.497 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:26:34.879 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T09:28:35.880 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T09:28:35.880 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T09:28:35.880 [Cloud] Queued cloud request. 2026-09-25T09:28:35.880 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T09:28:35.880 [Cloud] Dequeued cloud request. 2026-09-25T09:28:35.880 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T09:28:36.318 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2AEA2C89-4684-0BE5-0F32-9322AEA46A2B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 09:28:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T09:28:36.818 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:38:24.963 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T09:38:24.963 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T09:38:24.963 [Cloud] Queued cloud request. 2026-09-25T09:38:24.963 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T09:38:24.963 [Cloud] Dequeued cloud request. 2026-09-25T09:38:24.963 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T09:38:25.150 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D1436B76-5F11-FDA1-2FA0-BBEFBA3DAEE9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 09:38:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T09:38:25.650 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:39:41.682 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 32199, Count: 2099, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-25T09:39:41.682 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 9454, Count: 790, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-25T09:39:41.682 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 6506, Count: 553, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-25T09:39:41.682 ProcessImageName: powershell.exe, Pid: 4772, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 34% 2026-09-25T09:39:41.682 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 1390, Count: 268, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\Messages\D7BCBA44705C4E659EA38FA66ACDD27A.MAI, EstimatedImpact: 0% 2026-09-25T09:39:41.682 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 957, Count: 108, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\7F5005A1990545DCAF83F9B7CE14EDEE.MAI, EstimatedImpact: 8% 2026-09-25T09:39:41.682 ProcessImageName: taskhostw.exe, Pid: 4672, TotalTime: 781, Count: 2, MaxTime: 750, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 15% 2026-09-25T09:39:41.682 ProcessImageName: php.exe, Pid: 6332, TotalTime: 773, Count: 21, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-25T09:39:41.682 ProcessImageName: WmiPrvSE.exe, Pid: 6604, TotalTime: 767, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-25T09:39:41.682 ProcessImageName: AgentShellService.exe, Pid: 7784, TotalTime: 711, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-25T09:39:41.682 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 586, Count: 47, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-25T09:39:41.682 ProcessImageName: WmiPrvSE.exe, Pid: 2176, TotalTime: 316, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-25T09:39:41.682 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 210, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-25T09:39:41.682 ProcessImageName: WmiPrvSE.exe, Pid: 7876, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-25T09:39:41.682 ProcessImageName: python.exe, Pid: 1428, TotalTime: 180, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 7% 2026-09-25T09:39:41.682 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\7F134E415EE54C3AA718869E1E41C578.MAI, EstimatedImpact: 1% 2026-09-25T09:39:41.682 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-25T09:39:41.682 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-224d3-0.MAI, EstimatedImpact: 0% 2026-09-25T09:39:41.682 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-25T09:39:41.682 ProcessImageName: powershell.exe, Pid: 7568, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rafkkzgf.gfa.ps1, EstimatedImpact: 0% 2026-09-25T09:39:41.682 ProcessImageName: DeviceCensus.exe, Pid: 6936, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-25T09:39:41.682 ProcessImageName: mysqldump.exe, Pid: 7124, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-25T09:39:41.682 ProcessImageName: cmd.exe, Pid: 6784, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-25T09:39:41.682 ProcessImageName: powershell.exe, Pid: 6788, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp9A15.tmp, EstimatedImpact: 0% 2026-09-25T09:39:41.682 ProcessImageName: taskhostw.exe, Pid: 6780, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-25T09:39:41.682 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-25T09:40:50.386 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T09:40:50.386 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T09:40:50.386 [Cloud] Queued cloud request. 2026-09-25T09:40:50.386 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T09:40:50.386 [Cloud] Dequeued cloud request. 2026-09-25T09:40:50.386 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T09:40:50.542 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1A3D5E93-FC01-09E9-4A3D-2DA937112BDF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 09:40:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T09:40:51.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:41:39.886 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T09:44:23.323 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T09:44:23.323 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T09:44:23.323 [Cloud] Queued cloud request. 2026-09-25T09:44:23.323 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T09:44:23.323 [Cloud] Dequeued cloud request. 2026-09-25T09:44:23.323 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T09:44:23.479 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0FB3461F-5F37-A19D-B6DE-30C3EAA95E31} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 09:44:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T09:44:23.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:45:00.620 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T09:45:00.620 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T09:45:00.620 [Cloud] Queued cloud request. 2026-09-25T09:45:00.620 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T09:45:00.620 [Cloud] Dequeued cloud request. 2026-09-25T09:45:00.839 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T09:45:00.995 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{53872568-7AB3-C58A-4E05-6F9DCFD91A83} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 09:45:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T09:45:01.495 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:49:28.389 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T09:49:28.389 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T09:49:28.389 [Cloud] Queued cloud request. 2026-09-25T09:49:28.389 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T09:49:28.389 [Cloud] Dequeued cloud request. 2026-09-25T09:49:28.389 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T09:49:28.530 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C8DA4177-5D8B-0479-4C6F-CD728F084112} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 09:49:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T09:49:29.030 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:51:00.390 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T09:51:00.390 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T09:51:00.390 [Cloud] Queued cloud request. 2026-09-25T09:51:00.390 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T09:51:00.546 [Cloud] Dequeued cloud request. 2026-09-25T09:51:00.702 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T09:51:00.843 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{60D38AC6-06F1-36FE-3CB3-80AFA51D8197} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 09:51:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T09:51:01.343 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:53:56.171 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T09:53:56.171 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T09:53:56.171 [Cloud] Queued cloud request. 2026-09-25T09:53:56.171 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T09:53:56.171 [Cloud] Dequeued cloud request. 2026-09-25T09:53:56.171 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T09:53:56.327 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DD2B6AE1-4FA8-6E50-E620-8C466220BA64} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 09:53:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T09:53:56.827 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:54:53.906 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T09:54:53.906 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T09:54:53.906 [Cloud] Queued cloud request. 2026-09-25T09:54:53.906 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T09:54:53.906 [Cloud] Dequeued cloud request. 2026-09-25T09:54:53.906 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T09:54:53.984 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9B1CFF81-FC49-6DEB-7EE8-00F606CF3925} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 09:54:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T09:54:54.499 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:56:17.407 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T09:56:17.407 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T09:56:17.407 [Cloud] Queued cloud request. 2026-09-25T09:56:17.407 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T09:56:17.407 [Cloud] Dequeued cloud request. 2026-09-25T09:56:17.407 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T09:56:17.548 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D9189C37-227A-B2E3-C78D-3F70CC2CEC65} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 09:56:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T09:56:18.064 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T09:56:44.892 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T10:08:32.585 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T10:08:32.585 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T10:08:32.585 [Cloud] Queued cloud request. 2026-09-25T10:08:32.585 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T10:08:32.585 [Cloud] Dequeued cloud request. 2026-09-25T10:08:32.585 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T10:08:42.726 [Cloud] End of cloud request. 2026-09-25T10:08:43.226 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T10:09:30.836 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T10:09:30.836 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T10:09:30.836 [Cloud] Queued cloud request. 2026-09-25T10:09:30.836 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T10:09:30.836 [Cloud] Dequeued cloud request. 2026-09-25T10:09:30.836 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T10:09:37.007 [Cloud] End of cloud request. 2026-09-25T10:09:37.523 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T10:11:49.898 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T10:12:35.007 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T10:12:35.007 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T10:12:35.007 [Cloud] Queued cloud request. 2026-09-25T10:12:35.007 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T10:12:35.007 [Cloud] Dequeued cloud request. 2026-09-25T10:12:35.007 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T10:12:35.242 [Cloud] End of cloud request. 2026-09-25T10:12:35.742 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T10:18:59.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T10:18:59.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T10:18:59.387 [Cloud] Queued cloud request. 2026-09-25T10:18:59.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T10:18:59.387 [Cloud] Dequeued cloud request. 2026-09-25T10:18:59.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T10:19:09.527 [Cloud] End of cloud request. 2026-09-25T10:19:10.027 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T10:23:34.935 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T10:23:34.935 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T10:23:34.935 [Cloud] Queued cloud request. 2026-09-25T10:23:34.935 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T10:23:34.935 [Cloud] Dequeued cloud request. 2026-09-25T10:23:34.935 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T10:23:35.138 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EC6319A0-333B-3A7E-BFEB-B07B77CED513} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 10:23:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T10:23:35.638 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T10:26:54.904 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T10:27:35.765 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T10:27:35.765 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T10:27:35.765 [Cloud] Queued cloud request. 2026-09-25T10:27:35.765 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T10:27:35.765 [Cloud] Dequeued cloud request. 2026-09-25T10:27:35.765 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T10:27:35.952 [Cloud] End of cloud request. 2026-09-25T10:27:36.452 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T10:40:39.004 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T10:40:39.004 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T10:40:39.004 [Cloud] Queued cloud request. 2026-09-25T10:40:39.004 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T10:40:39.004 [Cloud] Dequeued cloud request. 2026-09-25T10:40:39.004 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{2635861F-19A4-D53C-3BBA-6C4649C23D28} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 10:40:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T10:40:39.176 [Cloud] End of cloud request. 2026-09-25T10:40:39.692 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T10:41:59.911 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T10:46:00.132 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T10:46:00.132 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T10:46:00.132 [Cloud] Queued cloud request. 2026-09-25T10:46:00.132 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T10:46:00.132 [Cloud] Dequeued cloud request. 2026-09-25T10:46:00.132 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T10:46:00.304 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{441E4FBF-07F0-F116-A44D-6248D6E2454D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 10:46:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T10:46:00.819 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T10:52:43.619 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T10:52:43.619 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T10:52:43.619 [Cloud] Queued cloud request. 2026-09-25T10:52:43.619 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T10:52:43.619 [Cloud] Dequeued cloud request. 2026-09-25T10:52:43.619 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T10:52:43.806 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EB1FAFA8-DD38-9AB4-53D7-DE5D3F830542} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 10:52:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T10:52:44.322 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T10:57:04.918 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T10:57:43.184 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T10:57:43.184 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T10:57:43.184 [Cloud] Queued cloud request. 2026-09-25T10:57:43.184 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T10:57:43.184 [Cloud] Dequeued cloud request. 2026-09-25T10:57:43.184 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T10:57:43.372 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EBF1D7EF-F1B3-8D82-484E-C8A76AC93070} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 10:57:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T10:57:43.872 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T11:01:48.576 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T11:01:48.576 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T11:01:48.576 [Cloud] Queued cloud request. 2026-09-25T11:01:48.576 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T11:01:48.576 [Cloud] Dequeued cloud request. 2026-09-25T11:01:48.576 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T11:01:48.764 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7A4F64D1-7B27-70BC-1C58-2865008714ED} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 11:01:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T11:01:49.279 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T11:12:09.924 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T11:12:20.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T11:12:20.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T11:12:20.049 [Cloud] Queued cloud request. 2026-09-25T11:12:20.049 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T11:12:20.049 [Cloud] Dequeued cloud request. 2026-09-25T11:12:20.049 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T11:12:20.236 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{44089A03-9FAA-0B11-DAD8-133D79551812} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 11:12:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T11:12:20.752 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T11:27:14.931 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T11:28:39.229 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T11:28:39.229 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T11:28:39.229 [Cloud] Queued cloud request. 2026-09-25T11:28:39.229 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T11:28:39.229 [Cloud] Dequeued cloud request. 2026-09-25T11:28:39.229 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T11:28:39.479 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2C895D55-CF3D-4D7B-98FB-B2476A24AFDA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 11:28:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T11:28:39.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T11:39:41.749 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 32687, Count: 2135, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-25T11:39:41.749 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 11589, Count: 969, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-25T11:39:41.749 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 6506, Count: 553, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-25T11:39:41.749 ProcessImageName: powershell.exe, Pid: 4772, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 34% 2026-09-25T11:39:41.749 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 1390, Count: 268, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\Messages\D7BCBA44705C4E659EA38FA66ACDD27A.MAI, EstimatedImpact: 0% 2026-09-25T11:39:41.749 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 957, Count: 108, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\7F5005A1990545DCAF83F9B7CE14EDEE.MAI, EstimatedImpact: 8% 2026-09-25T11:39:41.749 ProcessImageName: taskhostw.exe, Pid: 4672, TotalTime: 781, Count: 2, MaxTime: 750, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 15% 2026-09-25T11:39:41.749 ProcessImageName: php.exe, Pid: 6332, TotalTime: 773, Count: 21, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-25T11:39:41.749 ProcessImageName: WmiPrvSE.exe, Pid: 6604, TotalTime: 767, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-25T11:39:41.749 ProcessImageName: AgentShellService.exe, Pid: 7784, TotalTime: 711, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-25T11:39:41.749 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 616, Count: 49, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-25T11:39:41.749 ProcessImageName: WmiPrvSE.exe, Pid: 2176, TotalTime: 316, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-25T11:39:41.749 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 240, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-25T11:39:41.749 ProcessImageName: WmiPrvSE.exe, Pid: 7876, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-25T11:39:41.749 ProcessImageName: python.exe, Pid: 1428, TotalTime: 180, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 7% 2026-09-25T11:39:41.749 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\7F134E415EE54C3AA718869E1E41C578.MAI, EstimatedImpact: 1% 2026-09-25T11:39:41.749 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-25T11:39:41.749 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-224d3-0.MAI, EstimatedImpact: 0% 2026-09-25T11:39:41.749 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-25T11:39:41.749 ProcessImageName: powershell.exe, Pid: 7568, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rafkkzgf.gfa.ps1, EstimatedImpact: 0% 2026-09-25T11:39:41.749 ProcessImageName: DeviceCensus.exe, Pid: 6936, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-25T11:39:41.749 ProcessImageName: mysqldump.exe, Pid: 7124, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-25T11:39:41.749 ProcessImageName: cmd.exe, Pid: 6784, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-25T11:39:41.749 ProcessImageName: powershell.exe, Pid: 6788, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp9A15.tmp, EstimatedImpact: 0% 2026-09-25T11:39:41.749 ProcessImageName: taskhostw.exe, Pid: 6780, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-25T11:39:41.749 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-25T11:42:19.937 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T11:57:24.944 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T11:59:31.024 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T11:59:31.024 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T11:59:31.024 [Cloud] Queued cloud request. 2026-09-25T11:59:31.024 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T11:59:31.024 [Cloud] Dequeued cloud request. 2026-09-25T11:59:31.024 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T11:59:31.305 [Cloud] End of cloud request. 2026-09-25T11:59:31.805 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T12:03:39.289 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T12:03:39.289 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T12:03:39.289 [Cloud] Queued cloud request. 2026-09-25T12:03:39.289 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T12:03:39.289 [Cloud] Dequeued cloud request. 2026-09-25T12:03:39.289 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T12:03:39.477 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{03BEA149-B8F0-273F-3F80-09DECBEC97DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 12:03:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T12:03:39.977 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T12:04:19.508 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T12:04:19.508 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T12:04:19.508 [Cloud] Queued cloud request. 2026-09-25T12:04:19.508 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T12:04:19.508 [Cloud] Dequeued cloud request. 2026-09-25T12:04:19.508 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T12:04:19.617 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{20E1965F-DF91-0F3D-043E-69ADC8D29D1E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 12:04:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T12:04:20.117 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T12:07:43.355 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T12:07:43.355 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T12:07:43.355 [Cloud] Queued cloud request. 2026-09-25T12:07:43.355 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T12:07:43.355 [Cloud] Dequeued cloud request. 2026-09-25T12:07:43.355 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T12:07:43.559 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{96E5EFF0-2F07-EF1B-A45A-5122272C37B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 12:07:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T12:07:44.074 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T12:12:29.951 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T12:14:31.358 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T12:14:31.358 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T12:14:31.358 [Cloud] Queued cloud request. 2026-09-25T12:14:31.358 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T12:14:31.358 [Cloud] Dequeued cloud request. 2026-09-25T12:14:31.358 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T12:14:31.593 [Cloud] End of cloud request. 2026-09-25T12:14:32.108 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T12:17:00.374 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T12:17:00.374 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T12:17:00.374 [Cloud] Queued cloud request. 2026-09-25T12:17:00.374 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T12:17:00.578 [Cloud] Dequeued cloud request. 2026-09-25T12:17:00.578 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T12:17:03.078 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E64E2C7-64B2-D2B3-8157-B7706E084E5E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 12:17:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T12:17:03.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T12:17:32.016 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T12:17:32.016 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T12:17:32.016 [Cloud] Queued cloud request. 2026-09-25T12:17:32.016 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T12:17:32.016 [Cloud] Dequeued cloud request. 2026-09-25T12:17:32.016 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T12:17:32.156 [Cloud] End of cloud request. 2026-09-25T12:17:32.656 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T12:22:28.032 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T12:22:28.032 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T12:22:28.032 [Cloud] Queued cloud request. 2026-09-25T12:22:28.032 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T12:22:28.032 [Cloud] Dequeued cloud request. 2026-09-25T12:22:28.032 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T12:22:28.314 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{64FCA10A-DAB0-20C3-885F-83B3D78B2C32} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 12:22:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T12:22:28.814 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T12:23:26.282 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T12:23:26.282 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T12:23:26.282 [Cloud] Queued cloud request. 2026-09-25T12:23:26.282 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T12:23:26.282 [Cloud] Dequeued cloud request. 2026-09-25T12:23:26.282 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T12:23:26.392 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{90C4A716-5795-9F38-DB52-5466FD3D0F2B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 12:23:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T12:23:26.892 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T12:27:34.958 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T12:40:49.651 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T12:40:49.651 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T12:40:49.651 [Cloud] Queued cloud request. 2026-09-25T12:40:49.651 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T12:40:49.823 [Cloud] Dequeued cloud request. 2026-09-25T12:40:49.995 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T12:40:50.432 [Cloud] End of cloud request. 2026-09-25T12:40:50.948 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T12:42:39.963 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T12:47:56.201 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T12:47:56.201 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T12:47:56.201 [Cloud] Queued cloud request. 2026-09-25T12:47:56.201 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T12:47:56.201 [Cloud] Dequeued cloud request. 2026-09-25T12:47:56.201 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T12:47:56.389 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{302E97BF-A4B0-9DA2-DFF9-0BD9AF58803E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 12:47:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T12:47:56.889 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T12:50:21.452 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T12:50:21.452 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T12:50:21.452 [Cloud] Queued cloud request. 2026-09-25T12:50:21.452 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T12:50:21.452 [Cloud] Dequeued cloud request. 2026-09-25T12:50:21.452 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T12:50:21.639 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1626A802-2F6D-421B-1D1F-D6AD69DC5929} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 12:50:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T12:50:22.155 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T12:57:44.971 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T12:58:19.440 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T12:58:19.440 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T12:58:19.440 [Cloud] Queued cloud request. 2026-09-25T12:58:19.440 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T12:58:19.440 [Cloud] Dequeued cloud request. 2026-09-25T12:58:19.440 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T12:58:23.471 [Cloud] End of cloud request. 2026-09-25T12:58:23.987 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:04:08.410 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T13:04:08.410 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T13:04:08.410 [Cloud] Queued cloud request. 2026-09-25T13:04:08.410 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T13:04:08.410 [Cloud] Dequeued cloud request. 2026-09-25T13:04:08.410 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T13:04:08.597 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0607372A-7C8E-E7E2-E8F1-430960A14660} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 13:04:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T13:04:09.113 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:04:57.472 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T13:04:57.472 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T13:04:57.472 [Cloud] Queued cloud request. 2026-09-25T13:04:57.472 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T13:04:57.472 [Cloud] Dequeued cloud request. 2026-09-25T13:04:57.472 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T13:04:57.550 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D9BA140B-B1E7-C5F1-6874-6F82DB746D90} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 13:04:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T13:04:58.066 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:08:26.585 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T13:08:26.585 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T13:08:26.585 [Cloud] Queued cloud request. 2026-09-25T13:08:26.585 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T13:08:26.585 [Cloud] Dequeued cloud request. 2026-09-25T13:08:26.585 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T13:08:26.772 [Cloud] End of cloud request. 2026-09-25T13:08:27.272 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:08:38.569 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23494-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3295690, FileId: 0x2800000003b0fc, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T13:08:38.569 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23494-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3295689, FileId: 0x2500000003b105, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T13:08:43.069 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23498-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3295720, FileId: 0x2900000003b0fc, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T13:08:43.069 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23498-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3295719, FileId: 0x2600000003b105, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T13:08:54.835 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T13:08:54.835 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T13:08:54.835 [Cloud] Queued cloud request. 2026-09-25T13:08:54.835 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T13:08:54.835 [Cloud] Dequeued cloud request. 2026-09-25T13:08:55.022 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T13:08:55.101 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3A07CFFF-E65F-F805-C0D9-F85092BA654E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 13:08:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T13:08:55.616 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:11:27.772 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T13:11:27.772 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T13:11:27.772 [Cloud] Queued cloud request. 2026-09-25T13:11:27.772 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T13:11:27.772 [Cloud] Dequeued cloud request. 2026-09-25T13:11:27.772 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T13:11:27.913 [Cloud] End of cloud request. 2026-09-25T13:11:28.429 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:12:49.977 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T13:27:01.388 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T13:27:01.388 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T13:27:01.388 [Cloud] Queued cloud request. 2026-09-25T13:27:01.388 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T13:27:01.388 [Cloud] Dequeued cloud request. 2026-09-25T13:27:01.388 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T13:27:01.575 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3AF75347-3BA8-4E5C-D433-51D0821AA228} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 13:27:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T13:27:02.091 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:27:54.984 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T13:29:29.579 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T13:29:29.579 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T13:29:29.579 [Cloud] Queued cloud request. 2026-09-25T13:29:29.579 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T13:29:29.579 [Cloud] Dequeued cloud request. 2026-09-25T13:29:29.579 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T13:29:29.954 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FC56F2AA-A63E-DB1A-AA2C-6BC768386AF6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 13:29:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T13:29:30.469 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:38:09.520 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T13:38:09.520 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T13:38:09.520 [Cloud] Queued cloud request. 2026-09-25T13:38:09.520 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T13:38:09.520 [Cloud] Dequeued cloud request. 2026-09-25T13:38:09.520 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T13:38:09.879 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AE2C1E0E-67EA-2691-A014-5EA424DE9299} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 13:38:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T13:38:10.395 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:39:40.786 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T13:39:40.786 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T13:39:40.786 [Cloud] Queued cloud request. 2026-09-25T13:39:40.786 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T13:39:40.786 [Cloud] Dequeued cloud request. 2026-09-25T13:39:40.786 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T13:39:41.067 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D76F53B0-7A14-0D39-D200-25886DD71A24} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 13:39:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T13:39:41.567 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:39:41.817 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 36210, Count: 2429, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-25T13:39:41.817 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 13868, Count: 1139, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-25T13:39:41.817 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 6506, Count: 553, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-25T13:39:41.817 ProcessImageName: powershell.exe, Pid: 4772, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 34% 2026-09-25T13:39:41.817 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 1390, Count: 268, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\Messages\D7BCBA44705C4E659EA38FA66ACDD27A.MAI, EstimatedImpact: 0% 2026-09-25T13:39:41.817 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 957, Count: 108, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\7F5005A1990545DCAF83F9B7CE14EDEE.MAI, EstimatedImpact: 8% 2026-09-25T13:39:41.817 ProcessImageName: taskhostw.exe, Pid: 4672, TotalTime: 781, Count: 2, MaxTime: 750, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 15% 2026-09-25T13:39:41.817 ProcessImageName: php.exe, Pid: 6332, TotalTime: 773, Count: 21, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-25T13:39:41.817 ProcessImageName: WmiPrvSE.exe, Pid: 6604, TotalTime: 767, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-25T13:39:41.817 ProcessImageName: AgentShellService.exe, Pid: 7784, TotalTime: 711, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-25T13:39:41.817 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 646, Count: 51, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-25T13:39:41.817 ProcessImageName: WmiPrvSE.exe, Pid: 2176, TotalTime: 316, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-25T13:39:41.817 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 255, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-25T13:39:41.817 ProcessImageName: WmiPrvSE.exe, Pid: 7876, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-25T13:39:41.817 ProcessImageName: python.exe, Pid: 1428, TotalTime: 180, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 7% 2026-09-25T13:39:41.817 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\7F134E415EE54C3AA718869E1E41C578.MAI, EstimatedImpact: 1% 2026-09-25T13:39:41.817 ProcessImageName: upfc.exe, Pid: 4180, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml, EstimatedImpact: 96% 2026-09-25T13:39:41.817 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-25T13:39:41.817 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-224d3-0.MAI, EstimatedImpact: 0% 2026-09-25T13:39:41.817 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-25T13:39:41.817 ProcessImageName: powershell.exe, Pid: 7568, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rafkkzgf.gfa.ps1, EstimatedImpact: 0% 2026-09-25T13:39:41.817 ProcessImageName: DeviceCensus.exe, Pid: 6936, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-25T13:39:41.817 ProcessImageName: mysqldump.exe, Pid: 7124, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-25T13:39:41.817 ProcessImageName: cmd.exe, Pid: 6784, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-25T13:39:41.817 ProcessImageName: powershell.exe, Pid: 6788, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp9A15.tmp, EstimatedImpact: 0% 2026-09-25T13:39:41.817 ProcessImageName: taskhostw.exe, Pid: 6780, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-25T13:39:41.817 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-25T13:42:02.412 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T13:42:02.412 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T13:42:02.412 [Cloud] Queued cloud request. 2026-09-25T13:42:02.412 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T13:42:02.412 [Cloud] Dequeued cloud request. 2026-09-25T13:42:02.412 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T13:42:12.506 [Cloud] End of cloud request. 2026-09-25T13:42:13.021 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:42:30.912 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T13:42:30.912 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T13:42:30.912 [Cloud] Queued cloud request. 2026-09-25T13:42:30.912 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T13:42:30.912 [Cloud] Dequeued cloud request. 2026-09-25T13:42:30.912 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T13:42:40.927 [Cloud] End of cloud request. 2026-09-25T13:42:41.443 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:42:59.990 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T13:48:16.197 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T13:48:16.197 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T13:48:16.197 [Cloud] Queued cloud request. 2026-09-25T13:48:16.197 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T13:48:16.197 [Cloud] Dequeued cloud request. 2026-09-25T13:48:16.197 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T13:48:16.353 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B593B543-FE8C-5B06-832A-CBE4C6B0C1D3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 13:48:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T13:48:16.869 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T13:58:04.998 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T14:06:28.282 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:06:28.282 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:06:28.282 [Cloud] Queued cloud request. 2026-09-25T14:06:28.282 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:06:28.282 [Cloud] Dequeued cloud request. 2026-09-25T14:06:28.282 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:06:28.438 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9E8C11A3-5B3A-BB4E-AF9A-508FE88B8FF1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 14:06:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T14:06:28.938 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:07:39.830 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:07:39.830 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:07:39.830 [Cloud] Queued cloud request. 2026-09-25T14:07:39.830 [Cloud] Dequeued cloud request. 2026-09-25T14:07:39.830 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:07:39.830 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:07:39.986 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{679C9802-B608-6BB4-317B-A06D58AA07DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 14:07:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T14:07:40.502 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:09:07.862 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:09:07.862 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:09:07.862 [Cloud] Queued cloud request. 2026-09-25T14:09:07.862 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:09:07.862 [Cloud] Dequeued cloud request. 2026-09-25T14:09:07.862 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:09:08.018 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{96C9C85F-4C0E-D288-EAC1-8CEE13511E40} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 14:09:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T14:09:08.518 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:12:03.081 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:12:03.081 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:12:03.081 [Cloud] Queued cloud request. 2026-09-25T14:12:03.081 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:12:03.081 [Cloud] Dequeued cloud request. 2026-09-25T14:12:03.081 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:12:03.456 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ECB79045-E377-C313-CF3C-E4B2FE9025CA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 14:12:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T14:12:03.956 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:13:10.003 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T14:24:27.601 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:24:27.601 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:24:27.601 [Cloud] Queued cloud request. 2026-09-25T14:24:27.601 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:24:27.601 [Cloud] Dequeued cloud request. 2026-09-25T14:24:27.601 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:24:27.789 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E67AE987-EE0B-E718-1E9A-03B80CEC198B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 14:24:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T14:24:28.304 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:28:15.011 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T14:29:27.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:29:27.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:29:27.387 [Cloud] Queued cloud request. 2026-09-25T14:29:27.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:29:27.387 [Cloud] Dequeued cloud request. 2026-09-25T14:29:27.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:29:27.574 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{429F6EB1-ABB0-D8F6-EAE9-E3B319E9248A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 14:29:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T14:29:28.090 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:30:21.965 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:30:21.965 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:30:21.965 [Cloud] Queued cloud request. 2026-09-25T14:30:21.965 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:30:21.965 [Cloud] Dequeued cloud request. 2026-09-25T14:30:21.965 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:30:31.996 [Cloud] End of cloud request. 2026-09-25T14:30:32.496 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:34:45.121 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:34:45.121 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:34:45.121 [Cloud] Queued cloud request. 2026-09-25T14:34:45.121 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:34:45.121 [Cloud] Dequeued cloud request. 2026-09-25T14:34:45.121 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:34:45.309 [Cloud] End of cloud request. 2026-09-25T14:34:45.809 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:38:19.563 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:38:19.563 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:38:19.563 [Cloud] Queued cloud request. 2026-09-25T14:38:19.563 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:38:19.563 [Cloud] Dequeued cloud request. 2026-09-25T14:38:19.563 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:38:19.750 [Cloud] End of cloud request. 2026-09-25T14:38:20.250 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:39:11.172 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:39:11.172 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:39:11.172 [Cloud] Queued cloud request. 2026-09-25T14:39:11.172 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:39:11.172 [Cloud] Dequeued cloud request. 2026-09-25T14:39:11.172 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:39:11.266 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AA5BFDD9-C5BA-9FB3-7A48-B01DFA28A195} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 14:39:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T14:39:11.781 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:39:25.219 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:39:25.219 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:39:25.219 [Cloud] Queued cloud request. 2026-09-25T14:39:25.219 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:39:25.219 [Cloud] Dequeued cloud request. 2026-09-25T14:39:25.219 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:39:25.297 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06B65A9C-681E-B73B-C88D-2997B701A042} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 14:39:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T14:39:25.797 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:40:28.454 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:40:28.454 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:40:28.454 [Cloud] Queued cloud request. 2026-09-25T14:40:28.454 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:40:28.454 [Cloud] Dequeued cloud request. 2026-09-25T14:40:28.454 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:40:28.642 [Cloud] End of cloud request. 2026-09-25T14:40:29.142 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:43:20.017 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T14:45:09.767 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:45:09.767 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:45:09.767 [Cloud] Queued cloud request. 2026-09-25T14:45:09.767 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:45:09.767 [Cloud] Dequeued cloud request. 2026-09-25T14:45:09.767 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:45:09.954 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F90A9FBD-47FF-FA86-FA8B-D74CE7470B55} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 14:45:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T14:45:10.454 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:46:14.628 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:46:14.628 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:46:14.628 [Cloud] Queued cloud request. 2026-09-25T14:46:14.628 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:46:14.628 [Cloud] Dequeued cloud request. 2026-09-25T14:46:14.628 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:46:14.799 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AC860D2A-A51E-611C-D977-22A18B0425AC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 14:46:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T14:46:15.299 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:49:11.005 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:49:11.005 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:49:11.005 [Cloud] Queued cloud request. 2026-09-25T14:49:11.005 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:49:11.005 [Cloud] Dequeued cloud request. 2026-09-25T14:49:11.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:49:11.146 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{56D74CCA-E5F1-2D0E-4BEE-3600EDA488BF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 14:49:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T14:49:11.661 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:53:31.365 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T14:53:31.365 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T14:53:31.365 [Cloud] Queued cloud request. 2026-09-25T14:53:31.365 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T14:53:31.365 [Cloud] Dequeued cloud request. 2026-09-25T14:53:31.365 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T14:53:31.521 [Cloud] End of cloud request. 2026-09-25T14:53:32.036 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T14:58:25.025 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T15:10:04.639 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T15:10:04.639 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T15:10:04.639 [Cloud] Queued cloud request. 2026-09-25T15:10:04.639 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T15:10:04.639 [Cloud] Dequeued cloud request. 2026-09-25T15:10:04.639 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T15:10:04.827 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{41AC4436-C555-B415-2D45-0C54BAE1D477} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 15:10:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T15:10:05.327 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T15:13:30.030 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T15:20:35.769 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T15:20:35.769 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T15:20:35.769 [Cloud] Queued cloud request. 2026-09-25T15:20:35.769 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T15:20:35.769 [Cloud] Dequeued cloud request. 2026-09-25T15:20:35.769 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T15:20:35.925 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5ABC8C1F-A15F-DE49-5B77-272A0B751EB6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 15:20:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T15:20:36.441 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T15:23:39.785 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T15:23:39.785 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T15:23:39.785 [Cloud] Queued cloud request. 2026-09-25T15:23:39.785 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T15:23:39.785 [Cloud] Dequeued cloud request. 2026-09-25T15:23:39.785 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T15:23:40.035 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E6A9AF65-2E71-8613-2D66-5DA4A58D6877} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 15:23:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T15:23:40.535 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T15:27:56.788 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-233b5-3a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3341905, FileId: 0xc00000000d31a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:27:56.788 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-233b5-3a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3341904, FileId: 0x2600000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:27:57.538 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-233b5-3b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3341925, FileId: 0xd00000000d31a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:27:57.538 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-233b5-3b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3341924, FileId: 0x2700000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:28:35.038 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T15:30:51.600 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-b5.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3342888, FileId: 0x20000000036dd3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:30:51.600 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-b5.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3342887, FileId: 0x2800000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:30:51.616 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-b6.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3342892, FileId: 0x21000000036dd3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:30:51.616 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-b6.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3342891, FileId: 0x2900000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:33:00.881 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-10f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3343601, FileId: 0x21000000036eef, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:33:00.881 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-10f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3343600, FileId: 0x2a00000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:33:00.881 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-110.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3343605, FileId: 0x22000000036eef, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:33:00.881 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-110.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3343604, FileId: 0x2b00000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:33:03.616 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-11b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3343627, FileId: 0x23000000036eef, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:33:03.616 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-11b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3343626, FileId: 0x2c00000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:33:49.366 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-12d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3343886, FileId: 0x2600000003af58, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:33:49.366 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-12d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3343885, FileId: 0x2d00000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:33:49.382 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-12e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3343889, FileId: 0x2e00000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:33:49.382 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2344f-12e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3343890, FileId: 0x2700000003af58, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:34:40.773 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-3b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344179, FileId: 0x2800000003af58, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:34:40.773 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-3b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344178, FileId: 0x2f00000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:34:40.789 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-3c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344182, FileId: 0x3000000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:34:40.789 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-3c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344183, FileId: 0x2900000003af58, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:35:11.023 [RTP] [Mini-filter] Unsuccessful scan status(#28): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-5a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344345, FileId: 0x2a00000003af58, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:35:11.023 [RTP] [Mini-filter] Unsuccessful scan status(#27): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-5a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344344, FileId: 0x3100000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:35:11.039 [RTP] [Mini-filter] Unsuccessful scan status(#29): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-5b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344348, FileId: 0x3200000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:35:11.039 [RTP] [Mini-filter] Unsuccessful scan status(#30): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-5b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344349, FileId: 0x2b00000003af58, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:35:12.570 [RTP] [Mini-filter] Unsuccessful scan status(#32): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-66.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344363, FileId: 0x2c00000003af58, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:35:12.570 [RTP] [Mini-filter] Unsuccessful scan status(#31): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-66.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344362, FileId: 0x3300000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:35:16.726 [RTP] [Mini-filter] Unsuccessful scan status(#33): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-72.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344396, FileId: 0x3400000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:35:16.726 [RTP] [Mini-filter] Unsuccessful scan status(#34): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-72.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344397, FileId: 0x2d00000003af58, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:36:17.024 [RTP] [Mini-filter] Unsuccessful scan status(#36): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-c2.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344757, FileId: 0x3200000003af58, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:36:17.024 [RTP] [Mini-filter] Unsuccessful scan status(#35): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-c2.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344756, FileId: 0x3900000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:36:17.055 [RTP] [Mini-filter] Unsuccessful scan status(#38): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-c3.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344761, FileId: 0x3300000003af58, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:36:17.055 [RTP] [Mini-filter] Unsuccessful scan status(#37): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2343d-c3.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344760, FileId: 0x3a00000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:36:28.664 [RTP] [Mini-filter] Unsuccessful scan status(#39): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-233b5-60.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344832, FileId: 0x3b00000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:36:28.664 [RTP] [Mini-filter] Unsuccessful scan status(#40): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-233b5-60.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3344833, FileId: 0x3400000003af58, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:39:41.871 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 49918, Count: 3606, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-25T15:39:41.871 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 15974, Count: 1317, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-25T15:39:41.871 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 6506, Count: 553, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-25T15:39:41.871 ProcessImageName: powershell.exe, Pid: 4772, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 34% 2026-09-25T15:39:41.871 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 1390, Count: 268, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\Messages\D7BCBA44705C4E659EA38FA66ACDD27A.MAI, EstimatedImpact: 0% 2026-09-25T15:39:41.871 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 957, Count: 108, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\7F5005A1990545DCAF83F9B7CE14EDEE.MAI, EstimatedImpact: 8% 2026-09-25T15:39:41.871 ProcessImageName: taskhostw.exe, Pid: 4672, TotalTime: 781, Count: 2, MaxTime: 750, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 15% 2026-09-25T15:39:41.871 ProcessImageName: php.exe, Pid: 6332, TotalTime: 773, Count: 21, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-25T15:39:41.871 ProcessImageName: WmiPrvSE.exe, Pid: 6604, TotalTime: 767, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-25T15:39:41.871 ProcessImageName: AgentShellService.exe, Pid: 7784, TotalTime: 711, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-25T15:39:41.871 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 676, Count: 55, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-25T15:39:41.871 ProcessImageName: WmiPrvSE.exe, Pid: 2176, TotalTime: 316, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-25T15:39:41.871 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 285, Count: 19, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-25T15:39:41.871 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 270, Count: 102, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-224d3-0.MAI, EstimatedImpact: 0% 2026-09-25T15:39:41.871 ProcessImageName: WmiPrvSE.exe, Pid: 7876, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-25T15:39:41.871 ProcessImageName: python.exe, Pid: 1428, TotalTime: 180, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 7% 2026-09-25T15:39:41.871 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\7F134E415EE54C3AA718869E1E41C578.MAI, EstimatedImpact: 1% 2026-09-25T15:39:41.871 ProcessImageName: upfc.exe, Pid: 4180, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml, EstimatedImpact: 96% 2026-09-25T15:39:41.871 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-25T15:39:41.871 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-25T15:39:41.871 ProcessImageName: powershell.exe, Pid: 7568, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rafkkzgf.gfa.ps1, EstimatedImpact: 0% 2026-09-25T15:39:41.871 ProcessImageName: DeviceCensus.exe, Pid: 6936, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-25T15:39:41.871 ProcessImageName: mysqldump.exe, Pid: 7124, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-25T15:39:41.871 ProcessImageName: cmd.exe, Pid: 6784, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-25T15:39:41.871 ProcessImageName: powershell.exe, Pid: 6788, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp9A15.tmp, EstimatedImpact: 0% 2026-09-25T15:39:41.871 ProcessImageName: taskhostw.exe, Pid: 6780, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-25T15:39:41.871 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-25T15:43:40.043 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{A21D4C7D-A14E-145F-EAFD-0AFBFD2831A7} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-25-2026 15:44:59 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T15:45:00.215 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T15:45:00.215 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T15:45:00.215 [Cloud] Queued cloud request. 2026-09-25T15:45:00.215 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T15:45:00.215 [Cloud] Dequeued cloud request. 2026-09-25T15:45:00.215 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T15:45:00.402 [Cloud] End of cloud request. 2026-09-25T15:45:00.918 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T15:45:29.919 [RTP] [Mini-filter] Unsuccessful scan status(#41): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_n1xakfdm.z1z.psm1. Process: \Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3347962, FileId: 0x4300000003b32e, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:45:35.247 [RTP] [Mini-filter] Unsuccessful scan status(#42): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_zgtzehlg.a4u.psm1. Process: \Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3348012, FileId: 0x2800000003b335, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:45:38.372 [RTP] [Mini-filter] Unsuccessful scan status(#43): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_bujymdvy.2ax.psm1. Process: \Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3348031, FileId: 0x2900000003b335, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:46:07.795 [RTP] [Mini-filter] Unsuccessful scan status(#44): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_i0hest30.erj.psm1. Process: \Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3348204, FileId: 0x2c00000003b335, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:46:10.529 [RTP] [Mini-filter] Unsuccessful scan status(#45): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_5gd3vuhh.elh.psm1. Process: \Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3348222, FileId: 0x2d00000003b335, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:46:12.123 [RTP] [Mini-filter] Unsuccessful scan status(#46): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_q15cibna.drv.psm1. Process: \Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3348240, FileId: 0x2e00000003b335, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:46:15.029 [RTP] [Mini-filter] Unsuccessful scan status(#47): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_3gj0r41d.rc2.psm1. Process: \Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3348261, FileId: 0x2f00000003b335, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:46:24.061 [RTP] [Mini-filter] Unsuccessful scan status(#48): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_ifm1qdjo.0bt.psm1. Process: \Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3348324, FileId: 0x3200000003b335, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T15:53:59.829 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T15:53:59.829 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T15:53:59.829 [Cloud] Queued cloud request. 2026-09-25T15:53:59.829 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T15:53:59.829 [Cloud] Dequeued cloud request. 2026-09-25T15:53:59.829 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{487EA495-F97D-4A5A-F731-834F89B13489} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 15:54:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T15:54:00.016 [Cloud] End of cloud request. 2026-09-25T15:54:00.516 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T15:58:21.676 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T15:58:21.676 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T15:58:21.676 [Cloud] Queued cloud request. 2026-09-25T15:58:21.676 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T15:58:21.676 [Cloud] Dequeued cloud request. 2026-09-25T15:58:21.676 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T15:58:21.817 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EF65C0B7-3A95-B338-59B4-78255ABFA2F1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 15:58:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T15:58:22.332 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T15:58:45.051 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T16:08:41.493 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:08:41.493 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:08:41.493 [Cloud] Queued cloud request. 2026-09-25T16:08:41.493 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:08:41.493 [Cloud] Dequeued cloud request. 2026-09-25T16:08:41.493 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:08:41.681 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5F12029B-0B17-C711-64A0-70674A1DDA95} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 16:08:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T16:08:42.196 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:13:50.056 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T16:15:14.151 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:15:14.151 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:15:14.151 [Cloud] Queued cloud request. 2026-09-25T16:15:14.151 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:15:14.151 [Cloud] Dequeued cloud request. 2026-09-25T16:15:14.151 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:15:14.338 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5F5A58C4-2823-6FB9-EE07-A044BEFC7330} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 16:15:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T16:15:14.838 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:16:08.621 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:16:08.621 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:16:08.621 [Cloud] Queued cloud request. 2026-09-25T16:16:08.621 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:16:08.621 [Cloud] Dequeued cloud request. 2026-09-25T16:16:08.621 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:16:18.652 [Cloud] End of cloud request. 2026-09-25T16:16:19.168 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:19:22.263 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:19:22.263 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:19:22.263 [Cloud] Queued cloud request. 2026-09-25T16:19:22.263 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:19:22.263 [Cloud] Dequeued cloud request. 2026-09-25T16:19:22.263 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:19:22.451 [Cloud] End of cloud request. 2026-09-25T16:19:22.967 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:19:51.295 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:19:51.295 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:19:51.295 [Cloud] Queued cloud request. 2026-09-25T16:19:51.295 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:19:51.295 [Cloud] Dequeued cloud request. 2026-09-25T16:19:51.295 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:19:51.373 [Cloud] End of cloud request. 2026-09-25T16:19:51.873 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:20:31.389 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:20:31.389 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:20:31.389 [Cloud] Queued cloud request. 2026-09-25T16:20:31.389 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:20:31.389 [Cloud] Dequeued cloud request. 2026-09-25T16:20:31.389 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:20:31.467 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7876A0DD-5587-230A-784D-063527F5345E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 16:20:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T16:20:31.967 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:26:54.079 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:26:54.079 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:26:54.079 [Cloud] Queued cloud request. 2026-09-25T16:26:54.079 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:26:54.079 [Cloud] Dequeued cloud request. 2026-09-25T16:26:54.079 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:26:54.266 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3BA665FD-3A63-B707-F742-298558E3F046} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 16:26:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T16:26:54.766 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:28:01.220 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:28:01.220 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:28:01.220 [Cloud] Queued cloud request. 2026-09-25T16:28:01.220 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:28:01.220 [Cloud] Dequeued cloud request. 2026-09-25T16:28:01.220 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:28:01.408 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{36631E2F-0B1C-1CFB-9575-6E72DF3D764F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 16:28:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T16:28:01.908 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:28:33.580 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:28:33.580 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:28:33.580 [Cloud] Queued cloud request. 2026-09-25T16:28:33.580 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:28:33.580 [Cloud] Dequeued cloud request. 2026-09-25T16:28:33.580 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:28:33.658 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6A8779E6-8377-5381-E280-8F62B7007F26} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 16:28:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T16:28:34.158 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:28:55.064 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T16:34:33.284 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:34:33.284 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:34:33.284 [Cloud] Queued cloud request. 2026-09-25T16:34:33.284 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:34:33.284 [Cloud] Dequeued cloud request. 2026-09-25T16:34:33.284 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:34:33.471 [Cloud] End of cloud request. 2026-09-25T16:34:33.971 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:36:23.317 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:36:23.317 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:36:23.317 [Cloud] Queued cloud request. 2026-09-25T16:36:23.317 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:36:23.317 [Cloud] Dequeued cloud request. 2026-09-25T16:36:23.317 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:36:23.927 [Cloud] End of cloud request. 2026-09-25T16:36:24.442 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:39:31.225 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:39:31.225 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:39:31.225 [Cloud] Queued cloud request. 2026-09-25T16:39:31.225 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:39:31.225 [Cloud] Dequeued cloud request. 2026-09-25T16:39:31.225 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:39:31.413 [Cloud] End of cloud request. 2026-09-25T16:39:31.913 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:44:00.070 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T16:54:33.418 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T16:54:33.418 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T16:54:33.418 [Cloud] Queued cloud request. 2026-09-25T16:54:33.418 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T16:54:33.418 [Cloud] Dequeued cloud request. 2026-09-25T16:54:33.418 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T16:54:33.605 [Cloud] End of cloud request. 2026-09-25T16:54:34.121 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T16:57:24.310 [RTP] [Mini-filter] Unsuccessful scan status(#50): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-234f8-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3372142, FileId: 0x2600000003ac25, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T16:57:24.310 [RTP] [Mini-filter] Unsuccessful scan status(#49): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-234f8-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3372141, FileId: 0x2600000003b94f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-25T16:59:05.077 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T17:05:14.891 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T17:05:14.891 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T17:05:14.891 [Cloud] Queued cloud request. 2026-09-25T17:05:14.891 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T17:05:14.891 [Cloud] Dequeued cloud request. 2026-09-25T17:05:14.891 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T17:05:15.094 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{47C1968F-6FE3-6A2D-AE8C-38583E08B932} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 17:05:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T17:05:15.594 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T17:05:50.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T17:05:50.657 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T17:05:50.657 [Cloud] Queued cloud request. 2026-09-25T17:05:50.657 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T17:05:50.657 [Cloud] Dequeued cloud request. 2026-09-25T17:05:50.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T17:05:50.751 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2782D3E4-B4DB-56B8-C86C-E074EA2A96CC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 17:05:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T17:05:51.266 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T17:14:10.083 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T17:18:04.305 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T17:18:04.305 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T17:18:04.305 [Cloud] Queued cloud request. 2026-09-25T17:18:04.305 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T17:18:04.305 [Cloud] Dequeued cloud request. 2026-09-25T17:18:04.305 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T17:18:04.493 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EE8A88DC-6526-6E47-ADEC-0E56DA8002ED} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 17:18:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T17:18:04.993 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T17:19:40.696 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T17:19:40.696 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T17:19:40.696 [Cloud] Queued cloud request. 2026-09-25T17:19:40.696 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T17:19:40.946 [Cloud] Dequeued cloud request. 2026-09-25T17:19:40.946 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T17:19:41.118 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4FA5D29D-325D-18AC-FCBD-29C169FD2E6B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 17:19:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T17:19:41.634 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T17:21:59.618 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T17:21:59.618 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T17:21:59.618 [Cloud] Queued cloud request. 2026-09-25T17:21:59.618 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T17:21:59.618 [Cloud] Dequeued cloud request. 2026-09-25T17:21:59.618 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T17:21:59.805 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F61003DE-74B7-AFA0-0D9C-B00656C1964E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 17:21:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T17:22:00.321 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T17:28:14.840 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T17:28:14.840 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T17:28:14.840 [Cloud] Queued cloud request. 2026-09-25T17:28:14.840 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T17:28:14.840 [Cloud] Dequeued cloud request. 2026-09-25T17:28:14.840 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T17:28:15.028 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8703676F-96AC-37D0-3952-0C855C0114E0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 17:28:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T17:28:15.528 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T17:29:15.091 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T17:30:37.404 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T17:30:37.404 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T17:30:37.404 [Cloud] Queued cloud request. 2026-09-25T17:30:37.404 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T17:30:37.404 [Cloud] Dequeued cloud request. 2026-09-25T17:30:37.404 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T17:30:37.576 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EB09B1DE-C0CF-EDA5-1F97-E42F5BA60405} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 17:30:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T17:30:38.076 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T17:34:56.216 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T17:34:56.216 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T17:34:56.216 [Cloud] Queued cloud request. 2026-09-25T17:34:56.216 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T17:34:56.216 [Cloud] Dequeued cloud request. 2026-09-25T17:34:56.216 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T17:35:06.310 [Cloud] End of cloud request. 2026-09-25T17:35:06.826 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T17:39:41.939 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 53565, Count: 3826, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-25T17:39:41.939 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 18141, Count: 1493, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-25T17:39:41.939 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 6506, Count: 553, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-25T17:39:41.939 ProcessImageName: powershell.exe, Pid: 4772, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 34% 2026-09-25T17:39:41.939 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 1390, Count: 268, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\Messages\D7BCBA44705C4E659EA38FA66ACDD27A.MAI, EstimatedImpact: 0% 2026-09-25T17:39:41.939 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 957, Count: 108, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\7F5005A1990545DCAF83F9B7CE14EDEE.MAI, EstimatedImpact: 8% 2026-09-25T17:39:41.939 ProcessImageName: taskhostw.exe, Pid: 4672, TotalTime: 781, Count: 2, MaxTime: 750, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 15% 2026-09-25T17:39:41.939 ProcessImageName: php.exe, Pid: 6332, TotalTime: 773, Count: 21, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-25T17:39:41.939 ProcessImageName: WmiPrvSE.exe, Pid: 6604, TotalTime: 767, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-25T17:39:41.939 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 736, Count: 59, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-25T17:39:41.939 ProcessImageName: AgentShellService.exe, Pid: 7784, TotalTime: 711, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-25T17:39:41.939 ProcessImageName: powershell.exe, Pid: 3600, TotalTime: 477, Count: 36, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\1c04149984fb244f7a244ad5c96a88d4\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-25T17:39:41.939 ProcessImageName: WmiPrvSE.exe, Pid: 2176, TotalTime: 316, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-25T17:39:41.939 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 300, Count: 20, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-25T17:39:41.939 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 285, Count: 104, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-224d3-0.MAI, EstimatedImpact: 0% 2026-09-25T17:39:41.939 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 232, Count: 22, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 51% 2026-09-25T17:39:41.939 ProcessImageName: WmiPrvSE.exe, Pid: 7876, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-25T17:39:41.939 ProcessImageName: python.exe, Pid: 1428, TotalTime: 180, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 7% 2026-09-25T17:39:41.939 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 120, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\7F134E415EE54C3AA718869E1E41C578.MAI, EstimatedImpact: 1% 2026-09-25T17:39:41.939 ProcessImageName: upfc.exe, Pid: 4180, TotalTime: 120, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\WaaS\services\14a3f9e824793931d34f7f786a538bbc9ef1f0d6.xml, EstimatedImpact: 96% 2026-09-25T17:39:41.939 ProcessImageName: taskhostw.exe, Pid: 7488, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-25T17:39:41.939 ProcessImageName: python.exe, Pid: 5824, TotalTime: 75, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 4% 2026-09-25T17:39:41.939 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-25T17:39:41.939 ProcessImageName: powershell.exe, Pid: 7568, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_rafkkzgf.gfa.ps1, EstimatedImpact: 0% 2026-09-25T17:39:41.939 ProcessImageName: DeviceCensus.exe, Pid: 6936, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-09-25T17:39:41.939 ProcessImageName: mysqldump.exe, Pid: 7124, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 11% 2026-09-25T17:39:41.939 ProcessImageName: cmd.exe, Pid: 6784, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-25T17:39:41.939 ProcessImageName: powershell.exe, Pid: 6788, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp9A15.tmp, EstimatedImpact: 0% 2026-09-25T17:39:41.939 ProcessImageName: taskhostw.exe, Pid: 6780, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-25T17:39:41.939 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-25T17:44:20.096 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T17:47:44.380 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T17:47:44.380 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T17:47:44.380 [Cloud] Queued cloud request. 2026-09-25T17:47:44.380 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T17:47:44.380 [Cloud] Dequeued cloud request. 2026-09-25T17:47:44.380 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T17:47:44.537 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A2257D78-5FE4-4E43-F941-3B87761D3023} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 17:47:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T17:47:45.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T17:49:45.365 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T17:49:45.365 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T17:49:45.365 [Cloud] Queued cloud request. 2026-09-25T17:49:45.365 [Cloud] Dequeued cloud request. 2026-09-25T17:49:45.365 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T17:49:45.365 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T17:49:45.506 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B47EE4EC-D836-5EA8-AE07-787EE0225109} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 17:49:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T17:49:46.006 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T17:54:53.555 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T17:54:53.555 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T17:54:53.555 [Cloud] Queued cloud request. 2026-09-25T17:54:53.555 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T17:54:53.555 [Cloud] Dequeued cloud request. 2026-09-25T17:54:53.555 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T17:54:53.695 [Cloud] End of cloud request. 2026-09-25T17:54:54.211 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T17:59:00.432 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T17:59:00.432 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T17:59:00.432 [Cloud] Queued cloud request. 2026-09-25T17:59:00.432 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T17:59:00.432 [Cloud] Dequeued cloud request. 2026-09-25T17:59:00.432 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T17:59:00.572 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5A4D33B5-4AF3-D69F-B7E7-58C8F6387377} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 17:59:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T17:59:01.088 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T17:59:25.104 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T18:04:36.307 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:04:36.307 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:04:36.307 [Cloud] Queued cloud request. 2026-09-25T18:04:36.307 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:04:36.307 [Cloud] Dequeued cloud request. 2026-09-25T18:04:36.307 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:04:36.463 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FA06058A-9EA9-AA3D-B670-C94F25338E02} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 18:04:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T18:04:36.963 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:06:30.810 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:06:30.810 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:06:30.810 [Cloud] Queued cloud request. 2026-09-25T18:06:30.810 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:06:30.810 [Cloud] Dequeued cloud request. 2026-09-25T18:06:30.810 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:06:30.951 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4B8E52E4-EBF2-D132-2795-95342D247A34} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 18:06:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T18:06:31.466 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:09:17.311 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:09:17.311 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:09:17.311 [Cloud] Queued cloud request. 2026-09-25T18:09:17.311 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:09:17.311 [Cloud] Dequeued cloud request. 2026-09-25T18:09:17.311 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:09:27.390 [Cloud] End of cloud request. 2026-09-25T18:09:27.905 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:09:58.390 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:09:58.390 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:09:58.390 [Cloud] Queued cloud request. 2026-09-25T18:09:58.390 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:09:58.390 [Cloud] Dequeued cloud request. 2026-09-25T18:09:58.390 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:09:58.468 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E77347E3-C2BC-50F0-B477-48B9EA2A472C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 18:09:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T18:09:58.983 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:14:30.109 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T18:29:27.836 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:29:27.836 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:29:27.836 [Cloud] Queued cloud request. 2026-09-25T18:29:27.836 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:29:28.023 [Cloud] Dequeued cloud request. 2026-09-25T18:29:28.023 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:29:28.164 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{46DB9B98-3E5B-7BE8-68FC-8A8BE1013D83} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 18:29:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T18:29:28.679 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:29:35.117 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T18:32:53.586 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:32:53.586 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:32:53.586 [Cloud] Queued cloud request. 2026-09-25T18:32:53.586 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:32:53.586 [Cloud] Dequeued cloud request. 2026-09-25T18:32:53.586 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:32:53.726 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{685F56A1-E3A1-95C1-8736-3E8F06C91FF3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 18:32:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T18:32:54.226 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:33:04.883 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:33:04.883 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:33:04.883 [Cloud] Queued cloud request. 2026-09-25T18:33:04.883 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:33:04.883 [Cloud] Dequeued cloud request. 2026-09-25T18:33:04.883 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:33:04.961 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0098D15A-6F31-CE8F-27C2-A79BA24FC1A9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 18:33:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T18:33:05.476 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:33:27.554 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:33:27.554 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:33:27.554 [Cloud] Queued cloud request. 2026-09-25T18:33:27.554 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:33:27.554 [Cloud] Dequeued cloud request. 2026-09-25T18:33:27.554 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:33:27.914 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{501EFE5D-F17F-D557-EC99-512F0B4E7F16} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 18:33:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T18:33:28.414 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:33:29.070 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:33:29.070 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:33:29.070 [Cloud] Queued cloud request. 2026-09-25T18:33:29.070 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:33:29.070 [Cloud] Dequeued cloud request. 2026-09-25T18:33:29.070 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:33:29.148 [Cloud] End of cloud request. 2026-09-25T18:33:29.664 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:35:57.212 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:35:57.212 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:35:57.212 [Cloud] Queued cloud request. 2026-09-25T18:35:57.212 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:35:57.212 [Cloud] Dequeued cloud request. 2026-09-25T18:35:57.212 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:35:57.352 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F3382E6-AF95-D954-9344-FD1E5DEA653D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 18:35:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T18:35:57.852 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:36:14.181 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:36:14.181 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:36:14.181 [Cloud] Queued cloud request. 2026-09-25T18:36:14.181 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:36:14.181 [Cloud] Dequeued cloud request. 2026-09-25T18:36:14.181 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:36:14.260 [Cloud] End of cloud request. 2026-09-25T18:36:14.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:39:39.918 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:39:39.918 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:39:39.918 [Cloud] Queued cloud request. 2026-09-25T18:39:39.918 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:39:39.918 [Cloud] Dequeued cloud request. 2026-09-25T18:39:39.918 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:39:40.059 [Cloud] End of cloud request. 2026-09-25T18:39:40.559 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:43:09.403 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:43:09.403 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:43:09.403 [Cloud] Queued cloud request. 2026-09-25T18:43:09.403 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:43:09.403 [Cloud] Dequeued cloud request. 2026-09-25T18:43:09.403 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:43:09.590 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3C439DAD-3FAC-5400-B31F-FEA8C719AB71} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 18:43:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T18:43:10.106 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:44:40.121 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T18:55:13.485 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T18:55:13.485 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T18:55:13.485 [Cloud] Queued cloud request. 2026-09-25T18:55:13.485 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T18:55:13.485 [Cloud] Dequeued cloud request. 2026-09-25T18:55:13.485 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T18:55:13.673 [Cloud] End of cloud request. 2026-09-25T18:55:14.173 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T18:59:45.130 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T19:05:09.302 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T19:05:09.302 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T19:05:09.302 [Cloud] Queued cloud request. 2026-09-25T19:05:09.302 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T19:05:09.302 [Cloud] Dequeued cloud request. 2026-09-25T19:05:09.302 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T19:05:09.506 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E204767-39F3-8552-BCB3-DC0AA65A08CE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 19:05:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T19:05:10.006 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T19:06:41.710 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T19:06:41.710 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T19:06:41.710 [Cloud] Queued cloud request. 2026-09-25T19:06:41.710 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T19:06:41.710 [Cloud] Dequeued cloud request. 2026-09-25T19:06:41.710 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T19:06:41.867 [Cloud] End of cloud request. 2026-09-25T19:06:42.382 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T19:07:52.087 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T19:07:52.087 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T19:07:52.087 [Cloud] Queued cloud request. 2026-09-25T19:07:52.087 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T19:07:52.087 [Cloud] Dequeued cloud request. 2026-09-25T19:07:52.259 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T19:07:52.446 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E5359A5-9050-99BB-1A10-93756C26D278} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 19:07:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T19:07:52.962 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T19:12:37.150 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T19:12:37.150 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T19:12:37.150 [Cloud] Queued cloud request. 2026-09-25T19:12:37.150 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T19:12:37.150 [Cloud] Dequeued cloud request. 2026-09-25T19:12:37.150 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T19:12:37.291 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FBBF8469-B65B-DB34-03B6-562DD69942FA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 19:12:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T19:12:37.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T19:13:39.994 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T19:13:39.994 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T19:13:39.994 [Cloud] Queued cloud request. 2026-09-25T19:13:39.994 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T19:13:39.994 [Cloud] Dequeued cloud request. 2026-09-25T19:13:39.994 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T19:13:40.135 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B3B67CEE-1679-C700-9419-91729FD60F13} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 19:13:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T19:13:40.650 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T19:14:50.135 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T19:16:59.668 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T19:16:59.668 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T19:16:59.668 [Cloud] Queued cloud request. 2026-09-25T19:16:59.668 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T19:16:59.668 [Cloud] Dequeued cloud request. 2026-09-25T19:16:59.668 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T19:16:59.871 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{88ED0A56-2B95-F389-63D5-CF8A38849D17} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 19:16:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T19:17:00.371 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T19:24:59.608 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T19:24:59.608 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T19:24:59.608 [Cloud] Queued cloud request. 2026-09-25T19:24:59.608 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T19:24:59.608 [Cloud] Dequeued cloud request. 2026-09-25T19:24:59.608 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T19:24:59.795 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0ED9F710-AE9A-7E05-0CFB-AA04DBC3BD63} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 19:24:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T19:25:00.311 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T19:29:55.143 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T19:39:15.147 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-25T19:39:15.178 Job Notification: New process added to job (7608) 2026-09-25T19:39:15.178 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-25T19:39:15.178 Aggressive catchup quick scan threshold: 660073408394 / 25920000000000 2026-09-25T19:39:15.178 Job Notification: New process added to job (7332) 2026-09-25T19:39:15.193 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:7608] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7332]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-25T19:39:15.287 Job Notification: New process added to job (8044) 2026-09-25T19:39:15.303 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-25T19:39:15.303 Job Notification: New process added to job (776) 2026-09-25T19:39:15.334 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:8044] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:776]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-25T19:39:15.490 Job Notification: New process added to job (8032) 2026-09-25T19:39:15.537 Task(GetDeviceTicket -AccessKey 2C5CBFCA-4B57-D0E1-30A1-DC779338FDDF ) launched as network service 2026-09-25T19:39:15.693 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-25T19:39:15.693 [RTP] Duplicating the current plugin configuration object... 2026-09-25T19:39:15.693 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-25T19:39:15.693 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-25T19:39:15.693 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-25T19:39:15.693 [RTP] No config change detected. Not updating plugin configuration. 2026-09-25T19:39:15.693 [RTP] No config changes found. No configuration switch. 2026-09-25T19:39:15.693 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-25T19:39:16.084 Job Notification: Process exited from job (8032) 2026-09-25T19:39:16.240 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-25T19:39:16.240 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T19:39:16.240 [Cloud] Queued cloud request. 2026-09-25T19:39:16.240 [Cloud] Dequeued cloud request. 2026-09-25T19:39:16.240 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T19:39:16.428 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-25T19:39:16.428 [Cloud] End of cloud request. 2026-09-25T19:39:16.740 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T19:39:26.022 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\5B045051-4AB4-430C-B221-F64E912F51BF7f8.1dd4d2590b7dac2 2026-09-25T19:39:26.147 Verifying engine and signature files (source: 0) ... 2026-09-25T19:39:26.147 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1}\mpengine.dll] due to PPL. 2026-09-25T19:39:26.147 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1}\mpasbase.vdm]. File not in cache (0x1) 2026-09-25T19:39:27.287 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1}\mpasbase.vdm] 2026-09-25T19:39:27.287 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-25T19:39:27.334 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1}\mpasdlta.vdm] 2026-09-25T19:39:27.334 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1}\mpavbase.vdm]. File not in cache (0x1) 2026-09-25T19:39:27.787 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1}\mpavbase.vdm] 2026-09-25T19:39:27.787 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-25T19:39:27.803 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1}\mpavdlta.vdm] 2026-09-25T19:39:27.990 [Engine] IsHybridMode: 0 2026-09-25T19:39:27.990 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-25T19:39:28.006 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-1F3BF42B8F10A258213687733CDFB8A9436DF069.bin): 0x00000002 2026-09-25T19:39:28.006 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-1F3BF42B8F10A258213687733CDFB8A9436DF069.bin) 2026-09-25T19:39:28.006 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-25T19:39:28.006 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-25T19:39:28.006 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-25T19:39:28.006 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-25T19:39:40.053 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-25T19:39:40.053 [AutoExclusion] Applied roles from cache. 2026-09-25T19:39:40.053 [AutoExclusion] Started roles monitoring. 2026-09-25T19:39:40.146 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF4ABB020, lRefCount: 6, hr=0 2026-09-25T19:39:40.146 [Engine] New active engine 00007FFCF68AB020 replacing engine 00007FFCF4ABB020. Number of active engines: 2 2026-09-25T19:39:40.178 EngineInit:Global ASOC is enabled 2026-09-25T19:39:40.178 EngineInit:ASOO is enabled for developer volumes 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.272 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-25T19:39:40.303 MpWriteUupSignatureVersion 1.459.401.0, hr = 0 2026-09-25T19:39:40.303 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-25T19:39:40.334 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-25T19:39:40.334 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-25T19:39:40.334 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-25T19:39:40.334 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-25T19:39:40.350 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-25T19:39:40.350 [Plugin] Initializing RTP plugin state... 2026-09-25T19:39:40.350 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-25T19:39:40.350 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎24‎-‎2026 21:39:41 Last Perf:‎09‎-‎24‎-‎2026 21:39:41 First RTP Scan:‎09‎-‎24‎-‎2026 21:39:42 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1637 Misses:9489 BM Queue:0,97,0 Proc:0,71,0 File:0,97,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:3425755 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:731985730 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:4530 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:187931 TotalHits:1813307 InstanceCacheInserts:31476 InstanceCacheUpdates:0 InstanceCacheDeletes:17317 InstanceCacheHits:894 InstanceCacheMisses:113313 InstanceCacheOverflows:12907 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:5ms (8693/1605) Success: 1605, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-25T19:39:40.350 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1} 2026-09-25T19:39:40.350 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7619E42D-C4F1-4A92-B56F-9C3455A3598F} removed 2026-09-25T19:39:40.350 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-25T19:39:40.350 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817}\mpasbase.vdm in use, hr=0x80070020 2026-09-25T19:39:40.350 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-25T19:39:40.350 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-25T19:39:40.350 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-25T19:39:40.350 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-25T19:39:40.350 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-25-2026 19:39:40 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-25-2026 19:39:40 2026-09-25T19:39:40.365 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-25T19:39:40.365 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-25T19:39:40.365 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-25T19:39:40.365 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-25T19:39:40.365 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T19:39:40.365 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-25T19:39:40.365 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-25T19:39:40.365 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-25T19:39:40.365 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-25T19:39:40.365 MdCoreSvc is supported in this platform and OS Signature updated on 09-25-2026 19:39:40 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.401.0 AV Signature Version: 1.459.401.0 ************************************************************ 2026-09-25T19:39:40.381 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-25T19:39:40.381 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\5B045051-4AB4-430C-B221-F64E912F51BF7f8.1dd4d2590b7dac2 2026-09-25T19:39:40.412 Process scan (postsignatureupdatescan) started. 2026-09-25T19:39:40.428 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-25T19:39:40.428 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-25-2026 19:39:40 ************************************************************ 2026-09-25T19:39:40.631 Job Notification: Process exited from job (8044) 2026-09-25T19:39:40.662 Job Notification: Process exited from job (776) 2026-09-25T19:39:40.662 Job Notification: Process exited from job (7608) 2026-09-25T19:39:40.678 Job Notification: Process exited from job (7332) 2026-09-25T19:39:40.756 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-25T19:39:40.756 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-25T19:39:40.756 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-25T19:39:40.756 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-25T19:39:40.756 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-25T19:39:40.771 [Engine] Engine 00007FFCF4ABB020 no longer in use. Number of active engines: 1 2026-09-25T19:39:40.771 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-25T19:39:40.771 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-25T19:39:40.834 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-25T19:39:40.834 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-25T19:39:40.834 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-25T19:39:41.397 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 54010, Count: 3856, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-25T19:39:41.397 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 20451, Count: 1666, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-25T19:39:41.397 ProcessImageName: AgentShell.exe, Pid: 3364, TotalTime: 6506, Count: 553, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-25T19:39:41.397 ProcessImageName: powershell.exe, Pid: 4772, TotalTime: 1461, Count: 107, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 34% 2026-09-25T19:39:41.397 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 1390, Count: 268, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\Messages\D7BCBA44705C4E659EA38FA66ACDD27A.MAI, EstimatedImpact: 0% 2026-09-25T19:39:41.397 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 957, Count: 108, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\7F5005A1990545DCAF83F9B7CE14EDEE.MAI, EstimatedImpact: 8% 2026-09-25T19:39:41.397 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 842, Count: 68, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-25T19:39:41.397 ProcessImageName: taskhostw.exe, Pid: 4672, TotalTime: 781, Count: 2, MaxTime: 750, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 15% 2026-09-25T19:39:41.397 ProcessImageName: php.exe, Pid: 6332, TotalTime: 773, Count: 21, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 26% 2026-09-25T19:39:41.397 ProcessImageName: WmiPrvSE.exe, Pid: 6604, TotalTime: 767, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 6% 2026-09-25T19:39:41.397 ProcessImageName: AgentShellService.exe, Pid: 7784, TotalTime: 711, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-25T19:39:41.397 ProcessImageName: powershell.exe, Pid: 3600, TotalTime: 477, Count: 36, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\1c04149984fb244f7a244ad5c96a88d4\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-25T19:39:41.397 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 330, Count: 22, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-25T19:39:41.397 ProcessImageName: WmiPrvSE.exe, Pid: 2176, TotalTime: 316, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 35% 2026-09-25T19:39:41.397 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 285, Count: 104, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-224d3-0.MAI, EstimatedImpact: 0% 2026-09-25T19:39:41.443 [Engine] RSIG_UNLOADENGINE, 00007FFCF4ABB020, err=0x0 2026-09-25T19:39:41.475 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{80BD51D5-3672-4907-8A9A-FB420A544817} removed 2026-09-25T19:39:54.475 Process scan (postsignatureupdatescan) completed. 2026-09-25T19:44:40.194 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-25T19:45:00.147 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T19:46:12.415 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T19:46:12.415 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T19:46:12.415 [Cloud] Queued cloud request. 2026-09-25T19:46:12.415 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T19:46:12.415 [Cloud] Dequeued cloud request. 2026-09-25T19:46:12.415 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T19:46:12.587 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4E4B0502-E697-277A-CCC8-66A84062E652} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 19:46:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T19:46:13.087 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T19:52:59.276 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T19:52:59.276 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T19:52:59.276 [Cloud] Queued cloud request. 2026-09-25T19:52:59.276 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T19:52:59.276 [Cloud] Dequeued cloud request. 2026-09-25T19:52:59.276 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T19:52:59.464 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{876D8FF3-18D9-062A-A863-F0F1FDFB6B47} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 19:52:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T19:52:59.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T19:55:36.075 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T19:55:36.075 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T19:55:36.075 [Cloud] Queued cloud request. 2026-09-25T19:55:36.075 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T19:55:36.075 [Cloud] Dequeued cloud request. 2026-09-25T19:55:36.075 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T19:55:36.247 [Cloud] End of cloud request. 2026-09-25T19:55:36.747 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T20:00:05.156 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T20:09:35.472 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T20:09:35.472 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T20:09:35.472 [Cloud] Queued cloud request. 2026-09-25T20:09:35.472 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T20:09:35.472 [Cloud] Dequeued cloud request. 2026-09-25T20:09:35.472 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T20:09:35.613 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C8DD340-6D2C-5E60-C28F-29DC7C96A40E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 20:09:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T20:09:36.113 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T20:11:37.222 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T20:11:37.222 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T20:11:37.222 [Cloud] Queued cloud request. 2026-09-25T20:11:37.222 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T20:11:37.222 [Cloud] Dequeued cloud request. 2026-09-25T20:11:37.222 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T20:11:37.363 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6ECE3F66-C9F8-F286-09DF-10E84AA0D565} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 20:11:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T20:11:37.878 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T20:15:10.160 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T20:17:10.178 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T20:17:10.178 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T20:17:10.178 [Cloud] Queued cloud request. 2026-09-25T20:17:10.178 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T20:17:10.178 [Cloud] Dequeued cloud request. 2026-09-25T20:17:10.178 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T20:17:13.319 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FCA0C2EC-509C-8358-CF51-7064466B8A1F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 20:17:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T20:17:13.819 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{795294DF-0E46-F8B7-BCE6-43DDE0805F6F} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-25-2026 20:24:12 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T20:24:12.820 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T20:24:12.820 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T20:24:12.820 [Cloud] Queued cloud request. 2026-09-25T20:24:12.820 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T20:24:12.820 [Cloud] Dequeued cloud request. 2026-09-25T20:24:12.820 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T20:24:13.148 [Cloud] End of cloud request. 2026-09-25T20:24:13.648 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T20:30:15.169 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T20:36:34.124 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T20:36:34.124 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T20:36:34.124 [Cloud] Queued cloud request. 2026-09-25T20:36:34.124 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T20:36:34.124 [Cloud] Dequeued cloud request. 2026-09-25T20:36:34.124 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{9DA5D668-2DAF-72A4-D63D-E75911CB37ED} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 20:36:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T20:36:40.952 [Cloud] End of cloud request. 2026-09-25T20:36:41.452 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T20:45:20.174 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T20:52:06.006 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T20:52:06.006 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T20:52:06.006 [Cloud] Queued cloud request. 2026-09-25T20:52:06.006 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T20:52:06.006 [Cloud] Dequeued cloud request. 2026-09-25T20:52:06.006 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T20:52:06.162 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2BFDE213-715E-B15D-77AC-BFFC9A88F111} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 20:52:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T20:52:06.678 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T20:53:07.287 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T20:53:07.287 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T20:53:07.287 [Cloud] Queued cloud request. 2026-09-25T20:53:07.287 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T20:53:07.287 [Cloud] Dequeued cloud request. 2026-09-25T20:53:07.287 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T20:53:07.428 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EA04656F-7E15-7AC1-BDF8-72E98A76DFDE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 20:53:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T20:53:07.928 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T20:58:13.431 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T20:58:13.431 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T20:58:13.431 [Cloud] Queued cloud request. 2026-09-25T20:58:13.431 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T20:58:13.431 [Cloud] Dequeued cloud request. 2026-09-25T20:58:13.431 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T20:58:13.572 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{73CBE148-F5B3-4617-BD68-2E57FCD5B54D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 20:58:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T20:58:14.072 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T21:00:25.182 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T21:06:47.091 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T21:06:47.091 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T21:06:47.091 [Cloud] Queued cloud request. 2026-09-25T21:06:47.091 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T21:06:47.091 [Cloud] Dequeued cloud request. 2026-09-25T21:06:47.091 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T21:06:47.278 [Cloud] End of cloud request. 2026-09-25T21:06:47.794 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T21:07:31.591 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T21:07:31.591 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T21:07:31.591 [Cloud] Queued cloud request. 2026-09-25T21:07:31.591 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T21:07:31.591 [Cloud] Dequeued cloud request. 2026-09-25T21:07:31.591 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T21:07:31.669 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E960153C-8FFB-CB40-F287-5EDE44795C63} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 21:07:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T21:07:32.185 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T21:11:19.325 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T21:11:19.325 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T21:11:19.325 [Cloud] Queued cloud request. 2026-09-25T21:11:19.325 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T21:11:19.325 [Cloud] Dequeued cloud request. 2026-09-25T21:11:19.325 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T21:11:19.544 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C6EA3AB-020E-9BDA-4E70-6938D3308959} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 21:11:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T21:11:20.060 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T21:15:30.185 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T21:26:11.630 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T21:26:11.630 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T21:26:11.630 [Cloud] Queued cloud request. 2026-09-25T21:26:11.630 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T21:26:11.630 [Cloud] Dequeued cloud request. 2026-09-25T21:26:11.630 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T21:26:12.083 [Cloud] End of cloud request. 2026-09-25T21:26:12.583 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T21:30:35.195 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T21:39:40.199 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 4457, Count: 368, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\turbodbadmin\turbo\turbo.js, EstimatedImpact: 0% 2026-09-25T21:39:40.199 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 1993, Count: 179, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-25T21:39:40.199 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-25T21:39:40.199 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-25T21:39:40.199 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 135, Count: 10, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start, EstimatedImpact: 0% 2026-09-25T21:39:40.199 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-25T21:39:40.199 ProcessImageName: taskhostw.exe, Pid: 7052, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-25T21:39:40.199 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-25T21:39:40.199 ProcessImageName: ngentask.exe, Pid: 6032, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-25T21:41:20.262 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T21:41:20.262 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T21:41:20.262 [Cloud] Queued cloud request. 2026-09-25T21:41:20.262 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T21:41:20.262 [Cloud] Dequeued cloud request. 2026-09-25T21:41:20.262 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T21:41:20.403 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{419282AB-E5D9-849E-2DAA-B479AD41C9EB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 21:41:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T21:41:20.918 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T21:45:40.200 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T21:53:28.297 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T21:53:28.297 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T21:53:28.297 [Cloud] Queued cloud request. 2026-09-25T21:53:28.297 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T21:53:28.297 [Cloud] Dequeued cloud request. 2026-09-25T21:53:28.297 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T21:53:28.453 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D32CF472-465C-8F70-1F5E-67DFAC6708CD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 21:53:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T21:53:28.953 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T21:54:07.281 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T21:54:07.281 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T21:54:07.281 [Cloud] Queued cloud request. 2026-09-25T21:54:07.281 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T21:54:07.281 [Cloud] Dequeued cloud request. 2026-09-25T21:54:07.281 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T21:54:07.891 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5C3EE484-E5B0-A84A-E53D-47F6B8800B4F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 21:54:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T21:54:08.391 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T21:56:50.502 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T21:56:50.502 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T21:56:50.502 [Cloud] Queued cloud request. 2026-09-25T21:56:50.502 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T21:56:50.502 [Cloud] Dequeued cloud request. 2026-09-25T21:56:50.502 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T21:56:50.643 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2394267D-AB53-89ED-0574-7AFB227AB42E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 21:56:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T21:56:51.143 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T22:00:45.208 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T22:04:55.442 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T22:04:55.442 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T22:04:55.442 [Cloud] Queued cloud request. 2026-09-25T22:04:55.442 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T22:04:55.442 [Cloud] Dequeued cloud request. 2026-09-25T22:04:55.442 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T22:05:05.520 [Cloud] End of cloud request. 2026-09-25T22:05:06.020 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T22:15:50.214 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T22:26:04.890 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T22:26:04.890 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T22:26:04.890 [Cloud] Queued cloud request. 2026-09-25T22:26:04.890 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T22:26:04.890 [Cloud] Dequeued cloud request. 2026-09-25T22:26:04.890 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T22:26:06.983 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{93B7A816-695E-A36E-79A6-99326850074E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 22:26:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T22:26:07.483 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T22:27:33.938 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T22:27:33.938 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T22:27:33.938 [Cloud] Queued cloud request. 2026-09-25T22:27:33.938 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T22:27:33.938 [Cloud] Dequeued cloud request. 2026-09-25T22:27:33.938 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T22:27:34.094 [Cloud] End of cloud request. 2026-09-25T22:27:34.594 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T22:29:49.564 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T22:29:49.564 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T22:29:49.564 [Cloud] Queued cloud request. 2026-09-25T22:29:49.564 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T22:29:49.564 [Cloud] Dequeued cloud request. 2026-09-25T22:29:49.564 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T22:29:49.705 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{39B99AD2-1920-8221-DFC5-E4E403FBF0B1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 22:29:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T22:29:50.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T22:30:49.877 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T22:30:49.877 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T22:30:49.877 [Cloud] Queued cloud request. 2026-09-25T22:30:49.877 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T22:30:49.877 [Cloud] Dequeued cloud request. 2026-09-25T22:30:49.877 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T22:30:50.564 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4F13981B-7CDB-D0C1-8CDD-DAFF9F2BA577} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 22:30:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T22:30:51.080 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T22:30:55.220 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T22:37:09.661 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T22:37:09.661 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T22:37:09.661 [Cloud] Queued cloud request. 2026-09-25T22:37:09.661 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T22:37:09.661 [Cloud] Dequeued cloud request. 2026-09-25T22:37:09.661 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T22:37:09.832 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A9D70273-0D4F-0239-911E-9AD68A512526} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 22:37:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T22:37:10.332 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T22:40:08.818 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T22:40:08.818 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T22:40:08.818 [Cloud] Queued cloud request. 2026-09-25T22:40:08.818 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T22:40:08.818 [Cloud] Dequeued cloud request. 2026-09-25T22:40:08.818 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T22:40:08.959 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{21851CAE-C114-CEBA-2644-BF37FAAFAA60} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 22:40:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T22:40:09.475 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T22:46:00.225 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T22:53:48.870 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T22:53:48.870 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T22:53:48.870 [Cloud] Queued cloud request. 2026-09-25T22:53:48.870 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T22:53:48.870 [Cloud] Dequeued cloud request. 2026-09-25T22:53:48.870 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T22:53:49.073 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1878EF6A-3E90-6A6F-5462-2D3A1C32EFB6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 22:53:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T22:53:49.588 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T23:01:05.233 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T23:07:17.266 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T23:07:17.266 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T23:07:17.266 [Cloud] Queued cloud request. 2026-09-25T23:07:17.266 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T23:07:17.266 [Cloud] Dequeued cloud request. 2026-09-25T23:07:17.266 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T23:07:27.345 [Cloud] End of cloud request. 2026-09-25T23:07:27.860 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T23:07:35.314 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T23:07:35.314 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T23:07:35.314 [Cloud] Queued cloud request. 2026-09-25T23:07:35.314 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T23:07:35.314 [Cloud] Dequeued cloud request. 2026-09-25T23:07:35.314 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T23:07:45.330 [Cloud] End of cloud request. 2026-09-25T23:07:45.830 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T23:09:54.893 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T23:09:54.893 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T23:09:54.893 [Cloud] Queued cloud request. 2026-09-25T23:09:54.893 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T23:09:54.893 [Cloud] Dequeued cloud request. 2026-09-25T23:09:54.893 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T23:09:55.096 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{39D989FF-2E29-4D9F-719B-EAE4950628E5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 23:09:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T23:09:55.596 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T23:16:08.410 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T23:16:08.410 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T23:16:08.410 [Cloud] Queued cloud request. 2026-09-25T23:16:08.410 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T23:16:08.410 [Cloud] Dequeued cloud request. 2026-09-25T23:16:08.410 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T23:16:08.566 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1931DFDE-7F61-BF6B-B3BF-AEB64ED7D5D4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 23:16:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T23:16:09.066 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T23:16:10.238 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T23:19:34.678 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T23:19:34.678 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T23:19:34.678 [Cloud] Queued cloud request. 2026-09-25T23:19:34.678 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T23:19:34.678 [Cloud] Dequeued cloud request. 2026-09-25T23:19:34.678 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T23:19:34.850 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C47E0D0E-BEF4-5FC5-124F-326384186104} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 23:19:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T23:19:35.366 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T23:21:00.335 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T23:21:00.335 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T23:21:00.335 [Cloud] Queued cloud request. 2026-09-25T23:21:00.335 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T23:21:00.335 [Cloud] Dequeued cloud request. 2026-09-25T23:21:00.335 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T23:21:00.507 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B178A71B-8D50-E02D-3526-8B2713D28243} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 23:21:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T23:21:01.007 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T23:29:47.589 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T23:29:47.589 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T23:29:47.589 [Cloud] Queued cloud request. 2026-09-25T23:29:47.589 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T23:29:47.589 [Cloud] Dequeued cloud request. 2026-09-25T23:29:47.589 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T23:29:47.776 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{97356CFC-F09B-69C9-640B-4EAC2767448A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 23:29:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T23:29:48.276 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T23:31:15.245 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T23:31:18.917 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T23:31:18.917 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T23:31:18.917 [Cloud] Queued cloud request. 2026-09-25T23:31:18.917 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T23:31:18.917 [Cloud] Dequeued cloud request. 2026-09-25T23:31:18.917 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T23:31:19.057 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C79570C6-77C1-58BE-EEBA-42DDABF8E9B6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-25-2026 23:31:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-25T23:31:19.557 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T23:35:35.901 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T23:35:35.901 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T23:35:35.901 [Cloud] Queued cloud request. 2026-09-25T23:35:35.901 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T23:35:35.901 [Cloud] Dequeued cloud request. 2026-09-25T23:35:35.901 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T23:35:36.042 [Cloud] End of cloud request. 2026-09-25T23:35:36.558 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T23:39:40.265 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 7172, Count: 568, MaxTime: 312, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-25T23:39:40.265 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 4127, Count: 368, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-25T23:39:40.265 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-25T23:39:40.265 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-25T23:39:40.265 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start, EstimatedImpact: 0% 2026-09-25T23:39:40.265 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-25T23:39:40.265 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 60, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-25T23:39:40.265 ProcessImageName: taskhostw.exe, Pid: 7052, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-25T23:39:40.265 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-25T23:39:40.265 ProcessImageName: ngentask.exe, Pid: 6032, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-25T23:44:16.546 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T23:44:16.546 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T23:44:16.546 [Cloud] Queued cloud request. 2026-09-25T23:44:16.546 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T23:44:16.546 [Cloud] Dequeued cloud request. 2026-09-25T23:44:16.546 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T23:44:16.703 [Cloud] End of cloud request. 2026-09-25T23:44:17.203 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T23:46:20.251 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-25T23:47:17.002 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T23:47:17.002 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T23:47:17.002 [Cloud] Queued cloud request. 2026-09-25T23:47:17.002 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T23:47:17.002 [Cloud] Dequeued cloud request. 2026-09-25T23:47:17.002 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T23:47:17.142 [Cloud] End of cloud request. 2026-09-25T23:47:17.658 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-25T23:55:03.737 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-25T23:55:03.737 [Cloud] Start of cloud request. Passive mode: 0 2026-09-25T23:55:03.737 [Cloud] Queued cloud request. 2026-09-25T23:55:03.737 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-25T23:55:03.941 [Cloud] Dequeued cloud request. 2026-09-25T23:55:03.941 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-25T23:55:14.034 [Cloud] End of cloud request. 2026-09-25T23:55:14.550 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T00:01:25.257 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T00:02:18.523 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T00:02:18.523 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T00:02:18.523 [Cloud] Queued cloud request. 2026-09-26T00:02:18.523 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T00:02:18.523 [Cloud] Dequeued cloud request. 2026-09-26T00:02:18.523 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T00:02:18.679 [Cloud] End of cloud request. 2026-09-26T00:02:19.195 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T00:16:30.263 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T00:20:38.703 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T00:20:38.703 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T00:20:38.703 [Cloud] Queued cloud request. 2026-09-26T00:20:38.703 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T00:20:38.703 [Cloud] Dequeued cloud request. 2026-09-26T00:20:38.703 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T00:20:38.891 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{938B88AC-72A7-354F-13F9-6B1A48E0F37B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 00:20:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T00:20:39.407 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T00:30:09.207 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T00:30:09.207 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T00:30:09.207 [Cloud] Queued cloud request. 2026-09-26T00:30:09.207 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T00:30:09.207 [Cloud] Dequeued cloud request. 2026-09-26T00:30:09.207 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T00:30:09.379 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EA8048D9-663D-60BC-179A-7CE07C810191} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 00:30:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T00:30:09.895 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T00:31:28.410 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T00:31:28.410 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T00:31:28.410 [Cloud] Queued cloud request. 2026-09-26T00:31:28.410 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T00:31:28.410 [Cloud] Dequeued cloud request. 2026-09-26T00:31:28.410 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T00:31:28.551 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FCE8D26F-1A5E-BC2C-F4CB-3D8711239A27} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 00:31:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T00:31:29.051 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T00:31:35.270 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T00:36:31.849 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T00:36:31.849 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T00:36:31.849 [Cloud] Queued cloud request. 2026-09-26T00:36:31.849 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T00:36:32.005 [Cloud] Dequeued cloud request. 2026-09-26T00:36:32.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T00:36:32.146 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F44956F5-EB9D-ED0A-EF8B-29AD7C930A49} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 00:36:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T00:36:32.646 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T00:37:50.882 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T00:37:50.882 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T00:37:50.882 [Cloud] Queued cloud request. 2026-09-26T00:37:50.882 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T00:37:50.882 [Cloud] Dequeued cloud request. 2026-09-26T00:37:50.882 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T00:37:51.023 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5837D3BC-B826-D611-A754-615EC27BBA16} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 00:37:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T00:37:51.523 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T00:38:53.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T00:38:53.445 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T00:38:53.445 [Cloud] Queued cloud request. 2026-09-26T00:38:53.445 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T00:38:53.445 [Cloud] Dequeued cloud request. 2026-09-26T00:38:53.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T00:38:53.570 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{74B71C62-1761-6143-2DD0-9568340B86F2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 00:38:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T00:38:54.086 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T00:38:56.555 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T00:38:56.555 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T00:38:56.555 [Cloud] Queued cloud request. 2026-09-26T00:38:56.555 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T00:38:56.555 [Cloud] Dequeued cloud request. 2026-09-26T00:38:56.555 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T00:38:56.649 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D55D5D17-D1EE-C34D-E116-33434B231FED} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 00:38:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T00:38:57.164 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T00:46:40.277 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T01:00:02.063 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532206, FileId: 0x230000000376a1, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.063 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532205, FileId: 0x2100000003bdc5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.094 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532212, FileId: 0x250000000376a1, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.094 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532211, FileId: 0x2300000003bdc5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.094 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532217, FileId: 0x2500000003bdc5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.094 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532218, FileId: 0x270000000376a1, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.110 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532223, FileId: 0x290000000376a1, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.110 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532224, FileId: 0x2700000003bdc5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.110 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532230, FileId: 0x2b0000000376a1, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.110 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532229, FileId: 0x2900000003bdc5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.126 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532237, FileId: 0x2d0000000376a1, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.126 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532236, FileId: 0x2b00000003bdc5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.141 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532242, FileId: 0x2d00000003bdc5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.141 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532243, FileId: 0x2f0000000376a1, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.157 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532248, FileId: 0x2f00000003bdc5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.157 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532249, FileId: 0x310000000376a1, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.157 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532254, FileId: 0x3100000003bdc5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.157 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532255, FileId: 0x330000000376a1, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.173 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532260, FileId: 0x350000000376a1, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.173 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532261, FileId: 0x3300000003bdc5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.188 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532266, FileId: 0x3500000003bdc5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.188 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532267, FileId: 0x370000000376a1, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.204 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532272, FileId: 0x3700000003bdc5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:00:02.204 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-241a7-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3532273, FileId: 0x390000000376a1, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T01:01:45.282 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T01:16:50.289 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T01:19:07.853 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:BEE844A1-C168-4E22-A59B-87A2DDCDF147, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-26T01:19:07.853 Scheduled scan with Id BEE844A1-C168-4E22-A59B-87A2DDCDF147 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-26T01:19:07.853 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-26T01:19:07.853 [SFC] System file cache build is not needed (already completed) 2026-09-26T01:19:28.447 Engine:Triggered AR EMS scan 2026-09-26T01:19:28.447 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.462 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.478 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.478 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.478 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.493 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.509 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.509 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.525 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.525 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.525 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.525 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.540 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.540 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.540 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.556 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.556 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.572 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.572 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.572 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.572 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.587 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.587 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.587 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.587 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.603 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.603 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.618 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.618 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.618 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.618 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.634 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.650 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.650 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.650 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.665 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.665 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.665 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.681 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.681 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.681 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.681 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.697 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.697 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.697 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.712 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.712 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.712 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.728 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.728 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.728 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.728 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.743 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.743 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.743 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.759 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.759 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.759 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.775 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.775 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:19:28.790 Engine:EMS scan for process: svchost pid: 4008, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-26T01:20:05.993 QuickScan:ScanID:BEE844A1-C168-4E22-A59B-87A2DDCDF147: Quick scan finished with error 0 2026-09-26T01:20:06.509 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-26T01:20:06.509 [RTP] Duplicating the current plugin configuration object... 2026-09-26T01:20:06.509 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-26T01:20:06.509 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-26T01:20:06.509 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-26T01:20:06.509 [RTP] No config change detected. Not updating plugin configuration. 2026-09-26T01:20:06.509 [RTP] No config changes found. No configuration switch. 2026-09-26T01:20:06.509 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-26T01:29:41.841 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T01:29:41.841 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T01:29:41.841 [Cloud] Queued cloud request. 2026-09-26T01:29:41.841 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T01:29:41.841 [Cloud] Dequeued cloud request. 2026-09-26T01:29:41.841 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T01:29:42.029 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D8C9AA21-F51A-C250-FD3E-15F01DEDEF9F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 01:29:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T01:29:42.544 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T01:31:55.295 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T01:34:58.311 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T01:34:58.311 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T01:34:58.311 [Cloud] Queued cloud request. 2026-09-26T01:34:58.311 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T01:34:58.311 [Cloud] Dequeued cloud request. 2026-09-26T01:34:58.311 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T01:34:58.529 [Cloud] End of cloud request. 2026-09-26T01:34:59.045 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T01:39:40.314 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 14821, Count: 1079, MaxTime: 312, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-26T01:39:40.314 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 6322, Count: 565, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T01:39:40.314 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-26T01:39:40.314 ProcessImageName: WmiPrvSE.exe, Pid: 6284, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-26T01:39:40.314 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 316, Count: 23, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-26T01:39:40.314 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T01:39:40.314 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 90, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-26T01:39:40.314 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-26T01:39:40.314 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 54, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23b3e-0.MAI, EstimatedImpact: 0% 2026-09-26T01:39:40.314 ProcessImageName: powershell.exe, Pid: 5824, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_2oan4zek.qzq.ps1, EstimatedImpact: 0% 2026-09-26T01:39:40.314 ProcessImageName: taskhostw.exe, Pid: 7052, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-26T01:39:40.314 ProcessImageName: mysqldump.exe, Pid: 7892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 12% 2026-09-26T01:39:40.314 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-26T01:39:40.314 ProcessImageName: cmd.exe, Pid: 3244, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-26T01:39:40.314 ProcessImageName: ngentask.exe, Pid: 6032, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-26T01:47:00.301 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T01:54:57.678 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T01:54:57.678 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T01:54:57.678 [Cloud] Queued cloud request. 2026-09-26T01:54:57.678 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T01:54:57.678 [Cloud] Dequeued cloud request. 2026-09-26T01:54:57.678 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T01:55:03.943 [Cloud] End of cloud request. 2026-09-26T01:55:04.443 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T01:56:01.491 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T01:56:01.491 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T01:56:01.491 [Cloud] Queued cloud request. 2026-09-26T01:56:01.491 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T01:56:01.491 [Cloud] Dequeued cloud request. 2026-09-26T01:56:01.491 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T01:56:01.585 [Cloud] End of cloud request. 2026-09-26T01:56:02.085 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T02:02:05.306 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T02:13:49.639 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T02:13:49.639 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T02:13:49.639 [Cloud] Queued cloud request. 2026-09-26T02:13:49.639 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T02:13:49.639 [Cloud] Dequeued cloud request. 2026-09-26T02:13:49.639 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T02:13:49.795 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8B782A98-B16D-61CD-90BF-1702B4366A98} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 02:13:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T02:13:50.295 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T02:17:10.314 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T02:21:10.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T02:21:10.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T02:21:10.049 [Cloud] Queued cloud request. 2026-09-26T02:21:10.049 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T02:21:10.049 [Cloud] Dequeued cloud request. 2026-09-26T02:21:10.049 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T02:21:10.189 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8528CCF3-7520-A63C-9BB9-5A58A0A8720E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 02:21:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T02:21:10.705 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T02:23:57.238 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T02:23:57.238 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T02:23:57.238 [Cloud] Queued cloud request. 2026-09-26T02:23:57.238 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T02:23:57.238 [Cloud] Dequeued cloud request. 2026-09-26T02:23:57.238 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T02:23:57.379 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4F46B336-8197-DE09-EC9C-868E645C9667} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 02:23:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T02:23:57.879 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T02:32:15.319 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T02:33:36.929 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-26T02:33:36.975 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-26T02:33:36.975 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-26T02:33:36.975 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-26T02:33:36.975 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-26T02:33:36.975 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-26T02:33:37.069 [AutoPurge] Cleanup Routine tasks have started. 2026-09-26T02:33:37.085 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-26T02:33:37.100 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-26T02:33:37.100 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-26T02:33:37.100 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-26T02:33:37.100 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-26T02:33:37.100 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-26-2026 02:33:37 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-26-2026 02:33:37 2026-09-26T02:33:37.126 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-26T02:33:37.126 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-26T02:33:37.126 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-26T02:33:37.126 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-26T02:33:37.126 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-26T02:33:37.126 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-26T02:33:37.147 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-26T02:33:37.147 [AutoPurge] Removing expired default signature package ... 2026-09-26T02:33:37.382 Job Notification: New process added to job (6404) 2026-09-26T02:33:37.429 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-26T02:33:37.585 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-26T02:33:38.026 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:33:38.397 Job Notification: Process exited from job (6404) 2026-09-26T02:33:38.460 [AutoPurge] Verification Routine tasks have ended. 2026-09-26T02:33:38.647 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-26T02:33:38.757 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-26T02:33:39.179 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-26T02:33:39.272 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-26T02:33:39.429 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-26T02:33:41.007 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-26T02:33:41.350 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-26T02:33:41.475 Engine:Setting original file name "dual_engine_adapter.dll" for "c:\program files (x86)\microsoft\edgecore\153.0.4234.48\dual_engine_adapter_x64.dll", hr=0x0 2026-09-26T02:33:41.663 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-26T02:33:41.679 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-26T02:33:41.882 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-26T02:33:42.538 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-26T02:33:43.100 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-26T02:33:43.210 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-26T02:33:43.319 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-26T02:33:43.538 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:33:43.679 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-26T02:33:44.038 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-26T02:33:44.163 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-26T02:33:44.366 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-26T02:33:44.460 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-26T02:33:44.522 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-26T02:33:44.538 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-26T02:33:44.679 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:33:44.741 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-26T02:33:44.772 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-26T02:33:44.835 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-26T02:33:44.960 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-26T02:33:45.350 Engine:Setting original file name "mini_installer.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{56eb18f8-b008-4cbd-b6d2-8c97fe7e9062}\153.0.4234.48\microsoftedge_x64_153.0.4234.48_153.0.4234.32.exe", hr=0x0 2026-09-26T02:33:45.491 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-26T02:33:45.522 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-26T02:33:45.944 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:33:46.069 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-26T02:33:46.647 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-26T02:33:47.132 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-26T02:33:47.319 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:33:47.632 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-26T02:33:48.022 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-26T02:33:48.116 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-26T02:33:48.444 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.271.7\microsoftedgeupdatesetup_x86_1.3.271.7.exe", hr=0x0 2026-09-26T02:33:48.538 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-26T02:33:48.647 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-26T02:33:49.304 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:33:49.429 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-26T02:33:49.429 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-26T02:33:49.475 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-26T02:33:49.632 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-26T02:33:49.710 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-26T02:33:49.757 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-26T02:33:49.819 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-26T02:33:50.038 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-26T02:33:50.444 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-26T02:33:50.679 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-26T02:33:51.147 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-26T02:33:52.429 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-26T02:33:52.850 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-26T02:33:52.882 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-26T02:33:52.913 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-26T02:33:52.913 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-26T02:33:52.929 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-26T02:33:53.054 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-26T02:33:53.241 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-26T02:33:53.272 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-26T02:33:53.335 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-26T02:33:53.757 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-26T02:33:53.804 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-26T02:33:53.819 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-26T02:33:53.866 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-26T02:33:54.350 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-26T02:33:54.522 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-26T02:33:54.554 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-26T02:33:54.585 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-26T02:33:54.616 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-26T02:33:55.022 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-26T02:33:55.366 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-26T02:33:55.382 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-26T02:33:56.054 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-26T02:33:56.069 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-26T02:33:56.663 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:33:56.991 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-26T02:33:57.413 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-26T02:33:57.569 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-26T02:33:57.710 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-26T02:33:57.851 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-26T02:33:58.038 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-26T02:33:58.116 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-26T02:33:58.179 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-26T02:33:58.663 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-26T02:33:59.007 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-26T02:33:59.038 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-26T02:33:59.085 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:33:59.382 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:33:59.632 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-26T02:33:59.741 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-26T02:33:59.897 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-26T02:33:59.929 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-26T02:34:00.038 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-26T02:34:00.554 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-26T02:34:00.976 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-26T02:34:01.069 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-26T02:34:01.194 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:01.772 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-26T02:34:01.804 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:02.116 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-26T02:34:02.210 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-26T02:34:02.225 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-26T02:34:02.257 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-26T02:34:02.366 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-26T02:34:02.413 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-26T02:34:02.460 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-26T02:34:02.819 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-26T02:34:02.819 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-26T02:34:03.147 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-26T02:34:03.304 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-26T02:34:03.413 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-26T02:34:03.429 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-26T02:34:03.632 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:03.850 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-26T02:34:04.241 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:04.538 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-26T02:34:04.679 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-26T02:34:05.007 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-26T02:34:05.038 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-26T02:34:05.194 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-26T02:34:05.304 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-26T02:34:05.757 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-26T02:34:05.804 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-26T02:34:05.944 Engine:Setting original file name "notification_helper.exe" for "c:\program files (x86)\microsoft\edge\application\153.0.4234.48\notification_click_helper.exe", hr=0x0 2026-09-26T02:34:06.007 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-26T02:34:06.022 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-26T02:34:06.194 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-26T02:34:06.241 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-26T02:34:06.429 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:34:06.960 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:07.163 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-26T02:34:07.210 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-26T02:34:07.819 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-26T02:34:07.819 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-26T02:34:08.069 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-26T02:34:08.225 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:08.507 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-26T02:34:09.085 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:34:09.304 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:09.694 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-26T02:34:09.960 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-26T02:34:10.116 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-26T02:34:10.132 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:10.147 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-26T02:34:10.241 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-26T02:34:10.444 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-26T02:34:10.788 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-26T02:34:10.866 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-26T02:34:11.101 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-26T02:34:11.335 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-26T02:34:11.382 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-26T02:34:11.663 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:34:11.851 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-26T02:34:12.022 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-26T02:34:12.757 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:12.835 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-26T02:34:12.913 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-26T02:34:12.976 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-26T02:34:13.851 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-26T02:34:13.913 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-26T02:34:14.007 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-26T02:34:14.147 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-26T02:34:14.366 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-26T02:34:14.538 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-26T02:34:15.210 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-26T02:34:15.257 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-26T02:34:15.272 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-26T02:34:15.335 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-26T02:34:15.429 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-26T02:34:15.726 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-26T02:34:15.851 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-26T02:34:15.882 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-26T02:34:15.897 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-26T02:34:15.976 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:16.022 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-26T02:34:16.069 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:16.366 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-26T02:34:16.491 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-26T02:34:16.757 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-26T02:34:16.882 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:17.069 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-26T02:34:17.460 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-26T02:34:17.554 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-26T02:34:17.726 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-26T02:34:17.944 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-26T02:34:18.007 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-26T02:34:18.085 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:18.257 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:18.460 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-26T02:34:18.522 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-26T02:34:18.710 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:34:18.851 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-26T02:34:18.929 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:19.163 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:34:19.210 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:19.241 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-26T02:34:19.413 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-26T02:34:19.444 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-26T02:34:19.460 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-26T02:34:19.866 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-26T02:34:19.929 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-26T02:34:19.960 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-26T02:34:20.038 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:20.210 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:34:20.335 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-26T02:34:20.444 Engine:Setting original file name "CopilotUpdate.exe" for "c:\windows\systemtemp\copilotupdate.exe.old{9c304e8d-10bc-445a-8771-81a12ae6dd9b}", hr=0x0 2026-09-26T02:34:20.866 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-26T02:34:20.991 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-26T02:34:21.054 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-26T02:34:21.210 Engine:Setting original file name "Vulkan Runtime" for "c:\program files (x86)\microsoft\edgecore\153.0.4234.48\vulkan-1.dll", hr=0x0 2026-09-26T02:34:21.351 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-26T02:34:21.382 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-26T02:34:21.429 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-26T02:34:21.757 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-26T02:34:21.804 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-26T02:34:22.132 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-26T02:34:22.210 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-26T02:34:22.257 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-26T02:34:22.272 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:22.288 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-26T02:34:22.319 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:34:22.319 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-26T02:34:22.335 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:22.960 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-26T02:34:23.241 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:23.491 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:23.585 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-26T02:34:23.835 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:23.851 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:34:23.976 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-26T02:34:24.304 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:24.319 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-26T02:34:24.491 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-26T02:34:24.507 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-26T02:34:24.632 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-26T02:34:24.710 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-26T02:34:24.710 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:24.960 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-26T02:34:24.991 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-26T02:34:25.007 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-26T02:34:25.163 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-26T02:34:25.366 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:25.616 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-26T02:34:25.944 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\systemapps\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-26T02:34:26.054 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-26T02:34:26.179 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:26.366 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-26T02:34:26.522 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:26.538 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-26T02:34:26.554 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:34:26.772 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-26T02:34:26.788 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-26T02:34:27.007 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:27.147 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-26T02:34:27.163 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-26T02:34:27.866 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:34:27.866 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-26T02:34:27.960 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-26T02:34:28.085 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:34:28.085 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:34:28.882 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:29.304 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-26T02:34:29.491 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:29.507 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:29.710 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:29.726 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-26T02:34:29.835 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-26T02:34:29.944 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-26T02:34:29.991 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-26T02:34:30.288 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-26T02:34:30.319 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:30.569 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:34:30.585 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:30.632 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-26T02:34:31.210 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-26T02:34:31.710 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-26T02:34:31.757 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:31.804 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-26T02:34:31.913 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:32.101 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:32.163 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-26T02:34:32.444 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-26T02:34:32.929 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:32.960 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-26T02:34:33.194 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:34:33.335 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-26T02:34:33.522 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-26T02:34:33.538 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:33.788 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-26T02:34:34.147 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-26T02:34:34.179 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:34.288 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:34.397 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-26T02:34:34.429 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-26T02:34:34.772 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-26T02:34:34.882 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:35.054 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-26T02:34:35.085 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-26T02:34:35.101 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:35.147 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:35.304 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-26T02:34:35.366 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:35.772 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-26T02:34:35.851 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-26T02:34:36.351 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-26T02:34:36.397 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-26T02:34:36.476 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-26T02:34:36.569 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-26T02:34:36.601 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:36.632 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-26T02:34:36.679 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-26T02:34:37.116 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-26T02:34:37.288 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-26T02:34:37.507 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-26T02:34:37.522 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-26T02:34:37.851 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-26T02:34:37.851 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:38.147 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-26T02:34:38.491 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-26T02:34:38.772 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-26T02:34:38.835 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-26T02:34:38.897 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-26T02:34:38.944 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:39.116 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-26T02:34:39.163 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-26T02:34:39.194 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-26T02:34:39.288 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-26T02:34:39.601 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-26T02:34:39.647 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:34:39.741 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:34:40.069 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-26T02:34:40.147 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:34:40.319 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-26T02:34:40.538 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-26T02:34:40.804 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-26T02:34:40.819 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:41.179 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-26T02:34:41.194 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:41.241 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-26T02:34:41.476 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-26T02:34:41.726 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-26T02:34:41.741 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-26T02:34:42.038 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-26T02:34:42.116 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-26T02:34:42.226 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-26T02:34:42.304 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:42.335 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-26T02:34:42.460 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-26T02:34:42.663 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-26T02:34:42.819 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-26T02:34:42.897 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-26T02:34:43.054 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-26T02:34:44.288 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-26T02:34:44.679 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-26T02:34:44.835 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-26T02:34:45.069 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:45.304 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-26T02:34:45.538 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-26T02:34:45.788 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-26T02:34:46.054 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-26T02:34:46.147 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-26T02:34:46.179 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-26T02:34:46.179 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-26T02:34:46.304 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-26T02:34:46.585 Engine:Setting original file name " " for "c:\program files (x86)\microsoft\edgecore\153.0.4234.48\dxcompiler.dll", hr=0x0 2026-09-26T02:34:46.788 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-26T02:34:46.804 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:46.804 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-26T02:34:46.882 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-26T02:34:46.913 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-26T02:34:47.007 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-26T02:34:47.351 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-26T02:34:47.444 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-26T02:34:47.632 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-26T02:34:47.647 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:47.741 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-26T02:34:47.757 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-26T02:34:47.976 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-26T02:34:48.038 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:34:48.319 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-26T02:34:48.632 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-26T02:34:49.069 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:34:49.507 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:49.585 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-26T02:34:50.022 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-26T02:34:50.382 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:34:50.491 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:50.726 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-26T02:34:50.991 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:51.054 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-26T02:34:51.210 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-26T02:34:51.366 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-26T02:34:51.772 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-26T02:34:52.476 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-26T02:34:52.554 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-26T02:34:52.632 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-26T02:34:53.194 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:53.507 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-26T02:34:53.788 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-26T02:34:53.866 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-26T02:34:53.976 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-26T02:34:53.976 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-26T02:34:54.429 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-26T02:34:54.538 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-26T02:34:54.554 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:54.585 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-26T02:34:54.882 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-26T02:34:54.897 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:34:55.101 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-26T02:34:55.288 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-26T02:34:55.616 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-26T02:34:56.132 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-26T02:34:56.226 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:34:56.413 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:56.601 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-26T02:34:56.944 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:57.022 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-26T02:34:57.210 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-26T02:34:57.397 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-26T02:34:57.538 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:57.679 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-26T02:34:57.929 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-26T02:34:58.272 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-26T02:34:58.319 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-26T02:34:58.351 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-26T02:34:58.491 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-26T02:34:58.522 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-26T02:34:58.851 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-26T02:34:59.007 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-26T02:34:59.101 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-26T02:35:00.054 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-26T02:35:00.601 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-26T02:35:00.710 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-26T02:35:00.757 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-26T02:35:00.804 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-26T02:35:01.132 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-26T02:35:01.194 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-26T02:35:01.382 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-26T02:35:01.460 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-26T02:35:01.522 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-26T02:35:01.585 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-26T02:35:01.663 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-26T02:35:01.866 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-26T02:35:01.929 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-26T02:35:02.304 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-26T02:35:02.382 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-26T02:35:02.460 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-26T02:35:02.476 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-26T02:35:02.476 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-26T02:35:02.491 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-26T02:35:02.601 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-26T02:35:02.616 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:35:02.632 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-26T02:35:02.679 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-26T02:35:03.038 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-26T02:35:03.069 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-26T02:35:03.397 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:35:03.444 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-26T02:35:03.460 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-26T02:35:03.491 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-26T02:35:04.272 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-26T02:35:04.397 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:35:04.569 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:35:04.569 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-26T02:35:04.835 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-26T02:35:05.022 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-26T02:35:05.132 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-26T02:35:05.210 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-26T02:35:05.851 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-26T02:35:05.882 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-26T02:35:06.022 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-26T02:35:06.038 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-26T02:35:06.038 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:35:06.647 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:35:06.647 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-26T02:35:06.788 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-26T02:35:06.788 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-26T02:35:06.929 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-26T02:35:07.272 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-26T02:35:07.647 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-26T02:35:07.851 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-26T02:35:08.241 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-26T02:35:08.460 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-26T02:35:08.507 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-26T02:35:08.647 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-26T02:35:08.679 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-26T02:35:08.757 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-26T02:35:08.851 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-26T02:35:08.929 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-26T02:35:08.929 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:35:09.163 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-26T02:35:09.241 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-26T02:35:09.522 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-26T02:35:09.632 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-26T02:35:09.788 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-26T02:35:09.804 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:35:09.960 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\de-de\diagpackage.dll.mui", hr=0x0 2026-09-26T02:35:10.101 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-console-l1-1-0.dll", hr=0x0 2026-09-26T02:35:10.257 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0 2026-09-26T02:35:10.257 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-registry-l2-1-0.dll", hr=0x0 2026-09-26T02:35:10.585 Engine:Setting original file name "MrmCore.dll" for "c:\windows\winsxs\wow64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.20348.5020_none_9e6a80bbc86408d7\mrmcorer.dll", hr=0x0 2026-09-26T02:35:10.601 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-26T02:35:10.804 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_en-gb_56416fd74780e848\vsswmi.dll.mui", hr=0x0 2026-09-26T02:35:10.804 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\es-es\aerolite.msstyles.mui", hr=0x0 2026-09-26T02:35:10.960 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_7573f1c6d4639f87\penimc.dll", hr=0x0 2026-09-26T02:35:10.976 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.data.winmd", hr=0x0 2026-09-26T02:35:11.132 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\de-de\ndisimplatcim.dll.mui", hr=0x0 2026-09-26T02:35:11.194 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_4e347e352039867c\diagpackage.dll.mui", hr=0x0 2026-09-26T02:35:11.304 Engine:Setting original file name "winsqlite3" for "c:\windows\winsxs\wow64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.20348.4647_none_c9096b99901f19cd\winsqlite3.dll", hr=0x0 2026-09-26T02:35:11.335 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0 2026-09-26T02:35:11.335 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000c.dll", hr=0x0 2026-09-26T02:35:11.835 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-1-0.dll", hr=0x0 2026-09-26T02:35:11.851 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata000a.dll", hr=0x0 2026-09-26T02:35:12.101 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-2-0.dll", hr=0x0 2026-09-26T02:35:12.194 Engine:Setting original file name "wmic.exe" for "c:\windows\winsxs\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.20348.2849_none_54405a5933961199\wmic.exe", hr=0x0 2026-09-26T02:35:12.397 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.storage.winmd", hr=0x0 2026-09-26T02:35:12.679 Engine:Setting original file name "CRYPT32.DLL" for "c:\windows\systemresources\crypt32.dll.mun", hr=0x0 2026-09-26T02:35:12.897 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_7d8ffbc5cb37c8e0\bootmgr.exe.mui", hr=0x0 2026-09-26T02:35:12.944 Engine:Setting original file name "mstsc.exe" for "c:\windows\systemresources\mstsc.exe.mun", hr=0x0 2026-09-26T02:35:13.163 Engine:Setting original file name "SYSTEMCPL.DLL" for "c:\windows\systemresources\systemcpl.dll.mun", hr=0x0 2026-09-26T02:35:13.210 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0 2026-09-26T02:35:13.366 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1e6e07718388e886\diagpackage.dll.mui", hr=0x0 2026-09-26T02:35:13.413 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0 2026-09-26T02:35:14.022 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0 2026-09-26T02:35:14.022 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mpg4decd_31bf3856ad364e35_10.0.20348.2849_none_08e768f194682e23\mpg4decd.dll", hr=0x0 2026-09-26T02:35:14.038 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0 2026-09-26T02:35:14.069 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0 2026-09-26T02:35:14.272 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-1.dll", hr=0x0 2026-09-26T02:35:14.272 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\naturallanguage6.dll", hr=0x0 2026-09-26T02:35:14.726 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0 2026-09-26T02:35:14.976 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0 2026-09-26T02:35:15.241 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ja-jp_5634cc97d85965d9\bootmgr_ex.efi.mui", hr=0x0 2026-09-26T02:35:15.241 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0 2026-09-26T02:35:15.444 OriginalFileName Maintenance::28401 files in Moac, 0 skipped (cached), 541 filename set 2026-09-26T02:35:15.444 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-26T02:38:07.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T02:38:07.088 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T02:38:07.088 [Cloud] Queued cloud request. 2026-09-26T02:38:07.088 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T02:38:07.088 [Cloud] Dequeued cloud request. 2026-09-26T02:38:07.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T02:38:07.245 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AE74A46C-7A2D-7642-0480-2B140CB26F13} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 02:38:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T02:38:07.745 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-26T02:38:07.760 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T02:38:07.776 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-26T02:38:07.776 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-26T02:38:07.776 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-26T02:38:07.776 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-26T02:38:07.776 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-26T02:38:07.776 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-26T02:38:07.776 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-26T02:38:07.776 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-26T02:38:07.776 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-26T02:38:07.776 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-26T02:38:07.776 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-26T02:38:07.776 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-26T02:38:07.776 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-26T02:38:07.776 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-26T02:38:07.776 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T02:38:07.776 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-26T02:38:07.776 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-26T02:38:07.776 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-26T02:38:07.776 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-26T02:38:07.776 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-26T02:38:07.776 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-26T02:38:07.776 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T02:38:07.776 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T02:38:07.776 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T02:38:10.354 [RTP] Duplicating the current plugin configuration object... 2026-09-26T02:38:10.354 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-26T02:38:10.354 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-26T02:38:10.354 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-26T02:38:10.354 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-26T02:38:10.354 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-26T02:47:20.326 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T02:56:24.844 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T02:56:24.844 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T02:56:24.844 [Cloud] Queued cloud request. 2026-09-26T02:56:24.844 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T02:56:24.844 [Cloud] Dequeued cloud request. 2026-09-26T02:56:24.844 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T02:56:25.047 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F0A1AA8-35CA-1107-0855-BD9FB2AF66B0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 02:56:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T02:56:25.547 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T03:02:25.332 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T03:04:14.004 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T03:04:14.004 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T03:04:14.004 [Cloud] Queued cloud request. 2026-09-26T03:04:14.004 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T03:04:14.004 [Cloud] Dequeued cloud request. 2026-09-26T03:04:14.004 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T03:04:24.129 [Cloud] End of cloud request. 2026-09-26T03:04:24.629 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T03:05:19.738 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T03:05:19.738 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T03:05:19.738 [Cloud] Queued cloud request. 2026-09-26T03:05:19.738 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T03:05:19.738 [Cloud] Dequeued cloud request. 2026-09-26T03:05:19.738 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T03:05:19.816 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{34ECF349-3A36-668E-272A-1F923744FAE4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 03:05:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T03:05:20.332 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T03:08:44.022 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T03:08:44.022 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T03:08:44.022 [Cloud] Queued cloud request. 2026-09-26T03:08:44.022 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T03:08:44.022 [Cloud] Dequeued cloud request. 2026-09-26T03:08:44.022 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T03:08:44.179 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0D9D580E-B95B-E4EA-F2DD-96F5B036F2B3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 03:08:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T03:08:44.679 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T03:15:35.837 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T03:15:35.837 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T03:15:35.837 [Cloud] Queued cloud request. 2026-09-26T03:15:35.837 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T03:15:35.837 [Cloud] Dequeued cloud request. 2026-09-26T03:15:35.837 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T03:15:35.993 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CC799C27-A848-5309-0F75-73BB79D1F462} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 03:15:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T03:15:36.493 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T03:17:30.338 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T03:32:35.344 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T03:39:40.363 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 18348, Count: 1336, MaxTime: 312, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\js\jquery.js, EstimatedImpact: 0% 2026-09-26T03:39:40.363 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 6595, Count: 590, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T03:39:40.363 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 2591, Count: 208, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-26T03:39:40.363 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-26T03:39:40.363 ProcessImageName: AgentShellService.exe, Pid: 1664, TotalTime: 665, Count: 24, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-26T03:39:40.363 ProcessImageName: WmiPrvSE.exe, Pid: 6284, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-26T03:39:40.363 ProcessImageName: WmiPrvSE.exe, Pid: 6952, TotalTime: 498, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 42% 2026-09-26T03:39:40.363 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 452, Count: 31, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-26T03:39:40.363 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T03:39:40.363 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 105, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-26T03:39:40.363 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-26T03:39:40.363 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-26T03:39:40.363 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23b3e-0.MAI, EstimatedImpact: 0% 2026-09-26T03:39:40.363 ProcessImageName: powershell.exe, Pid: 5824, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_2oan4zek.qzq.ps1, EstimatedImpact: 0% 2026-09-26T03:39:40.363 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-26T03:39:40.363 ProcessImageName: taskhostw.exe, Pid: 7052, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-26T03:39:40.363 ProcessImageName: DeviceCensus.exe, Pid: 5524, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-26T03:39:40.363 ProcessImageName: mysqldump.exe, Pid: 7892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 12% 2026-09-26T03:39:40.363 ProcessImageName: cmd.exe, Pid: 3244, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-26T03:39:40.363 ProcessImageName: ngentask.exe, Pid: 6032, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-26T03:39:40.363 ProcessImageName: powershell.exe, Pid: 6680, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4003.tmp, EstimatedImpact: 0% 2026-09-26T03:39:40.363 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-26T03:47:40.351 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T03:52:52.790 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T03:52:52.790 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T03:52:52.790 [Cloud] Queued cloud request. 2026-09-26T03:52:52.790 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T03:52:52.790 [Cloud] Dequeued cloud request. 2026-09-26T03:52:52.790 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T03:52:52.946 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D8C03524-80B7-5136-9B3E-C4EAF4358437} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 03:52:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T03:52:53.446 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T03:58:20.668 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T03:58:20.668 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T03:58:20.668 [Cloud] Queued cloud request. 2026-09-26T03:58:20.668 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T03:58:20.668 [Cloud] Dequeued cloud request. 2026-09-26T03:58:20.668 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T03:58:20.808 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{77C4D1A1-E107-1268-724C-FD1D9D50DDB3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 03:58:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T03:58:21.324 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T04:02:45.356 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T04:02:50.293 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T04:02:50.293 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T04:02:50.293 [Cloud] Queued cloud request. 2026-09-26T04:02:50.293 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T04:02:50.293 [Cloud] Dequeued cloud request. 2026-09-26T04:02:50.293 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T04:02:50.434 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{892136A8-C3BB-8250-C96E-7E5A383B79F0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 04:02:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T04:02:50.934 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T04:17:50.363 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T04:21:45.770 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T04:21:45.770 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T04:21:45.770 [Cloud] Queued cloud request. 2026-09-26T04:21:45.770 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T04:21:45.770 [Cloud] Dequeued cloud request. 2026-09-26T04:21:45.770 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T04:21:45.927 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{123DDD48-BE81-6407-FD9E-35EB11F65ABB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 04:21:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T04:21:46.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T04:32:55.367 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T04:42:27.716 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T04:42:27.716 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T04:42:27.716 [Cloud] Queued cloud request. 2026-09-26T04:42:27.716 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T04:42:27.716 [Cloud] Dequeued cloud request. 2026-09-26T04:42:27.716 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T04:42:27.873 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CB9260CC-4561-55D6-DCAF-2CD5C5C4E84E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 04:42:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T04:42:28.373 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T04:48:00.375 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T04:49:52.954 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T04:49:52.954 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T04:49:52.954 [Cloud] Queued cloud request. 2026-09-26T04:49:52.954 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T04:49:52.954 [Cloud] Dequeued cloud request. 2026-09-26T04:49:52.954 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T04:49:53.110 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E7A8B4E4-EDF2-D0B4-30F6-B0AB199B6B6B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 04:49:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T04:49:53.610 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T04:52:41.094 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T04:52:41.094 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T04:52:41.094 [Cloud] Queued cloud request. 2026-09-26T04:52:41.094 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T04:52:41.250 [Cloud] Dequeued cloud request. 2026-09-26T04:52:41.250 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T04:52:41.375 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BFB3344C-F769-539B-3C34-CCC8D8854316} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 04:52:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T04:52:41.891 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T04:54:33.470 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T04:54:33.470 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T04:54:33.470 [Cloud] Queued cloud request. 2026-09-26T04:54:33.470 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T04:54:33.470 [Cloud] Dequeued cloud request. 2026-09-26T04:54:33.470 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T04:54:33.657 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C0BE0AA7-8F3C-08CA-466E-9E976012E3C4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 04:54:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T04:54:34.173 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T05:03:05.380 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T05:06:02.085 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T05:06:02.085 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T05:06:02.085 [Cloud] Queued cloud request. 2026-09-26T05:06:02.085 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T05:06:02.085 [Cloud] Dequeued cloud request. 2026-09-26T05:06:02.085 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T05:06:02.273 [Cloud] End of cloud request. 2026-09-26T05:06:02.773 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T05:18:10.403 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T05:24:18.576 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T05:24:18.576 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T05:24:18.576 [Cloud] Queued cloud request. 2026-09-26T05:24:18.576 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T05:24:18.576 [Cloud] Dequeued cloud request. 2026-09-26T05:24:18.576 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T05:24:18.732 [Cloud] End of cloud request. 2026-09-26T05:24:19.232 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T05:28:32.329 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T05:28:32.329 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T05:28:32.329 [Cloud] Queued cloud request. 2026-09-26T05:28:32.329 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T05:28:32.329 [Cloud] Dequeued cloud request. 2026-09-26T05:28:32.329 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T05:28:32.517 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D2D01F96-35E5-C159-9094-70EBE19579FE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 05:28:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T05:28:33.032 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T05:33:15.392 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T05:39:40.427 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 23625, Count: 1770, MaxTime: 359, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\js\jquery.js, EstimatedImpact: 0% 2026-09-26T05:39:40.427 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 6595, Count: 590, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T05:39:40.427 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 4775, Count: 404, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-26T05:39:40.427 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-26T05:39:40.427 ProcessImageName: AgentShellService.exe, Pid: 1664, TotalTime: 665, Count: 24, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-26T05:39:40.427 ProcessImageName: WmiPrvSE.exe, Pid: 6284, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-26T05:39:40.427 ProcessImageName: WmiPrvSE.exe, Pid: 6952, TotalTime: 498, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 42% 2026-09-26T05:39:40.427 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 482, Count: 33, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-26T05:39:40.427 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T05:39:40.427 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 120, Count: 11, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-26T05:39:40.427 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-26T05:39:40.427 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-26T05:39:40.427 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23b3e-0.MAI, EstimatedImpact: 0% 2026-09-26T05:39:40.427 ProcessImageName: powershell.exe, Pid: 5824, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_2oan4zek.qzq.ps1, EstimatedImpact: 0% 2026-09-26T05:39:40.427 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-26T05:39:40.427 ProcessImageName: taskhostw.exe, Pid: 7052, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-26T05:39:40.427 ProcessImageName: DeviceCensus.exe, Pid: 5524, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-26T05:39:40.427 ProcessImageName: mysqldump.exe, Pid: 7892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 12% 2026-09-26T05:39:40.427 ProcessImageName: cmd.exe, Pid: 3244, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-26T05:39:40.427 ProcessImageName: ngentask.exe, Pid: 6032, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-26T05:39:40.427 ProcessImageName: powershell.exe, Pid: 6680, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4003.tmp, EstimatedImpact: 0% 2026-09-26T05:39:40.427 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-26T05:45:13.866 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T05:45:13.866 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T05:45:13.866 [Cloud] Queued cloud request. 2026-09-26T05:45:13.866 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T05:45:13.866 [Cloud] Dequeued cloud request. 2026-09-26T05:45:13.866 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T05:45:23.256 [Cloud] End of cloud request. 2026-09-26T05:45:23.772 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T05:48:20.400 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T05:53:16.104 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T05:53:16.104 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T05:53:16.104 [Cloud] Queued cloud request. 2026-09-26T05:53:16.104 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T05:53:16.104 [Cloud] Dequeued cloud request. 2026-09-26T05:53:16.104 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T05:53:16.244 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F9E51C4B-884F-563E-7D87-392E5BF21ECB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 05:53:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T05:53:16.744 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T05:58:17.107 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T05:58:17.107 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T05:58:17.107 [Cloud] Queued cloud request. 2026-09-26T05:58:17.107 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T05:58:17.107 [Cloud] Dequeued cloud request. 2026-09-26T05:58:17.107 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T05:58:17.341 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BC8792D9-BF0A-8C45-50CE-DA5132782C8D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 05:58:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T05:58:17.857 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:03:25.404 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T06:04:38.140 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:04:38.140 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:04:38.140 [Cloud] Queued cloud request. 2026-09-26T06:04:38.140 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:04:38.140 [Cloud] Dequeued cloud request. 2026-09-26T06:04:38.140 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:04:38.312 [Cloud] End of cloud request. 2026-09-26T06:04:38.812 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:06:03.829 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:06:03.829 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:06:03.829 [Cloud] Queued cloud request. 2026-09-26T06:06:03.829 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:06:03.829 [Cloud] Dequeued cloud request. 2026-09-26T06:06:03.829 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:06:04.001 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{99CD6128-C4E5-6053-3BD7-C03A4FB25068} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 06:06:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T06:06:04.501 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:12:32.017 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:12:32.017 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:12:32.017 [Cloud] Queued cloud request. 2026-09-26T06:12:32.017 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:12:32.017 [Cloud] Dequeued cloud request. 2026-09-26T06:12:32.017 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:12:32.205 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AE36951F-BDD2-87CE-4772-D3F440B62D9A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 06:12:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T06:12:32.705 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:17:49.802 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:17:49.802 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:17:49.802 [Cloud] Queued cloud request. 2026-09-26T06:17:49.802 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:17:49.802 [Cloud] Dequeued cloud request. 2026-09-26T06:17:49.802 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:17:50.052 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{54BB26A6-F39D-E0B1-527D-B40BB1933632} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 06:17:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T06:17:50.568 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:18:30.412 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T06:24:19.288 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:24:19.288 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:24:19.288 [Cloud] Queued cloud request. 2026-09-26T06:24:19.288 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:24:19.444 [Cloud] Dequeued cloud request. 2026-09-26T06:24:19.444 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:24:19.616 [Cloud] End of cloud request. 2026-09-26T06:24:20.116 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:25:30.789 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:25:30.789 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:25:30.789 [Cloud] Queued cloud request. 2026-09-26T06:25:30.789 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:25:30.789 [Cloud] Dequeued cloud request. 2026-09-26T06:25:30.789 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:25:30.961 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3B632052-0B36-1C22-CF1C-044A89205013} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 06:25:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T06:25:31.461 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:31:37.948 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:31:37.948 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:31:37.948 [Cloud] Queued cloud request. 2026-09-26T06:31:37.948 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:31:37.948 [Cloud] Dequeued cloud request. 2026-09-26T06:31:37.948 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:31:38.167 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6B13B087-F198-F615-1586-9C517775858D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 06:31:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T06:31:38.667 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:33:35.418 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T06:35:39.888 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:35:39.888 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:35:39.888 [Cloud] Queued cloud request. 2026-09-26T06:35:39.888 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:35:39.888 [Cloud] Dequeued cloud request. 2026-09-26T06:35:39.888 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:35:40.028 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{44E517F6-E80E-D4AA-26D3-A55F2AA0FD3D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 06:35:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T06:35:40.528 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:36:47.123 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:36:47.123 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:36:47.123 [Cloud] Queued cloud request. 2026-09-26T06:36:47.123 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:36:47.123 [Cloud] Dequeued cloud request. 2026-09-26T06:36:47.123 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:36:47.263 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{27B72AF1-5CD7-1550-E002-563DA6FCCDE3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 06:36:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T06:36:47.779 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:41:23.326 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:41:23.326 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:41:23.326 [Cloud] Queued cloud request. 2026-09-26T06:41:23.326 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:41:23.326 [Cloud] Dequeued cloud request. 2026-09-26T06:41:23.326 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:41:23.467 [Cloud] End of cloud request. 2026-09-26T06:41:23.967 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:44:27.828 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:44:27.828 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:44:27.828 [Cloud] Queued cloud request. 2026-09-26T06:44:27.828 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:44:27.828 [Cloud] Dequeued cloud request. 2026-09-26T06:44:27.828 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:44:27.984 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3E98AD2B-EC0C-9328-E0FE-2CB287F49EB6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 06:44:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T06:44:28.484 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:45:19.063 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:45:19.063 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:45:19.063 [Cloud] Queued cloud request. 2026-09-26T06:45:19.063 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:45:19.360 [Cloud] Dequeued cloud request. 2026-09-26T06:45:19.360 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:45:19.454 [Cloud] End of cloud request. 2026-09-26T06:45:19.954 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:48:40.424 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T06:49:51.737 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:49:51.737 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:49:51.737 [Cloud] Queued cloud request. 2026-09-26T06:49:51.737 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:49:51.737 [Cloud] Dequeued cloud request. 2026-09-26T06:49:51.737 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:49:51.925 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{98E60C26-33A5-B059-99CB-2AD1B8ADD3EF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 06:49:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T06:49:52.425 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T06:50:56.878 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T06:50:56.878 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T06:50:56.878 [Cloud] Queued cloud request. 2026-09-26T06:50:56.878 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T06:50:56.878 [Cloud] Dequeued cloud request. 2026-09-26T06:50:56.878 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T06:50:57.050 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7AEF864F-7794-C4F4-CA5A-990A69DFADA9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 06:50:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T06:50:57.566 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T07:03:45.428 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T07:06:19.572 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T07:06:19.572 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T07:06:19.572 [Cloud] Queued cloud request. 2026-09-26T07:06:19.572 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T07:06:19.572 [Cloud] Dequeued cloud request. 2026-09-26T07:06:19.572 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T07:06:19.744 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{70AAC426-0FC6-DF19-9F87-42D5E67B71C6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 07:06:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T07:06:20.244 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T07:18:50.437 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T07:25:57.922 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T07:25:57.922 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T07:25:57.922 [Cloud] Queued cloud request. 2026-09-26T07:25:57.922 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T07:25:57.922 [Cloud] Dequeued cloud request. 2026-09-26T07:25:57.922 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T07:25:58.125 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4C217C7A-A75A-BD66-D45D-7E273278ED11} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 07:25:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T07:25:58.625 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T07:33:55.442 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T07:39:40.476 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27420, Count: 1967, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-26T07:39:40.476 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 6958, Count: 599, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-26T07:39:40.476 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 6595, Count: 590, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T07:39:40.476 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-26T07:39:40.476 ProcessImageName: AgentShellService.exe, Pid: 1664, TotalTime: 665, Count: 24, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-26T07:39:40.476 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 649, Count: 43, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-26T07:39:40.476 ProcessImageName: WmiPrvSE.exe, Pid: 6284, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-26T07:39:40.476 ProcessImageName: WmiPrvSE.exe, Pid: 6952, TotalTime: 498, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 42% 2026-09-26T07:39:40.476 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T07:39:40.476 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 150, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-26T07:39:40.476 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-26T07:39:40.476 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-26T07:39:40.476 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23b3e-0.MAI, EstimatedImpact: 0% 2026-09-26T07:39:40.476 ProcessImageName: powershell.exe, Pid: 5824, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_2oan4zek.qzq.ps1, EstimatedImpact: 0% 2026-09-26T07:39:40.476 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-26T07:39:40.476 ProcessImageName: taskhostw.exe, Pid: 7052, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-26T07:39:40.476 ProcessImageName: DeviceCensus.exe, Pid: 5524, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-26T07:39:40.476 ProcessImageName: mysqldump.exe, Pid: 7892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 12% 2026-09-26T07:39:40.476 ProcessImageName: cmd.exe, Pid: 3244, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-26T07:39:40.476 ProcessImageName: ngentask.exe, Pid: 6032, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-26T07:39:40.476 ProcessImageName: powershell.exe, Pid: 6680, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4003.tmp, EstimatedImpact: 0% 2026-09-26T07:39:40.476 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-26T07:49:00.449 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T08:04:05.454 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T08:06:26.002 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T08:06:26.002 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T08:06:26.002 [Cloud] Queued cloud request. 2026-09-26T08:06:26.002 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T08:06:26.002 [Cloud] Dequeued cloud request. 2026-09-26T08:06:26.002 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T08:06:26.190 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1EFCAA6D-5DBC-88C6-417D-3CFE923E3067} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 08:06:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T08:06:26.690 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T08:14:05.177 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T08:14:05.177 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T08:14:05.177 [Cloud] Queued cloud request. 2026-09-26T08:14:05.177 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T08:14:05.177 [Cloud] Dequeued cloud request. 2026-09-26T08:14:05.177 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T08:14:05.381 [Cloud] End of cloud request. 2026-09-26T08:14:05.881 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T08:19:10.461 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T08:26:08.245 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T08:26:08.245 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T08:26:08.245 [Cloud] Queued cloud request. 2026-09-26T08:26:08.245 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T08:26:08.245 [Cloud] Dequeued cloud request. 2026-09-26T08:26:08.245 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T08:26:08.433 [Cloud] End of cloud request. 2026-09-26T08:26:08.933 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T08:26:49.636 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T08:26:49.636 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T08:26:49.636 [Cloud] Queued cloud request. 2026-09-26T08:26:49.636 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T08:26:49.636 [Cloud] Dequeued cloud request. 2026-09-26T08:26:49.636 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T08:26:49.714 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{21F37BBF-3DA9-7159-AFA5-067C6F69D1A7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 08:26:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T08:26:50.214 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T08:32:14.122 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T08:32:14.122 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T08:32:14.122 [Cloud] Queued cloud request. 2026-09-26T08:32:14.122 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T08:32:14.122 [Cloud] Dequeued cloud request. 2026-09-26T08:32:14.122 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T08:32:14.294 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{53C9EE04-E019-1D33-BB37-44E140EDADAB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 08:32:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T08:32:14.809 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T08:34:15.466 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T08:34:50.216 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T08:34:50.216 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T08:34:50.216 [Cloud] Queued cloud request. 2026-09-26T08:34:50.216 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T08:34:50.403 [Cloud] Dequeued cloud request. 2026-09-26T08:34:50.403 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T08:35:00.544 [Cloud] End of cloud request. 2026-09-26T08:35:00.966 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T08:35:00.966 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T08:35:00.966 [Cloud] Queued cloud request. 2026-09-26T08:35:00.966 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T08:35:00.966 [Cloud] Dequeued cloud request. 2026-09-26T08:35:00.966 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T08:35:01.044 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T08:35:01.044 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{33754662-CF5E-A0F4-62DF-0ADDF8D03D0F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 08:35:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T08:35:01.544 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T08:49:20.473 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T09:02:32.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T09:02:32.337 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T09:02:32.337 [Cloud] Queued cloud request. 2026-09-26T09:02:32.337 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T09:02:32.337 [Cloud] Dequeued cloud request. 2026-09-26T09:02:32.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T09:02:32.540 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9D6D6B68-72A3-7B91-0740-311BA8BE255F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 09:02:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T09:02:33.040 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T09:04:02.401 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T09:04:02.401 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T09:04:02.401 [Cloud] Queued cloud request. 2026-09-26T09:04:02.401 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T09:04:02.401 [Cloud] Dequeued cloud request. 2026-09-26T09:04:02.401 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T09:04:02.589 [Cloud] End of cloud request. 2026-09-26T09:04:03.089 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T09:04:25.480 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T09:07:20.575 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T09:07:20.575 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T09:07:20.575 [Cloud] Queued cloud request. 2026-09-26T09:07:20.575 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T09:07:20.575 [Cloud] Dequeued cloud request. 2026-09-26T09:07:20.575 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T09:07:20.747 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EEE7396A-41D1-F39A-5EC7-4C638CF7279D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 09:07:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T09:07:21.247 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T09:09:04.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T09:09:04.700 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T09:09:04.700 [Cloud] Queued cloud request. 2026-09-26T09:09:04.700 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T09:09:04.700 [Cloud] Dequeued cloud request. 2026-09-26T09:09:04.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T09:09:04.872 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6911F76F-C698-BA83-9B93-7887C68695EF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 09:09:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T09:09:05.388 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T09:16:13.328 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T09:16:13.328 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T09:16:13.328 [Cloud] Queued cloud request. 2026-09-26T09:16:13.328 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T09:16:13.328 [Cloud] Dequeued cloud request. 2026-09-26T09:16:13.328 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T09:16:13.516 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{27A00281-3A1B-A894-3987-F8A026158E82} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 09:16:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T09:16:14.031 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T09:19:30.486 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T09:25:49.113 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T09:25:49.113 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T09:25:49.113 [Cloud] Queued cloud request. 2026-09-26T09:25:49.113 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T09:25:49.113 [Cloud] Dequeued cloud request. 2026-09-26T09:25:49.113 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T09:25:49.316 [Cloud] End of cloud request. 2026-09-26T09:25:49.832 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T09:26:53.457 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T09:26:53.457 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T09:26:53.457 [Cloud] Queued cloud request. 2026-09-26T09:26:53.457 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T09:26:53.457 [Cloud] Dequeued cloud request. 2026-09-26T09:26:53.457 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T09:26:53.644 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F96FE3CB-A97B-326C-8596-D0F63C8A925D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 09:26:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T09:26:54.160 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T09:34:35.491 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T09:39:40.541 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 29027, Count: 2060, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-26T09:39:40.541 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 9046, Count: 794, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-26T09:39:40.541 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 6595, Count: 590, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T09:39:40.541 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-26T09:39:40.541 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 709, Count: 49, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-26T09:39:40.541 ProcessImageName: AgentShellService.exe, Pid: 1664, TotalTime: 665, Count: 24, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-26T09:39:40.541 ProcessImageName: WmiPrvSE.exe, Pid: 6284, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-26T09:39:40.541 ProcessImageName: WmiPrvSE.exe, Pid: 6952, TotalTime: 498, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 42% 2026-09-26T09:39:40.541 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T09:39:40.541 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 180, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-26T09:39:40.541 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-26T09:39:40.541 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-26T09:39:40.541 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23b3e-0.MAI, EstimatedImpact: 0% 2026-09-26T09:39:40.541 ProcessImageName: powershell.exe, Pid: 5824, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_2oan4zek.qzq.ps1, EstimatedImpact: 0% 2026-09-26T09:39:40.541 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-26T09:39:40.541 ProcessImageName: taskhostw.exe, Pid: 7052, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-26T09:39:40.541 ProcessImageName: DeviceCensus.exe, Pid: 5524, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-26T09:39:40.541 ProcessImageName: mysqldump.exe, Pid: 7892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 12% 2026-09-26T09:39:40.541 ProcessImageName: cmd.exe, Pid: 3244, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-26T09:39:40.541 ProcessImageName: ngentask.exe, Pid: 6032, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-26T09:39:40.541 ProcessImageName: powershell.exe, Pid: 6680, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4003.tmp, EstimatedImpact: 0% 2026-09-26T09:39:40.541 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-26T09:47:15.512 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T09:47:15.512 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T09:47:15.512 [Cloud] Queued cloud request. 2026-09-26T09:47:15.512 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T09:47:15.512 [Cloud] Dequeued cloud request. 2026-09-26T09:47:15.512 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T09:47:15.668 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EDD5E247-1A8B-7DEF-7C72-0B3F04E8F202} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 09:47:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T09:47:16.184 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T09:49:35.514 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T09:49:35.514 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T09:49:35.514 [Cloud] Queued cloud request. 2026-09-26T09:49:35.514 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T09:49:35.514 [Cloud] Dequeued cloud request. 2026-09-26T09:49:35.514 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T09:49:35.655 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CFD98748-79D2-D296-BCE9-BC8730F872E7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 09:49:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T09:49:36.155 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T09:49:40.499 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T10:04:45.505 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T10:04:47.381 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T10:04:47.381 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T10:04:47.381 [Cloud] Queued cloud request. 2026-09-26T10:04:47.381 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T10:04:47.381 [Cloud] Dequeued cloud request. 2026-09-26T10:04:47.381 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T10:04:47.568 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AA88228F-B178-FC58-CDA5-286D66DBE311} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 10:04:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T10:04:48.084 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T10:07:39.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T10:07:39.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T10:07:39.304 [Cloud] Queued cloud request. 2026-09-26T10:07:39.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T10:07:39.304 [Cloud] Dequeued cloud request. 2026-09-26T10:07:39.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T10:07:39.491 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C821A0B7-149A-08D4-B584-F38C73E7848F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 10:07:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T10:07:39.991 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T10:08:11.117 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T10:08:11.117 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T10:08:11.117 [Cloud] Queued cloud request. 2026-09-26T10:08:11.117 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T10:08:11.117 [Cloud] Dequeued cloud request. 2026-09-26T10:08:11.117 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T10:08:11.195 [Cloud] End of cloud request. 2026-09-26T10:08:11.695 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T10:09:22.773 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T10:09:22.773 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T10:09:22.773 [Cloud] Queued cloud request. 2026-09-26T10:09:22.773 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T10:09:22.773 [Cloud] Dequeued cloud request. 2026-09-26T10:09:22.773 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T10:09:26.773 [Cloud] End of cloud request. 2026-09-26T10:09:27.273 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T10:11:02.867 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T10:11:02.867 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T10:11:02.867 [Cloud] Queued cloud request. 2026-09-26T10:11:02.867 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T10:11:02.867 [Cloud] Dequeued cloud request. 2026-09-26T10:11:02.867 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T10:11:03.055 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A4C722D6-1807-2DDE-EF30-45665243BA0D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 10:11:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T10:11:03.555 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T10:11:33.164 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T10:11:33.164 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T10:11:33.164 [Cloud] Queued cloud request. 2026-09-26T10:11:33.164 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T10:11:33.164 [Cloud] Dequeued cloud request. 2026-09-26T10:11:33.164 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T10:11:33.258 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CF5D7DD5-FFDE-DB9C-9E42-14EACECAB999} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 10:11:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T10:11:33.758 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T10:13:19.117 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T10:13:19.117 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T10:13:19.117 [Cloud] Queued cloud request. 2026-09-26T10:13:19.117 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T10:13:19.320 [Cloud] Dequeued cloud request. 2026-09-26T10:13:19.320 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T10:13:19.508 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{90716C88-C115-8A72-0A90-93EB22AD0081} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 10:13:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T10:13:20.023 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T10:19:50.512 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T10:23:00.310 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T10:23:00.310 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T10:23:00.310 [Cloud] Queued cloud request. 2026-09-26T10:23:00.310 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T10:23:00.310 [Cloud] Dequeued cloud request. 2026-09-26T10:23:00.310 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T10:23:00.450 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C83419DC-207D-7405-6A14-062FB1D6139C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 10:23:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T10:23:00.966 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T10:26:56.859 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T10:26:56.859 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T10:26:56.859 [Cloud] Queued cloud request. 2026-09-26T10:26:56.859 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T10:26:56.859 [Cloud] Dequeued cloud request. 2026-09-26T10:26:56.859 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T10:27:02.015 [Cloud] End of cloud request. 2026-09-26T10:27:02.516 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T10:27:17.547 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T10:27:17.547 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T10:27:17.547 [Cloud] Queued cloud request. 2026-09-26T10:27:17.547 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T10:27:17.547 [Cloud] Dequeued cloud request. 2026-09-26T10:27:17.547 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T10:27:17.641 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{129199E6-5FBB-7C7B-0C5D-EF38FAE0CBEB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 10:27:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T10:27:18.141 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T10:34:55.519 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T10:47:32.728 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T10:47:32.728 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T10:47:32.728 [Cloud] Queued cloud request. 2026-09-26T10:47:32.728 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T10:47:32.728 [Cloud] Dequeued cloud request. 2026-09-26T10:47:32.728 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T10:47:42.931 [Cloud] End of cloud request. 2026-09-26T10:47:43.447 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T10:50:00.526 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T10:53:34.744 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T10:53:34.744 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T10:53:34.744 [Cloud] Queued cloud request. 2026-09-26T10:53:34.744 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T10:53:34.744 [Cloud] Dequeued cloud request. 2026-09-26T10:53:34.744 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T10:53:34.901 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AE69E5A4-ACA5-C081-92F3-9B70FE2594C4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 10:53:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T10:53:35.416 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T11:00:47.640 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T11:00:47.640 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T11:00:47.640 [Cloud] Queued cloud request. 2026-09-26T11:00:47.640 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T11:00:47.640 [Cloud] Dequeued cloud request. 2026-09-26T11:00:47.640 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T11:00:47.780 [Cloud] End of cloud request. 2026-09-26T11:00:48.280 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T11:05:05.533 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T11:05:31.455 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T11:05:31.455 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T11:05:31.455 [Cloud] Queued cloud request. 2026-09-26T11:05:31.455 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T11:05:31.486 [Cloud] Dequeued cloud request. 2026-09-26T11:05:31.486 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T11:05:31.611 [Cloud] End of cloud request. 2026-09-26T11:05:32.111 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T11:05:36.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T11:05:36.643 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T11:05:36.643 [Cloud] Queued cloud request. 2026-09-26T11:05:36.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T11:05:36.643 [Cloud] Dequeued cloud request. 2026-09-26T11:05:36.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T11:05:36.736 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5F6E3F3B-933E-B68B-11C4-9692923A8899} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 11:05:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T11:05:37.236 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T11:08:32.629 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T11:08:32.629 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T11:08:32.629 [Cloud] Queued cloud request. 2026-09-26T11:08:32.629 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T11:08:32.629 [Cloud] Dequeued cloud request. 2026-09-26T11:08:32.629 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T11:08:32.770 [Cloud] End of cloud request. 2026-09-26T11:08:33.285 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T11:11:23.379 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T11:11:23.379 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T11:11:23.379 [Cloud] Queued cloud request. 2026-09-26T11:11:23.379 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T11:11:23.379 [Cloud] Dequeued cloud request. 2026-09-26T11:11:23.379 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T11:11:23.535 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9C6A56F5-E603-36D1-2DF8-D7A016374F73} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 11:11:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T11:11:24.051 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T11:20:10.540 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T11:20:37.540 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T11:20:37.540 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T11:20:37.540 [Cloud] Queued cloud request. 2026-09-26T11:20:37.540 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T11:20:37.540 [Cloud] Dequeued cloud request. 2026-09-26T11:20:37.696 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T11:20:37.852 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{982ADC3D-0658-127D-2755-CACD2DE73477} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 11:20:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T11:20:38.352 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T11:21:55.634 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T11:21:55.634 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T11:21:55.634 [Cloud] Queued cloud request. 2026-09-26T11:21:55.634 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T11:21:55.634 [Cloud] Dequeued cloud request. 2026-09-26T11:21:55.634 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T11:21:55.774 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E0E2B6A2-8F63-76AC-1F97-4B30CACB3306} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 11:21:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T11:21:56.290 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T11:23:32.915 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T11:23:32.915 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T11:23:32.915 [Cloud] Queued cloud request. 2026-09-26T11:23:32.915 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T11:23:32.915 [Cloud] Dequeued cloud request. 2026-09-26T11:23:32.915 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T11:23:33.102 [Cloud] End of cloud request. 2026-09-26T11:23:33.602 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T11:27:59.763 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T11:27:59.763 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T11:27:59.763 [Cloud] Queued cloud request. 2026-09-26T11:27:59.763 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T11:27:59.763 [Cloud] Dequeued cloud request. 2026-09-26T11:27:59.763 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T11:27:59.951 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A409E215-3DA7-5E83-172D-DBB075071313} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 11:27:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T11:28:00.467 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T11:29:07.060 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T11:29:07.060 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T11:29:07.060 [Cloud] Queued cloud request. 2026-09-26T11:29:07.060 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T11:29:07.060 [Cloud] Dequeued cloud request. 2026-09-26T11:29:07.060 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T11:29:07.295 [Cloud] End of cloud request. 2026-09-26T11:29:07.795 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T11:35:15.548 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T11:39:40.612 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 34168, Count: 2414, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-26T11:39:40.612 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 11040, Count: 990, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-26T11:39:40.612 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 6595, Count: 590, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T11:39:40.612 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-26T11:39:40.612 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 739, Count: 51, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-26T11:39:40.612 ProcessImageName: AgentShellService.exe, Pid: 1664, TotalTime: 665, Count: 24, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-26T11:39:40.612 ProcessImageName: WmiPrvSE.exe, Pid: 6284, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-26T11:39:40.612 ProcessImageName: WmiPrvSE.exe, Pid: 6952, TotalTime: 498, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 42% 2026-09-26T11:39:40.612 ProcessImageName: powershell.exe, Pid: 5972, TotalTime: 230, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 22% 2026-09-26T11:39:40.612 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T11:39:40.612 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-26T11:39:40.612 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23b3e-0.MAI, EstimatedImpact: 0% 2026-09-26T11:39:40.612 ProcessImageName: python.exe, Pid: 5740, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 4% 2026-09-26T11:39:40.612 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-26T11:39:40.612 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-26T11:39:40.612 ProcessImageName: powershell.exe, Pid: 5824, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_2oan4zek.qzq.ps1, EstimatedImpact: 0% 2026-09-26T11:39:40.612 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-26T11:39:40.612 ProcessImageName: taskhostw.exe, Pid: 7052, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-26T11:39:40.612 ProcessImageName: DeviceCensus.exe, Pid: 5524, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-26T11:39:40.612 ProcessImageName: mysqldump.exe, Pid: 7892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 12% 2026-09-26T11:39:40.612 ProcessImageName: cmd.exe, Pid: 3244, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-26T11:39:40.612 ProcessImageName: ngentask.exe, Pid: 6032, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-26T11:39:40.612 ProcessImageName: powershell.exe, Pid: 6680, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4003.tmp, EstimatedImpact: 0% 2026-09-26T11:39:40.612 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-26T11:44:10.552 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T11:44:10.552 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T11:44:10.552 [Cloud] Queued cloud request. 2026-09-26T11:44:10.552 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T11:44:10.552 [Cloud] Dequeued cloud request. 2026-09-26T11:44:10.552 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T11:44:10.708 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C013DD6B-8733-035E-40E1-BE4B1AB017B6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 11:44:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T11:44:11.208 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T11:50:20.555 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T12:00:37.231 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T12:00:37.231 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T12:00:37.231 [Cloud] Queued cloud request. 2026-09-26T12:00:37.231 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T12:00:37.231 [Cloud] Dequeued cloud request. 2026-09-26T12:00:37.231 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T12:00:37.387 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{571FE37D-F612-BB76-D775-E5E48D6B2B46} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 12:00:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T12:00:37.887 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T12:05:25.562 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T12:06:14.110 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T12:06:14.110 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T12:06:14.110 [Cloud] Queued cloud request. 2026-09-26T12:06:14.110 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T12:06:14.110 [Cloud] Dequeued cloud request. 2026-09-26T12:06:14.110 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T12:06:14.266 [Cloud] End of cloud request. 2026-09-26T12:06:14.766 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T12:09:15.814 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T12:09:15.814 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T12:09:15.814 [Cloud] Queued cloud request. 2026-09-26T12:09:15.814 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T12:09:15.814 [Cloud] Dequeued cloud request. 2026-09-26T12:09:15.814 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T12:09:15.955 [Cloud] End of cloud request. 2026-09-26T12:09:16.471 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T12:10:12.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T12:10:12.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T12:10:12.049 [Cloud] Queued cloud request. 2026-09-26T12:10:12.049 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T12:10:12.049 [Cloud] Dequeued cloud request. 2026-09-26T12:10:12.299 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T12:10:12.377 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1CCD9F46-7B1A-A26C-BEE4-96717FCEA21A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 12:10:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T12:10:12.892 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T12:20:30.569 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T12:22:15.460 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T12:22:15.460 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T12:22:15.460 [Cloud] Queued cloud request. 2026-09-26T12:22:15.460 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T12:22:15.460 [Cloud] Dequeued cloud request. 2026-09-26T12:22:15.460 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T12:22:15.632 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A26F47E4-1BF0-6E72-24A8-9E4C998E0E3D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 12:22:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T12:22:16.132 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T12:24:16.853 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T12:24:16.853 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T12:24:16.853 [Cloud] Queued cloud request. 2026-09-26T12:24:16.853 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T12:24:16.853 [Cloud] Dequeued cloud request. 2026-09-26T12:24:16.853 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T12:24:17.024 [Cloud] End of cloud request. 2026-09-26T12:24:17.540 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T12:28:13.496 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T12:28:13.496 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T12:28:13.496 [Cloud] Queued cloud request. 2026-09-26T12:28:13.496 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T12:28:13.496 [Cloud] Dequeued cloud request. 2026-09-26T12:28:13.496 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T12:28:13.637 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8AA2B1CA-F83C-9F3D-BCEF-BB021FECBBD6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 12:28:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T12:28:14.152 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T12:35:35.575 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T12:49:01.209 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T12:49:01.209 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T12:49:01.209 [Cloud] Queued cloud request. 2026-09-26T12:49:01.209 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T12:49:01.209 [Cloud] Dequeued cloud request. 2026-09-26T12:49:01.209 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T12:49:01.397 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1373F739-1BEF-658D-8266-52A8C51EAAA5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 12:49:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T12:49:01.897 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T12:50:40.584 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T12:57:24.979 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T12:57:24.979 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T12:57:24.979 [Cloud] Queued cloud request. 2026-09-26T12:57:24.979 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T12:57:24.979 [Cloud] Dequeued cloud request. 2026-09-26T12:57:24.979 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T12:57:25.167 [Cloud] End of cloud request. 2026-09-26T12:57:25.667 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T13:01:04.714 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T13:01:04.714 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T13:01:04.714 [Cloud] Queued cloud request. 2026-09-26T13:01:04.714 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T13:01:04.714 [Cloud] Dequeued cloud request. 2026-09-26T13:01:04.714 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T13:01:04.902 [Cloud] End of cloud request. 2026-09-26T13:01:05.402 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T13:05:45.592 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T13:16:10.504 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T13:16:10.504 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T13:16:10.504 [Cloud] Queued cloud request. 2026-09-26T13:16:10.504 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T13:16:10.504 [Cloud] Dequeued cloud request. 2026-09-26T13:16:10.504 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T13:16:10.660 [Cloud] End of cloud request. 2026-09-26T13:16:11.176 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T13:20:50.599 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T13:26:54.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T13:26:54.088 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T13:26:54.088 [Cloud] Queued cloud request. 2026-09-26T13:26:54.088 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T13:26:54.088 [Cloud] Dequeued cloud request. 2026-09-26T13:26:54.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T13:26:54.244 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F63FE0E8-BDE8-8386-3B35-D968B7F02018} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 13:26:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T13:26:54.744 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T13:30:43.776 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T13:30:43.776 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T13:30:43.776 [Cloud] Queued cloud request. 2026-09-26T13:30:43.776 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T13:30:43.776 [Cloud] Dequeued cloud request. 2026-09-26T13:30:43.776 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T13:30:43.964 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C4ACF7CF-892C-079B-C276-9AC5315C08CF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 13:30:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T13:30:44.479 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T13:35:55.608 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T13:39:40.687 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 34761, Count: 2461, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-26T13:39:40.688 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 13129, Count: 1181, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-26T13:39:40.688 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 6595, Count: 590, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T13:39:40.688 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-26T13:39:40.688 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 829, Count: 57, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-26T13:39:40.688 ProcessImageName: AgentShellService.exe, Pid: 1664, TotalTime: 665, Count: 24, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-26T13:39:40.688 ProcessImageName: WmiPrvSE.exe, Pid: 6284, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-26T13:39:40.688 ProcessImageName: WmiPrvSE.exe, Pid: 6952, TotalTime: 498, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 42% 2026-09-26T13:39:40.688 ProcessImageName: powershell.exe, Pid: 5972, TotalTime: 230, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 22% 2026-09-26T13:39:40.688 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T13:39:40.688 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 18, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-26T13:39:40.688 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 165, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23b3e-0.MAI, EstimatedImpact: 0% 2026-09-26T13:39:40.688 ProcessImageName: python.exe, Pid: 5740, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 4% 2026-09-26T13:39:40.688 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-26T13:39:40.688 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-26T13:39:40.688 ProcessImageName: powershell.exe, Pid: 5824, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_2oan4zek.qzq.ps1, EstimatedImpact: 0% 2026-09-26T13:39:40.688 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-26T13:39:40.688 ProcessImageName: taskhostw.exe, Pid: 7052, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-26T13:39:40.688 ProcessImageName: DeviceCensus.exe, Pid: 5524, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-26T13:39:40.688 ProcessImageName: mysqldump.exe, Pid: 7892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 12% 2026-09-26T13:39:40.688 ProcessImageName: cmd.exe, Pid: 3244, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-26T13:39:40.688 ProcessImageName: ngentask.exe, Pid: 6032, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-26T13:39:40.688 ProcessImageName: powershell.exe, Pid: 6680, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4003.tmp, EstimatedImpact: 0% 2026-09-26T13:39:40.688 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-26T13:41:05.031 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T13:41:05.031 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T13:41:05.031 [Cloud] Queued cloud request. 2026-09-26T13:41:05.031 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T13:41:05.031 [Cloud] Dequeued cloud request. 2026-09-26T13:41:05.031 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T13:41:05.219 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{34D1BA71-D11E-3B0A-0F06-4352DB26F788} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 13:41:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T13:41:05.719 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T13:42:30.142 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T13:42:30.142 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T13:42:30.142 [Cloud] Queued cloud request. 2026-09-26T13:42:30.142 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T13:42:30.142 [Cloud] Dequeued cloud request. 2026-09-26T13:42:30.142 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T13:42:30.330 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9B03B99C-2444-3855-B1C0-F046775BFDE6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 13:42:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T13:42:30.846 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e 2026-09-26T13:42:48.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T13:42:48.643 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T13:42:48.643 [Cloud] Queued cloud request. 2026-09-26T13:42:48.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T13:42:48.643 [Cloud] Dequeued cloud request. 2026-09-26T13:42:48.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T13:42:49.080 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-09-26T13:42:49.080 [Cloud] End of cloud request. Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7 2026-09-26T13:42:49.111 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T13:42:49.111 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T13:42:49.111 [Cloud] Queued cloud request. 2026-09-26T13:42:49.111 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T13:42:49.111 [Cloud] Dequeued cloud request. 2026-09-26T13:42:49.111 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T13:42:49.580 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T13:42:59.111 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40010000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c 2026-09-26T13:42:59.143 [Cloud] End of cloud request. 2026-09-26T13:42:59.643 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T13:43:02.596 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2436b-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3788261, FileId: 0xb00000005b247, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T13:43:02.596 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2436b-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3788260, FileId: 0xb00000005b248, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 BEGIN BM telemetry GUID:{C9D174DC-2F1E-8683-66FA-6C5A0680FABA} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:09-26-2026 13:44:59 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T13:44:59.955 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T13:44:59.955 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T13:44:59.955 [Cloud] Queued cloud request. 2026-09-26T13:44:59.955 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T13:44:59.955 [Cloud] Dequeued cloud request. 2026-09-26T13:44:59.955 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T13:45:00.377 [Cloud] End of cloud request. 2026-09-26T13:45:00.893 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x56d96c17 2026-09-26T13:48:08.692 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T13:48:08.692 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T13:48:08.692 [Cloud] Queued cloud request. 2026-09-26T13:48:08.692 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T13:48:08.692 [Cloud] Dequeued cloud request. 2026-09-26T13:48:08.755 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T13:48:09.255 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpMyAdmin\tbl_changer.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x3329faf726b1 2026-09-26T13:48:09.255 [Cloud] End of cloud request. 2026-09-26T13:48:09.958 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T13:50:12.646 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T13:50:12.646 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T13:50:12.646 [Cloud] Queued cloud request. 2026-09-26T13:50:12.646 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T13:50:12.646 [Cloud] Dequeued cloud request. 2026-09-26T13:50:12.646 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T13:50:12.818 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E6333AE9-DDCE-FB3C-3880-E45966DABD7E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 13:50:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T13:50:13.318 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T13:50:48.022 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2444e-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3794148, FileId: 0x1800000005c4d3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T13:50:48.022 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2444e-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #3794149, FileId: 0xc00000005c2d4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T13:51:00.615 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T13:57:22.118 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T13:57:22.118 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T13:57:22.118 [Cloud] Queued cloud request. 2026-09-26T13:57:22.118 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T13:57:22.118 [Cloud] Dequeued cloud request. 2026-09-26T13:57:22.118 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T13:57:22.947 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{03FFA23C-672B-1150-B783-AC326B8A7497} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 13:57:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T13:57:23.462 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T14:06:05.623 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T14:08:31.171 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T14:08:31.171 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T14:08:31.171 [Cloud] Queued cloud request. 2026-09-26T14:08:31.171 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T14:08:31.171 [Cloud] Dequeued cloud request. 2026-09-26T14:08:31.171 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T14:08:31.328 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C1FF03C2-A0F9-01FC-F36F-F4BD700E32B5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 14:08:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T14:08:31.828 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T14:08:59.093 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T14:08:59.093 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T14:08:59.093 [Cloud] Queued cloud request. 2026-09-26T14:08:59.093 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T14:08:59.093 [Cloud] Dequeued cloud request. 2026-09-26T14:08:59.093 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T14:08:59.171 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8ED5B7BF-DFB5-0E95-2F6B-5EE6DD03B077} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 14:08:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T14:08:59.671 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T14:16:44.283 Bm signature throttled:0x000135b39c9104ce 2026-09-26T14:16:49.877 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_1mxlvgcr.2hx.psm1. Process: \Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3803236, FileId: 0x1f00000005c895, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T14:16:57.455 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_0veesq1e.bbz.psm1. Process: \Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3803288, FileId: 0x2200000005c895, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T14:17:01.783 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_vse2qmv2.v23.psm1. Process: \Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3803313, FileId: 0x2300000005c895, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T14:17:04.549 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T14:17:04.549 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T14:17:04.549 [Cloud] Queued cloud request. 2026-09-26T14:17:04.549 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T14:17:04.549 [Cloud] Dequeued cloud request. 2026-09-26T14:17:04.549 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T14:17:04.705 [Cloud] End of cloud request. 2026-09-26T14:17:05.205 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T14:17:09.158 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_uksnabph.dbi.psm1. Process: \Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3803363, FileId: 0x2500000005c895, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T14:21:10.631 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T14:31:15.697 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T14:31:15.697 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T14:31:15.697 [Cloud] Queued cloud request. 2026-09-26T14:31:15.697 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T14:31:15.697 [Cloud] Dequeued cloud request. 2026-09-26T14:31:15.697 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T14:31:15.884 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CE75DAE8-2935-C5D3-81CF-07AB367B1E45} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 14:31:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T14:31:16.384 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T14:36:15.638 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T14:37:59.421 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T14:37:59.421 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T14:37:59.421 [Cloud] Queued cloud request. 2026-09-26T14:37:59.421 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T14:37:59.421 [Cloud] Dequeued cloud request. 2026-09-26T14:37:59.421 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T14:37:59.608 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{85828F5E-9D48-CC93-4299-9FDA836E1C54} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 14:37:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T14:38:00.108 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T14:51:20.645 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T14:58:28.556 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T14:58:28.556 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T14:58:28.556 [Cloud] Queued cloud request. 2026-09-26T14:58:28.556 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T14:58:28.556 [Cloud] Dequeued cloud request. 2026-09-26T14:58:28.556 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T14:58:28.774 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{24DFD56B-2E02-BAF3-168C-603546ECE947} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 14:58:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T14:58:29.274 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T15:04:33.918 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T15:04:33.918 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T15:04:33.918 [Cloud] Queued cloud request. 2026-09-26T15:04:33.918 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T15:04:33.918 [Cloud] Dequeued cloud request. 2026-09-26T15:04:33.918 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T15:04:34.058 [Cloud] End of cloud request. 2026-09-26T15:04:34.574 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T15:06:23.950 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T15:06:23.950 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T15:06:23.950 [Cloud] Queued cloud request. 2026-09-26T15:06:23.950 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T15:06:23.950 [Cloud] Dequeued cloud request. 2026-09-26T15:06:23.950 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T15:06:25.653 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T15:06:34.013 [Cloud] End of cloud request. 2026-09-26T15:06:34.513 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T15:21:30.659 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T15:23:17.394 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T15:23:17.394 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T15:23:17.394 [Cloud] Queued cloud request. 2026-09-26T15:23:17.394 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T15:23:17.394 [Cloud] Dequeued cloud request. 2026-09-26T15:23:17.394 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T15:23:19.784 [Cloud] End of cloud request. 2026-09-26T15:23:20.284 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T15:28:26.399 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T15:28:26.399 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T15:28:26.399 [Cloud] Queued cloud request. 2026-09-26T15:28:26.399 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T15:28:26.399 [Cloud] Dequeued cloud request. 2026-09-26T15:28:26.399 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T15:28:26.571 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DB916240-192E-1CC2-3D21-5E25414F9E11} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 15:28:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T15:28:27.071 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T15:31:06.336 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T15:31:06.336 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T15:31:06.336 [Cloud] Queued cloud request. 2026-09-26T15:31:06.336 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T15:31:06.336 [Cloud] Dequeued cloud request. 2026-09-26T15:31:06.336 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T15:31:06.524 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{289383FF-460C-9187-45A5-DFA1DDA89578} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 15:31:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T15:31:07.024 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T15:36:35.668 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T15:39:40.763 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 162542, Count: 14198, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-26T15:39:40.763 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 15217, Count: 1373, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-26T15:39:40.763 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 6595, Count: 590, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T15:39:40.763 ProcessImageName: setup.exe, Pid: 7636, TotalTime: 3501, Count: 433, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\153.0.4234.48\identity_proxy\win10\identity_helper.Sparse.Beta.p7x, EstimatedImpact: 34% 2026-09-26T15:39:40.763 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-26T15:39:40.763 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 889, Count: 63, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-26T15:39:40.763 ProcessImageName: AgentShellService.exe, Pid: 1664, TotalTime: 665, Count: 24, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-26T15:39:40.763 ProcessImageName: WmiPrvSE.exe, Pid: 6284, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-26T15:39:40.763 ProcessImageName: powershell.exe, Pid: 7908, TotalTime: 508, Count: 35, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\f10549eca5166e103fa08ae6df53ebba\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 24% 2026-09-26T15:39:40.763 ProcessImageName: WmiPrvSE.exe, Pid: 6952, TotalTime: 498, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 42% 2026-09-26T15:39:40.763 ProcessImageName: powershell.exe, Pid: 5972, TotalTime: 230, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 22% 2026-09-26T15:39:40.763 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 225, Count: 20, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-26T15:39:40.763 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T15:39:40.763 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 195, Count: 78, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23b3e-0.MAI, EstimatedImpact: 0% 2026-09-26T15:39:40.763 ProcessImageName: MicrosoftEdge_X64_154.0.4258.37_153.0.4234.48.exe, Pid: 7632, TotalTime: 156, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{16E4012D-02C1-4512-9662-3667BB6CA902}\EDGEMITMP_52375.tmp\setup.exe, EstimatedImpact: 71% 2026-09-26T15:39:40.763 ProcessImageName: python.exe, Pid: 5740, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 4% 2026-09-26T15:39:40.763 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-26T15:39:40.763 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-26T15:39:40.763 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-26T15:39:40.763 ProcessImageName: powershell.exe, Pid: 5824, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_2oan4zek.qzq.ps1, EstimatedImpact: 0% 2026-09-26T15:39:40.763 ProcessImageName: taskhostw.exe, Pid: 7052, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-26T15:39:40.763 ProcessImageName: DeviceCensus.exe, Pid: 5524, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-26T15:39:40.763 ProcessImageName: mysqldump.exe, Pid: 7892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 12% 2026-09-26T15:39:40.763 ProcessImageName: cmd.exe, Pid: 3244, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-26T15:39:40.763 ProcessImageName: ngentask.exe, Pid: 6032, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-26T15:39:40.763 ProcessImageName: powershell.exe, Pid: 6680, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4003.tmp, EstimatedImpact: 0% 2026-09-26T15:39:40.763 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-26T15:40:29.935 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #3831666, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T15:40:31.763 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #3831747, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T15:40:31.872 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #3831750, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T15:40:32.888 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #3831758, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T15:51:40.674 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T16:04:00.571 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T16:04:00.571 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T16:04:00.571 [Cloud] Queued cloud request. 2026-09-26T16:04:00.571 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T16:04:00.571 [Cloud] Dequeued cloud request. 2026-09-26T16:04:00.571 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T16:04:00.774 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{59DDFE5C-62A5-43F7-3499-D5E9AC0F3F06} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 16:04:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T16:04:01.274 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T16:06:45.682 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T16:08:19.934 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T16:08:19.934 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T16:08:19.934 [Cloud] Queued cloud request. 2026-09-26T16:08:19.934 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T16:08:19.934 [Cloud] Dequeued cloud request. 2026-09-26T16:08:19.934 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T16:08:20.121 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{863E03E1-C42B-A50D-73E2-82FB7BE588E9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 16:08:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T16:08:20.621 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T16:12:55.996 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T16:12:55.996 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T16:12:55.996 [Cloud] Queued cloud request. 2026-09-26T16:12:55.996 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T16:12:55.996 [Cloud] Dequeued cloud request. 2026-09-26T16:12:55.996 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T16:12:56.184 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{98956ED7-6A43-D60E-E3B7-2DED27FE560E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 16:12:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T16:12:56.684 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T16:21:50.689 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T16:28:57.084 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T16:28:57.084 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T16:28:57.084 [Cloud] Queued cloud request. 2026-09-26T16:28:57.084 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T16:28:57.084 [Cloud] Dequeued cloud request. 2026-09-26T16:28:57.084 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T16:28:57.272 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{681E0109-D783-9ABC-4C18-C3929CE49073} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 16:28:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T16:28:57.788 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T16:36:55.698 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T16:47:02.826 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T16:47:02.826 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T16:47:02.826 [Cloud] Queued cloud request. 2026-09-26T16:47:02.826 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T16:47:02.826 [Cloud] Dequeued cloud request. 2026-09-26T16:47:02.826 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T16:47:03.045 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FB9BA89B-BAB3-A67A-27E0-2B9F0293C086} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 16:47:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T16:47:03.561 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T16:52:00.703 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T16:55:54.096 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T16:55:54.096 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T16:55:54.096 [Cloud] Queued cloud request. 2026-09-26T16:55:54.096 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T16:55:54.096 [Cloud] Dequeued cloud request. 2026-09-26T16:55:54.096 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T16:55:54.284 [Cloud] End of cloud request. 2026-09-26T16:55:54.799 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T17:07:05.711 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T17:12:01.465 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T17:12:01.465 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T17:12:01.465 [Cloud] Queued cloud request. 2026-09-26T17:12:01.465 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T17:12:01.465 [Cloud] Dequeued cloud request. 2026-09-26T17:12:01.465 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T17:12:01.605 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CAF87268-1635-7DB0-5DF6-E0226977DF34} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 17:12:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T17:12:02.121 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T17:22:10.718 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T17:28:52.551 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T17:28:52.551 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T17:28:52.551 [Cloud] Queued cloud request. 2026-09-26T17:28:52.551 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T17:28:52.551 [Cloud] Dequeued cloud request. 2026-09-26T17:28:52.551 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T17:28:52.770 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{27E54D3F-FD03-4D27-9249-9282A0164BF9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 17:28:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T17:28:53.270 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T17:29:24.848 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T17:29:24.848 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T17:29:24.848 [Cloud] Queued cloud request. 2026-09-26T17:29:24.848 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T17:29:24.848 [Cloud] Dequeued cloud request. 2026-09-26T17:29:24.848 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T17:29:24.926 [Cloud] End of cloud request. 2026-09-26T17:29:25.426 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T17:37:15.727 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T17:37:32.290 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T17:37:32.290 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T17:37:32.290 [Cloud] Queued cloud request. 2026-09-26T17:37:32.290 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T17:37:32.290 [Cloud] Dequeued cloud request. 2026-09-26T17:37:32.290 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T17:37:32.493 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25E4DE2F-F423-D314-13C0-663FB1824E84} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 17:37:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T17:37:32.993 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T17:39:02.587 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T17:39:02.587 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T17:39:02.587 [Cloud] Queued cloud request. 2026-09-26T17:39:02.587 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T17:39:02.587 [Cloud] Dequeued cloud request. 2026-09-26T17:39:02.587 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T17:39:02.759 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0924493B-C4F1-A26A-7C00-0AA83D3B2A9D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 17:39:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T17:39:03.259 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T17:39:40.837 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 162587, Count: 14202, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-26T17:39:40.837 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 17306, Count: 1566, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-26T17:39:40.837 ProcessImageName: setup.exe, Pid: 7636, TotalTime: 12656, Count: 685, MaxTime: 4750, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\154.0.4258.37\msedge.dll, EstimatedImpact: 16% 2026-09-26T17:39:40.837 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 6595, Count: 590, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T17:39:40.837 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-26T17:39:40.837 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 949, Count: 67, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-26T17:39:40.837 ProcessImageName: AgentShellService.exe, Pid: 1664, TotalTime: 665, Count: 24, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-26T17:39:40.837 ProcessImageName: WmiPrvSE.exe, Pid: 6284, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-26T17:39:40.837 ProcessImageName: powershell.exe, Pid: 7908, TotalTime: 508, Count: 35, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\f10549eca5166e103fa08ae6df53ebba\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 24% 2026-09-26T17:39:40.837 ProcessImageName: WmiPrvSE.exe, Pid: 6952, TotalTime: 498, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 42% 2026-09-26T17:39:40.837 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 240, Count: 21, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-26T17:39:40.837 ProcessImageName: powershell.exe, Pid: 5972, TotalTime: 230, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 22% 2026-09-26T17:39:40.837 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 225, Count: 82, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-23b3e-0.MAI, EstimatedImpact: 0% 2026-09-26T17:39:40.837 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T17:39:40.837 ProcessImageName: MicrosoftEdge_X64_154.0.4258.37_153.0.4234.48.exe, Pid: 7632, TotalTime: 156, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{16E4012D-02C1-4512-9662-3667BB6CA902}\EDGEMITMP_52375.tmp\setup.exe, EstimatedImpact: 71% 2026-09-26T17:39:40.837 ProcessImageName: python.exe, Pid: 5740, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 4% 2026-09-26T17:39:40.837 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-26T17:39:40.837 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-26T17:39:40.837 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-26T17:39:40.837 ProcessImageName: powershell.exe, Pid: 5824, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_2oan4zek.qzq.ps1, EstimatedImpact: 0% 2026-09-26T17:39:40.837 ProcessImageName: taskhostw.exe, Pid: 7052, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-26T17:39:40.837 ProcessImageName: DeviceCensus.exe, Pid: 5524, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-26T17:39:40.837 ProcessImageName: mysqldump.exe, Pid: 7892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 12% 2026-09-26T17:39:40.837 ProcessImageName: cmd.exe, Pid: 3244, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-26T17:39:40.837 ProcessImageName: ngentask.exe, Pid: 6032, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-26T17:39:40.837 ProcessImageName: powershell.exe, Pid: 6680, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4003.tmp, EstimatedImpact: 0% 2026-09-26T17:39:40.837 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-26T17:40:59.821 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T17:40:59.821 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T17:40:59.821 [Cloud] Queued cloud request. 2026-09-26T17:40:59.821 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T17:40:59.821 [Cloud] Dequeued cloud request. 2026-09-26T17:40:59.821 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T17:41:00.028 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BAF325C6-F03B-CFE2-5337-84857D5766E5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 17:41:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T17:41:00.540 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T17:45:32.043 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\$Extend\$Deleted\0028000000032F34015FCC99. Process: \Device\HarddiskVolume2\Windows\System32\svchost.exe, Status: 0xc0000001, State: 0, ScanRequest #3872955, FileId: 0x28000000032f34, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x2000, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T17:52:20.732 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T18:02:07.518 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T18:02:07.518 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T18:02:07.518 [Cloud] Queued cloud request. 2026-09-26T18:02:07.518 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T18:02:07.518 [Cloud] Dequeued cloud request. 2026-09-26T18:02:07.518 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T18:02:17.596 [Cloud] End of cloud request. 2026-09-26T18:02:18.096 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T18:04:46.802 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T18:04:46.802 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T18:04:46.802 [Cloud] Queued cloud request. 2026-09-26T18:04:46.802 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T18:04:46.802 [Cloud] Dequeued cloud request. 2026-09-26T18:04:46.802 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T18:04:46.943 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A67373E9-C0C6-5FDC-A4A6-7E8254FBF2F9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 18:04:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T18:04:47.458 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T18:07:25.741 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T18:22:30.747 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T18:34:35.236 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T18:34:35.236 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T18:34:35.236 [Cloud] Queued cloud request. 2026-09-26T18:34:35.236 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T18:34:35.236 [Cloud] Dequeued cloud request. 2026-09-26T18:34:35.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T18:34:35.377 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F6DF7472-9C8F-5979-3297-C57509207A81} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 18:34:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T18:34:35.893 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T18:37:35.755 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T18:45:56.040 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T18:45:56.040 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T18:45:56.040 [Cloud] Queued cloud request. 2026-09-26T18:45:56.040 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T18:45:56.040 [Cloud] Dequeued cloud request. 2026-09-26T18:45:56.040 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T18:45:56.196 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{827F907F-1044-3EEA-67FF-1478786CE919} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 18:45:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T18:45:56.696 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T18:47:51.541 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T18:47:51.541 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T18:47:51.541 [Cloud] Queued cloud request. 2026-09-26T18:47:51.541 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T18:47:51.541 [Cloud] Dequeued cloud request. 2026-09-26T18:47:51.541 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T18:47:51.698 [Cloud] End of cloud request. 2026-09-26T18:47:52.198 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T18:52:40.760 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T19:07:45.769 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T19:09:25.910 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T19:09:25.910 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:09:25.910 [Cloud] Queued cloud request. 2026-09-26T19:09:25.910 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T19:09:25.910 [Cloud] Dequeued cloud request. 2026-09-26T19:09:25.910 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:09:26.098 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{04697169-7F6E-C51B-EAC1-9F2E3C745E6B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 19:09:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T19:09:26.598 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:13:55.473 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T19:13:55.473 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:13:55.473 [Cloud] Queued cloud request. 2026-09-26T19:13:55.473 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T19:13:55.473 [Cloud] Dequeued cloud request. 2026-09-26T19:13:55.473 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:13:55.645 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DB6C031E-8121-EC56-15E3-EDD1C0797C28} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 19:13:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T19:13:56.145 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:22:50.774 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T19:24:10.040 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T19:24:10.040 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:24:10.040 [Cloud] Queued cloud request. 2026-09-26T19:24:10.040 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T19:24:10.196 [Cloud] Dequeued cloud request. 2026-09-26T19:24:10.196 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:24:10.337 [Cloud] End of cloud request. 2026-09-26T19:24:10.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:27:11.262 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T19:27:11.262 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:27:11.262 [Cloud] Queued cloud request. 2026-09-26T19:27:11.262 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T19:27:11.262 [Cloud] Dequeued cloud request. 2026-09-26T19:27:11.262 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:27:11.403 [Cloud] End of cloud request. 2026-09-26T19:27:11.918 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:31:05.092 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T19:31:05.092 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:31:05.092 [Cloud] Queued cloud request. 2026-09-26T19:31:05.092 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T19:31:05.092 [Cloud] Dequeued cloud request. 2026-09-26T19:31:05.248 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:31:05.373 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{237DCD3C-FC22-DA20-B04C-0245DFC484FB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 19:31:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T19:31:05.873 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:31:26.795 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T19:31:26.795 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:31:26.795 [Cloud] Queued cloud request. 2026-09-26T19:31:26.795 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T19:31:26.795 [Cloud] Dequeued cloud request. 2026-09-26T19:31:26.795 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:31:26.888 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{45CABB61-3590-4A7C-0CE1-45CE8911D706} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 19:31:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T19:31:27.388 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:37:55.783 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T19:38:10.939 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T19:38:10.939 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:38:10.939 [Cloud] Queued cloud request. 2026-09-26T19:38:10.939 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T19:38:10.939 [Cloud] Dequeued cloud request. 2026-09-26T19:38:10.939 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:38:11.127 [Cloud] End of cloud request. 2026-09-26T19:38:11.642 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:39:15.783 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-26T19:39:15.815 Job Notification: New process added to job (7604) 2026-09-26T19:39:15.830 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-26T19:39:15.830 Aggressive catchup quick scan threshold: 660079904861 / 25920000000000 2026-09-26T19:39:15.846 Job Notification: New process added to job (7228) 2026-09-26T19:39:15.846 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:7604] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7228]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-26T19:39:15.986 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-26T19:39:15.986 Job Notification: New process added to job (1724) 2026-09-26T19:39:16.002 Job Notification: New process added to job (2376) 2026-09-26T19:39:16.049 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:1724] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:2376]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-26T19:39:16.158 Job Notification: New process added to job (7396) 2026-09-26T19:39:16.224 Task(GetDeviceTicket -AccessKey 9D8D493F-9CB9-2284-50DF-8E254751D97F ) launched as network service 2026-09-26T19:39:16.346 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-26T19:39:16.346 [RTP] Duplicating the current plugin configuration object... 2026-09-26T19:39:16.346 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-26T19:39:16.346 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-26T19:39:16.346 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-26T19:39:16.346 [RTP] No config change detected. Not updating plugin configuration. 2026-09-26T19:39:16.346 [RTP] No config changes found. No configuration switch. 2026-09-26T19:39:16.346 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-26T19:39:16.721 Job Notification: Process exited from job (7396) 2026-09-26T19:39:16.877 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-26T19:39:16.877 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:39:16.877 [Cloud] Queued cloud request. 2026-09-26T19:39:16.877 [Cloud] Dequeued cloud request. 2026-09-26T19:39:16.877 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:39:17.065 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-26T19:39:17.065 [Cloud] End of cloud request. 2026-09-26T19:39:17.393 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:39:27.424 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\A3DF04E3-A383-4D1F-A123-9216228E4E761a4c.1dd4deebbe32d2b 2026-09-26T19:39:27.533 Verifying engine and signature files (source: 0) ... 2026-09-26T19:39:27.533 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345}\mpengine.dll] due to PPL. 2026-09-26T19:39:27.533 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345}\mpasbase.vdm]. File not in cache (0x1) 2026-09-26T19:39:28.455 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345}\mpasbase.vdm] 2026-09-26T19:39:28.455 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-26T19:39:28.518 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345}\mpasdlta.vdm] 2026-09-26T19:39:28.518 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345}\mpavbase.vdm]. File not in cache (0x1) 2026-09-26T19:39:28.971 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345}\mpavbase.vdm] 2026-09-26T19:39:28.971 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-26T19:39:28.986 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345}\mpavdlta.vdm] 2026-09-26T19:39:29.190 [Engine] IsHybridMode: 0 2026-09-26T19:39:29.190 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-26T19:39:29.205 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-1C45DBA8266E22EEB09AE5CD0B9B35BE8466EBFF.bin): 0x00000002 2026-09-26T19:39:29.205 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-1C45DBA8266E22EEB09AE5CD0B9B35BE8466EBFF.bin) 2026-09-26T19:39:29.205 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-26T19:39:29.205 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-26T19:39:29.205 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-26T19:39:29.205 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff 2026-09-26T19:39:40.908 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 162725, Count: 14209, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-26T19:39:40.908 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 19429, Count: 1760, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-26T19:39:40.908 ProcessImageName: setup.exe, Pid: 7636, TotalTime: 12656, Count: 685, MaxTime: 4750, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\154.0.4258.37\msedge.dll, EstimatedImpact: 16% 2026-09-26T19:39:40.908 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 6595, Count: 590, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T19:39:40.908 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-26T19:39:40.908 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1117, Count: 80, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-26T19:39:40.908 ProcessImageName: AgentShellService.exe, Pid: 1664, TotalTime: 665, Count: 24, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-26T19:39:40.908 ProcessImageName: WmiPrvSE.exe, Pid: 6284, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-26T19:39:40.908 ProcessImageName: powershell.exe, Pid: 7908, TotalTime: 508, Count: 35, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\f10549eca5166e103fa08ae6df53ebba\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 24% 2026-09-26T19:39:40.908 ProcessImageName: WmiPrvSE.exe, Pid: 6952, TotalTime: 498, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 42% 2026-09-26T19:39:40.908 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 271, Count: 86, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2462c-0.MAI, EstimatedImpact: 0% 2026-09-26T19:39:40.908 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 270, Count: 24, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-26T19:39:40.908 ProcessImageName: powershell.exe, Pid: 5972, TotalTime: 230, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 22% 2026-09-26T19:39:40.908 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T19:39:40.908 ProcessImageName: MicrosoftEdge_X64_154.0.4258.37_153.0.4234.48.exe, Pid: 7632, TotalTime: 156, Count: 2, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{16E4012D-02C1-4512-9662-3667BB6CA902}\EDGEMITMP_52375.tmp\setup.exe, EstimatedImpact: 71% 2026-09-26T19:39:40.908 ProcessImageName: python.exe, Pid: 5740, TotalTime: 105, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 4% 2026-09-26T19:39:40.908 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-26T19:39:40.908 ProcessImageName: taskhostw.exe, Pid: 7928, TotalTime: 76, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 9% 2026-09-26T19:39:40.908 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-26T19:39:40.908 ProcessImageName: powershell.exe, Pid: 5824, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_2oan4zek.qzq.ps1, EstimatedImpact: 0% 2026-09-26T19:39:40.908 ProcessImageName: taskhostw.exe, Pid: 7052, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 10% 2026-09-26T19:39:40.908 ProcessImageName: DeviceCensus.exe, Pid: 5524, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 3% 2026-09-26T19:39:40.908 ProcessImageName: mysqldump.exe, Pid: 7892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 12% 2026-09-26T19:39:40.908 ProcessImageName: cmd.exe, Pid: 3244, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-26T19:39:40.908 ProcessImageName: ngentask.exe, Pid: 6032, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 9% 2026-09-26T19:39:40.908 ProcessImageName: powershell.exe, Pid: 6680, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp4003.tmp, EstimatedImpact: 0% 2026-09-26T19:39:40.908 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-26T19:39:41.174 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-26T19:39:41.174 [AutoExclusion] Applied roles from cache. 2026-09-26T19:39:41.174 [AutoExclusion] Started roles monitoring. 2026-09-26T19:39:41.268 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF68AB020, lRefCount: 6, hr=0 2026-09-26T19:39:41.268 [Engine] New active engine 00007FFCF4ABB020 replacing engine 00007FFCF68AB020. Number of active engines: 2 2026-09-26T19:39:41.299 EngineInit:Global ASOC is enabled 2026-09-26T19:39:41.299 EngineInit:ASOO is enabled for developer volumes 2026-09-26T19:39:41.408 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.424 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-26T19:39:41.455 MpWriteUupSignatureVersion 1.459.417.0, hr = 0 2026-09-26T19:39:41.455 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-26T19:39:41.471 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-26T19:39:41.471 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-26T19:39:41.471 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-26T19:39:41.471 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-26T19:39:41.486 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-26T19:39:41.486 [Plugin] Initializing RTP plugin state... 2026-09-26T19:39:41.486 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-26T19:39:41.486 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎25‎-‎2026 21:39:40 Last Perf:‎09‎-‎25‎-‎2026 21:39:40 First RTP Scan:‎09‎-‎25‎-‎2026 21:39:40 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:2316 Misses:12786 BM Queue:0,181,0 Proc:0,95,0 File:0,181,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:3910991 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:827718234 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:7760 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:211478 TotalHits:2057675 InstanceCacheInserts:32221 InstanceCacheUpdates:0 InstanceCacheDeletes:17775 InstanceCacheHits:1038 InstanceCacheMisses:124211 InstanceCacheOverflows:12907 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:5ms (8664/1596) Success: 1596, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-26T19:39:41.486 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345} 2026-09-26T19:39:41.486 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1}\mpasbase.vdm in use, hr=0x80070020 2026-09-26T19:39:41.486 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A078AD8B-E0D8-486B-A296-E774B51B660B} removed 2026-09-26T19:39:41.486 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-26T19:39:41.486 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-26T19:39:41.486 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-26T19:39:41.486 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-26T19:39:41.486 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-26T19:39:41.502 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-26-2026 19:39:41 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-26-2026 19:39:41 2026-09-26T19:39:41.502 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-26T19:39:41.502 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-26T19:39:41.502 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-26T19:39:41.502 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-26T19:39:41.502 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:39:41.502 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-26T19:39:41.502 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-26T19:39:41.502 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-26T19:39:41.502 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-26T19:39:41.502 MdCoreSvc is supported in this platform and OS Signature updated on 09-26-2026 19:39:41 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.417.0 AV Signature Version: 1.459.417.0 ************************************************************ 2026-09-26T19:39:41.518 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-26T19:39:41.518 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\A3DF04E3-A383-4D1F-A123-9216228E4E761a4c.1dd4deebbe32d2b 2026-09-26T19:39:41.565 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-26T19:39:41.565 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 2026-09-26T19:39:41.565 Process scan (postsignatureupdatescan) started. Signature updated via MicrosoftUpdateServer on 09-26-2026 19:39:41 ************************************************************ 2026-09-26T19:39:41.690 Job Notification: Process exited from job (7604) 2026-09-26T19:39:41.690 Job Notification: Process exited from job (7228) 2026-09-26T19:39:41.690 Job Notification: Process exited from job (1724) 2026-09-26T19:39:41.690 Job Notification: Process exited from job (2376) 2026-09-26T19:39:41.799 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-26T19:39:41.799 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-26T19:39:41.799 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-26T19:39:41.799 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-26T19:39:41.799 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-26T19:39:41.799 [Engine] Engine 00007FFCF68AB020 no longer in use. Number of active engines: 1 2026-09-26T19:39:41.799 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-26T19:39:41.799 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-26T19:39:41.971 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-26T19:39:41.971 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-26T19:39:41.971 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-26T19:39:42.299 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 162725, Count: 14209, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-26T19:39:42.299 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 19429, Count: 1760, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-26T19:39:42.299 ProcessImageName: setup.exe, Pid: 7636, TotalTime: 12656, Count: 685, MaxTime: 4750, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\154.0.4258.37\msedge.dll, EstimatedImpact: 16% 2026-09-26T19:39:42.299 ProcessImageName: AgentShell.exe, Pid: 808, TotalTime: 6595, Count: 590, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T19:39:42.299 ProcessImageName: powershell.exe, Pid: 4708, TotalTime: 1491, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 31% 2026-09-26T19:39:42.299 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1117, Count: 80, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-26T19:39:42.299 ProcessImageName: AgentShellService.exe, Pid: 1664, TotalTime: 665, Count: 24, MaxTime: 156, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 55% 2026-09-26T19:39:42.299 ProcessImageName: WmiPrvSE.exe, Pid: 6284, TotalTime: 599, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 4% 2026-09-26T19:39:42.299 ProcessImageName: powershell.exe, Pid: 7908, TotalTime: 508, Count: 35, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\f10549eca5166e103fa08ae6df53ebba\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 24% 2026-09-26T19:39:42.299 ProcessImageName: WmiPrvSE.exe, Pid: 6952, TotalTime: 498, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 42% 2026-09-26T19:39:42.299 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 271, Count: 86, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2462c-0.MAI, EstimatedImpact: 0% 2026-09-26T19:39:42.299 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 270, Count: 24, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-26T19:39:42.299 ProcessImageName: powershell.exe, Pid: 5972, TotalTime: 230, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 22% 2026-09-26T19:39:42.299 ProcessImageName: WmiPrvSE.exe, Pid: 4784, TotalTime: 200, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T19:39:42.377 [Engine] RSIG_UNLOADENGINE, 00007FFCF68AB020, err=0x0 2026-09-26T19:39:42.393 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{779A8C42-5297-4FCC-8834-9AD9708EDFD1} removed 2026-09-26T19:39:55.174 Process scan (postsignatureupdatescan) completed. 2026-09-26T19:41:16.925 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T19:41:16.925 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:41:16.925 [Cloud] Queued cloud request. 2026-09-26T19:41:16.940 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T19:41:16.940 [Cloud] Dequeued cloud request. 2026-09-26T19:41:16.940 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:41:17.112 [Cloud] End of cloud request. 2026-09-26T19:41:17.628 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:44:41.315 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-26T19:53:00.100 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T19:53:00.100 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:53:00.100 [Cloud] Queued cloud request. 2026-09-26T19:53:00.100 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T19:53:00.100 [Cloud] Dequeued cloud request. 2026-09-26T19:53:00.100 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:53:00.272 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{24BF5EAC-6A06-B9DF-0167-9261A26C3700} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 19:53:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T19:53:00.897 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:53:00.897 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T19:53:16.351 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T19:53:16.351 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:53:16.351 [Cloud] Queued cloud request. 2026-09-26T19:53:16.351 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T19:53:16.351 [Cloud] Dequeued cloud request. 2026-09-26T19:53:16.351 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:53:16.429 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{07AEABF6-A9A6-9812-A98E-36C81C9CCD78} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 19:53:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T19:53:16.929 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:56:57.588 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T19:56:57.588 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:56:57.588 [Cloud] Queued cloud request. 2026-09-26T19:56:57.588 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T19:56:57.588 [Cloud] Dequeued cloud request. 2026-09-26T19:56:57.588 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:56:57.775 [Cloud] End of cloud request. 2026-09-26T19:56:58.275 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T19:58:54.495 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T19:58:54.495 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T19:58:54.495 [Cloud] Queued cloud request. 2026-09-26T19:58:54.495 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T19:58:54.495 [Cloud] Dequeued cloud request. 2026-09-26T19:58:54.495 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T19:58:54.667 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DC7F04EE-44F8-0F97-3109-638E1C0B3614} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 19:58:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T19:58:55.183 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T20:08:05.796 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T20:09:32.453 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T20:09:32.453 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T20:09:32.453 [Cloud] Queued cloud request. 2026-09-26T20:09:32.453 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T20:09:32.453 [Cloud] Dequeued cloud request. 2026-09-26T20:09:32.453 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T20:09:32.640 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E1F0C8F-5F7A-2862-2AE0-4B82AB27F4A0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 20:09:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T20:09:33.140 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T20:17:39.660 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T20:17:39.660 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T20:17:39.660 [Cloud] Queued cloud request. 2026-09-26T20:17:39.660 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T20:17:39.660 [Cloud] Dequeued cloud request. 2026-09-26T20:17:39.660 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T20:17:39.847 [Cloud] End of cloud request. 2026-09-26T20:17:40.363 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T20:21:46.926 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T20:21:46.926 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T20:21:46.926 [Cloud] Queued cloud request. 2026-09-26T20:21:46.926 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T20:21:46.926 [Cloud] Dequeued cloud request. 2026-09-26T20:21:46.926 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T20:21:47.098 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{68BC1132-29D9-BF3E-5720-562DE281DA48} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 20:21:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T20:21:47.598 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T20:23:10.802 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T20:25:50.553 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T20:25:50.553 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T20:25:50.553 [Cloud] Queued cloud request. 2026-09-26T20:25:50.553 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T20:25:50.553 [Cloud] Dequeued cloud request. 2026-09-26T20:25:50.553 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T20:25:50.709 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{35501C1E-D817-B5DF-DC93-BD987A00D121} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 20:25:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T20:25:51.209 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T20:27:48.977 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T20:27:48.977 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T20:27:48.977 [Cloud] Queued cloud request. 2026-09-26T20:27:48.977 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T20:27:48.977 [Cloud] Dequeued cloud request. 2026-09-26T20:27:48.977 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T20:27:49.165 [Cloud] End of cloud request. 2026-09-26T20:27:49.680 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T20:30:55.493 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T20:30:55.493 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T20:30:55.493 [Cloud] Queued cloud request. 2026-09-26T20:30:55.493 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T20:30:55.493 [Cloud] Dequeued cloud request. 2026-09-26T20:30:55.493 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T20:30:55.962 [Cloud] End of cloud request. 2026-09-26T20:30:56.462 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T20:38:06.732 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T20:38:06.732 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T20:38:06.732 [Cloud] Queued cloud request. 2026-09-26T20:38:06.732 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T20:38:06.732 [Cloud] Dequeued cloud request. 2026-09-26T20:38:06.732 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T20:38:06.888 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E08587C-7486-0670-164C-56B809393DE4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 20:38:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T20:38:07.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T20:38:15.810 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T20:46:03.844 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T20:46:03.844 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T20:46:03.844 [Cloud] Queued cloud request. 2026-09-26T20:46:03.844 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T20:46:03.844 [Cloud] Dequeued cloud request. 2026-09-26T20:46:03.844 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T20:46:04.251 [Cloud] End of cloud request. 2026-09-26T20:46:04.766 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T20:53:20.816 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T20:53:46.489 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T20:53:46.489 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T20:53:46.489 [Cloud] Queued cloud request. 2026-09-26T20:53:46.489 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T20:53:46.489 [Cloud] Dequeued cloud request. 2026-09-26T20:53:46.489 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T20:53:46.645 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1A1A987B-8B25-17DD-0075-50A87F611A18} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 20:53:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T20:53:47.145 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T20:57:25.897 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T20:57:25.897 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T20:57:25.897 [Cloud] Queued cloud request. 2026-09-26T20:57:25.897 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T20:57:25.897 [Cloud] Dequeued cloud request. 2026-09-26T20:57:25.897 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T20:57:26.069 [Cloud] End of cloud request. 2026-09-26T20:57:26.569 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T20:59:02.741 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T20:59:02.741 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T20:59:02.741 [Cloud] Queued cloud request. 2026-09-26T20:59:02.741 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T20:59:02.741 [Cloud] Dequeued cloud request. 2026-09-26T20:59:02.741 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T20:59:02.897 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1BE8C2AD-23E3-7288-777C-E90C68318466} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 20:59:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T20:59:03.397 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:06:12.009 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:06:12.009 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:06:12.009 [Cloud] Queued cloud request. 2026-09-26T21:06:12.009 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:06:12.009 [Cloud] Dequeued cloud request. 2026-09-26T21:06:12.009 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:06:12.196 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D0619540-1364-D121-6F7F-B277799A184A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 21:06:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T21:06:12.712 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:08:25.821 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T21:12:20.509 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:12:20.509 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:12:20.509 [Cloud] Queued cloud request. 2026-09-26T21:12:20.509 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:12:20.509 [Cloud] Dequeued cloud request. 2026-09-26T21:12:20.509 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:12:20.665 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4AD4D137-B186-65EB-D43D-6AB3E2479783} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 21:12:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T21:12:21.181 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:14:41.665 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:14:41.665 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:14:41.665 [Cloud] Queued cloud request. 2026-09-26T21:14:41.665 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:14:41.665 [Cloud] Dequeued cloud request. 2026-09-26T21:14:41.665 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{09F4511A-E17E-A88B-C2BE-A06FE6E2A393} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 21:14:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T21:14:51.743 [Cloud] End of cloud request. 2026-09-26T21:14:52.243 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:17:36.623 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:17:36.623 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:17:36.623 [Cloud] Queued cloud request. 2026-09-26T21:17:36.623 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:17:36.623 [Cloud] Dequeued cloud request. 2026-09-26T21:17:36.623 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:17:36.780 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C26C69A2-C788-3857-6B14-35539217F42C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 21:17:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T21:17:37.280 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:23:30.830 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T21:26:23.769 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:26:23.769 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:26:23.769 [Cloud] Queued cloud request. 2026-09-26T21:26:23.769 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:26:23.769 [Cloud] Dequeued cloud request. 2026-09-26T21:26:23.769 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:26:23.926 [Cloud] End of cloud request. 2026-09-26T21:26:24.426 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:27:05.176 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:27:05.176 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:27:05.176 [Cloud] Queued cloud request. 2026-09-26T21:27:05.176 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:27:05.176 [Cloud] Dequeued cloud request. 2026-09-26T21:27:05.176 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:27:05.254 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BF397B2F-36F6-9C17-9AF9-5AB3D356D3C5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 21:27:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T21:27:05.770 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:28:00.067 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:28:00.067 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:28:00.067 [Cloud] Queued cloud request. 2026-09-26T21:28:00.067 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:28:00.067 [Cloud] Dequeued cloud request. 2026-09-26T21:28:00.067 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:28:00.146 [Cloud] End of cloud request. 2026-09-26T21:28:00.661 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:31:01.786 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:31:01.786 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:31:01.786 [Cloud] Queued cloud request. 2026-09-26T21:31:01.786 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:31:01.786 [Cloud] Dequeued cloud request. 2026-09-26T21:31:01.786 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:31:11.880 [Cloud] End of cloud request. 2026-09-26T21:31:12.380 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:38:35.837 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T21:39:41.322 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 15449, Count: 1167, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-26T21:39:41.322 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 2134, Count: 200, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T21:39:41.322 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-26T21:39:41.322 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-26T21:39:41.322 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T21:39:41.322 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 121, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start->(UTF-16LE), EstimatedImpact: 0% 2026-09-26T21:39:41.322 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-26T21:39:41.322 ProcessImageName: python.exe, Pid: 6424, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 2% 2026-09-26T21:39:41.322 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-26T21:39:41.322 ProcessImageName: ngentask.exe, Pid: 7412, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 27% 2026-09-26T21:41:49.697 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:41:49.697 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:41:49.697 [Cloud] Queued cloud request. 2026-09-26T21:41:49.697 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:41:49.963 [Cloud] Dequeued cloud request. 2026-09-26T21:41:49.963 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:41:50.119 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{671C5E5C-FD75-18B7-F7FC-7E0C4D034CAF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 21:41:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T21:41:50.619 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:42:32.603 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:42:32.603 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:42:32.603 [Cloud] Queued cloud request. 2026-09-26T21:42:32.603 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:42:32.603 [Cloud] Dequeued cloud request. 2026-09-26T21:42:32.603 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:42:32.681 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{59807FE6-ED6F-7869-E8B0-7BB3BC241DB7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 21:42:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T21:42:33.197 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:46:07.966 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:46:07.966 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:46:07.966 [Cloud] Queued cloud request. 2026-09-26T21:46:07.966 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:46:07.966 [Cloud] Dequeued cloud request. 2026-09-26T21:46:07.966 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:46:08.122 [Cloud] End of cloud request. 2026-09-26T21:46:08.622 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:46:19.060 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:46:19.060 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:46:19.060 [Cloud] Queued cloud request. 2026-09-26T21:46:19.060 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:46:19.060 [Cloud] Dequeued cloud request. 2026-09-26T21:46:19.060 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:46:19.138 [Cloud] End of cloud request. 2026-09-26T21:46:19.638 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:52:45.795 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:52:45.795 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:52:45.795 [Cloud] Queued cloud request. 2026-09-26T21:52:45.795 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:52:45.795 [Cloud] Dequeued cloud request. 2026-09-26T21:52:45.795 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:52:45.983 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{477D2EE9-A61A-C7F8-289A-174C743F692F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 21:52:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T21:52:46.483 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T21:53:40.844 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T21:55:32.689 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T21:55:32.689 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T21:55:32.689 [Cloud] Queued cloud request. 2026-09-26T21:55:32.689 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T21:55:32.689 [Cloud] Dequeued cloud request. 2026-09-26T21:55:32.689 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T21:55:32.923 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6E4E6B14-9739-A5CC-5B2A-E726111A8310} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 21:55:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T21:55:33.423 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T22:01:20.487 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T22:01:20.487 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T22:01:20.487 [Cloud] Queued cloud request. 2026-09-26T22:01:20.487 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T22:01:20.487 [Cloud] Dequeued cloud request. 2026-09-26T22:01:20.487 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T22:01:20.675 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9B015F71-C49A-F42B-DE0D-0A61F6A7DECA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 22:01:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T22:01:21.190 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T22:06:28.537 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T22:06:28.537 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T22:06:28.537 [Cloud] Queued cloud request. 2026-09-26T22:06:28.537 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T22:06:28.537 [Cloud] Dequeued cloud request. 2026-09-26T22:06:28.537 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T22:06:28.709 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F1669E0D-0DC1-D488-4603-C5780805E626} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 22:06:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T22:06:29.225 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T22:08:18.054 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T22:08:18.054 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T22:08:18.054 [Cloud] Queued cloud request. 2026-09-26T22:08:18.054 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T22:08:18.054 [Cloud] Dequeued cloud request. 2026-09-26T22:08:18.054 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T22:08:18.226 [Cloud] End of cloud request. 2026-09-26T22:08:18.742 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T22:08:45.851 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T22:11:18.335 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T22:11:18.335 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T22:11:18.335 [Cloud] Queued cloud request. 2026-09-26T22:11:18.335 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T22:11:18.335 [Cloud] Dequeued cloud request. 2026-09-26T22:11:18.335 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T22:11:28.460 [Cloud] End of cloud request. 2026-09-26T22:11:28.960 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T22:23:50.857 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T22:25:32.515 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T22:25:32.515 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T22:25:32.515 [Cloud] Queued cloud request. 2026-09-26T22:25:32.515 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T22:25:32.515 [Cloud] Dequeued cloud request. 2026-09-26T22:25:32.515 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T22:25:32.671 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B5E55038-89B6-944B-9AF7-B7AF4CF371F8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 22:25:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T22:25:33.186 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T22:25:45.343 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T22:25:45.343 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T22:25:45.343 [Cloud] Queued cloud request. 2026-09-26T22:25:45.343 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T22:25:45.343 [Cloud] Dequeued cloud request. 2026-09-26T22:25:45.343 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T22:25:45.468 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E0E9010C-D923-7AE2-2A65-1B738B636DAB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 22:25:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T22:25:45.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T22:29:20.579 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T22:29:20.579 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T22:29:20.579 [Cloud] Queued cloud request. 2026-09-26T22:29:20.579 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T22:29:20.579 [Cloud] Dequeued cloud request. 2026-09-26T22:29:20.579 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T22:29:20.719 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E5F2F0CB-47B6-BCAC-3462-FAD9AB24AD3F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 22:29:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T22:29:21.235 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T22:36:22.910 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T22:36:22.910 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T22:36:22.910 [Cloud] Queued cloud request. 2026-09-26T22:36:22.910 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T22:36:22.910 [Cloud] Dequeued cloud request. 2026-09-26T22:36:22.910 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T22:36:23.113 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{83F51F3D-00A3-C79E-1EB9-83F8B19DF188} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 22:36:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T22:36:23.613 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T22:36:42.238 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\SystemTemp\__PSScriptPolicyTest_ic3tcbjn.imx.psm1. Process: \Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, Status: 0xc0000001, State: 0, ScanRequest #3970777, FileId: 0x1d00000003c1c3, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-26T22:38:55.865 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T22:54:00.870 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T22:54:25.557 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T22:54:25.557 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T22:54:25.557 [Cloud] Queued cloud request. 2026-09-26T22:54:25.557 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T22:54:25.557 [Cloud] Dequeued cloud request. 2026-09-26T22:54:25.557 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T22:54:25.714 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{70C85C2A-C9E3-49DE-678D-411F685990E0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 22:54:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T22:54:26.214 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T22:56:01.559 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T22:56:01.559 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T22:56:01.559 [Cloud] Queued cloud request. 2026-09-26T22:56:01.559 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T22:56:01.559 [Cloud] Dequeued cloud request. 2026-09-26T22:56:01.559 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T22:56:01.700 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{19DB0F90-16B0-27FA-5B90-B3BC6388B78E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 22:56:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T22:56:02.215 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T22:56:20.591 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T22:56:20.591 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T22:56:20.591 [Cloud] Queued cloud request. 2026-09-26T22:56:20.591 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T22:56:20.591 [Cloud] Dequeued cloud request. 2026-09-26T22:56:20.591 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T22:56:20.669 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EE60FD3C-5F61-7FAC-33C2-86F3297071E1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 22:56:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T22:56:21.169 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T23:06:43.986 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T23:06:43.986 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T23:06:43.986 [Cloud] Queued cloud request. 2026-09-26T23:06:43.986 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T23:06:43.986 [Cloud] Dequeued cloud request. 2026-09-26T23:06:43.986 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T23:06:44.189 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{00E3523F-AA8F-6434-4344-FAAD96BB0CD1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 23:06:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T23:06:44.705 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T23:09:05.878 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T23:14:45.597 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T23:14:45.597 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T23:14:45.597 [Cloud] Queued cloud request. 2026-09-26T23:14:45.597 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T23:14:45.597 [Cloud] Dequeued cloud request. 2026-09-26T23:14:45.597 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T23:14:45.800 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{357844BF-B949-2D31-6048-16B0F5D12A27} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 23:14:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T23:14:46.300 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T23:16:26.053 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T23:16:26.053 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T23:16:26.053 [Cloud] Queued cloud request. 2026-09-26T23:16:26.053 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T23:16:26.053 [Cloud] Dequeued cloud request. 2026-09-26T23:16:26.053 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T23:16:26.240 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8417F383-A863-8FD4-C47D-5220FE60018A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 23:16:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T23:16:26.740 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T23:24:10.883 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T23:28:52.105 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T23:28:52.105 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T23:28:52.105 [Cloud] Queued cloud request. 2026-09-26T23:28:52.105 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T23:28:52.105 [Cloud] Dequeued cloud request. 2026-09-26T23:28:52.105 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T23:28:52.293 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9DBE447A-594B-17A9-868B-96159B5AF21B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-26-2026 23:28:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-26T23:28:52.808 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T23:36:17.201 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T23:36:17.201 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T23:36:17.201 [Cloud] Queued cloud request. 2026-09-26T23:36:17.201 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T23:36:17.435 [Cloud] Dequeued cloud request. 2026-09-26T23:36:17.435 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T23:36:17.607 [Cloud] End of cloud request. 2026-09-26T23:36:18.122 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T23:39:15.891 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T23:39:25.531 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T23:39:25.531 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T23:39:25.531 [Cloud] Queued cloud request. 2026-09-26T23:39:25.531 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T23:39:25.531 [Cloud] Dequeued cloud request. 2026-09-26T23:39:25.531 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T23:39:25.719 [Cloud] End of cloud request. 2026-09-26T23:39:26.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-26T23:39:41.391 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 17895, Count: 1260, MaxTime: 468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-26T23:39:41.391 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 3214, Count: 293, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-26T23:39:41.391 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 1905, Count: 152, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-26T23:39:41.391 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-26T23:39:41.391 ProcessImageName: AgentShellService.exe, Pid: 7376, TotalTime: 806, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 56% 2026-09-26T23:39:41.391 ProcessImageName: WmiPrvSE.exe, Pid: 6452, TotalTime: 615, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-26T23:39:41.391 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-26T23:39:41.391 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-26T23:39:41.391 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 166, Count: 12, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start->(UTF-16LE), EstimatedImpact: 0% 2026-09-26T23:39:41.391 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-26T23:39:41.391 ProcessImageName: python.exe, Pid: 6424, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 2% 2026-09-26T23:39:41.391 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-26T23:39:41.391 ProcessImageName: ngentask.exe, Pid: 7412, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 27% 2026-09-26T23:39:41.391 ProcessImageName: powershell.exe, Pid: 4876, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-26T23:39:41.391 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-26T23:39:41.391 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 0, Count: 4, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-24783-0.MAI, EstimatedImpact: 0% 2026-09-26T23:54:20.895 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-26T23:55:50.491 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-26T23:55:50.491 [Cloud] Start of cloud request. Passive mode: 0 2026-09-26T23:55:50.491 [Cloud] Queued cloud request. 2026-09-26T23:55:50.491 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-26T23:55:50.491 [Cloud] Dequeued cloud request. 2026-09-26T23:55:50.491 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-26T23:55:50.632 [Cloud] End of cloud request. 2026-09-26T23:55:51.148 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T00:07:09.574 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T00:07:09.574 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T00:07:09.574 [Cloud] Queued cloud request. 2026-09-27T00:07:09.574 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T00:07:09.574 [Cloud] Dequeued cloud request. 2026-09-27T00:07:09.574 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T00:07:09.762 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{79D261BB-8230-1389-324A-528C87A40624} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 00:07:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T00:07:10.262 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T00:09:25.904 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T00:19:48.424 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T00:19:48.424 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T00:19:48.424 [Cloud] Queued cloud request. 2026-09-27T00:19:48.424 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T00:19:48.424 [Cloud] Dequeued cloud request. 2026-09-27T00:19:48.424 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T00:19:48.658 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D27E9B52-4073-65B6-5485-5BB37E29E54A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 00:19:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T00:19:49.158 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T00:21:47.939 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T00:21:47.939 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T00:21:47.939 [Cloud] Queued cloud request. 2026-09-27T00:21:47.939 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T00:21:47.939 [Cloud] Dequeued cloud request. 2026-09-27T00:21:47.939 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T00:21:48.127 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{60C6B107-3ACB-3CC6-E95E-99D59D5D1D6F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 00:21:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T00:21:48.642 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T00:24:30.909 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T00:32:34.194 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T00:32:34.194 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T00:32:34.194 [Cloud] Queued cloud request. 2026-09-27T00:32:34.194 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T00:32:34.194 [Cloud] Dequeued cloud request. 2026-09-27T00:32:34.194 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T00:32:44.334 [Cloud] End of cloud request. 2026-09-27T00:32:44.850 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T00:38:04.792 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T00:38:04.792 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T00:38:04.792 [Cloud] Queued cloud request. 2026-09-27T00:38:04.792 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T00:38:04.792 [Cloud] Dequeued cloud request. 2026-09-27T00:38:04.792 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T00:38:04.964 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B09B01AA-C7DB-36F7-79B6-FAB21A039288} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 00:38:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T00:38:05.479 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T00:39:35.917 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T00:43:42.589 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T00:43:42.589 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T00:43:42.589 [Cloud] Queued cloud request. 2026-09-27T00:43:42.589 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T00:43:42.589 [Cloud] Dequeued cloud request. 2026-09-27T00:43:42.589 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T00:43:42.777 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9AA7C984-0B2C-9D2A-FBF1-82ABCED0C16B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 00:43:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T00:43:43.292 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T00:47:11.030 [RTP] [Mini-filter] Copy hint telemetry notification (\Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\AgentShell.exe) sent successfully. 2026-09-27T00:54:40.923 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T01:00:02.066 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018849, FileId: 0xa7000000037705, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.066 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018848, FileId: 0x1d0000000379b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.082 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018855, FileId: 0xa9000000037705, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.082 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018854, FileId: 0x1f0000000379b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.097 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018861, FileId: 0xab000000037705, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.097 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018860, FileId: 0x210000000379b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.113 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018866, FileId: 0x230000000379b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.113 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018867, FileId: 0xad000000037705, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.129 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018873, FileId: 0xaf000000037705, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.129 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018872, FileId: 0x250000000379b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.129 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018878, FileId: 0x270000000379b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.129 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018879, FileId: 0xb1000000037705, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.144 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018885, FileId: 0xb3000000037705, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.144 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018884, FileId: 0x290000000379b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.160 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018890, FileId: 0x2b0000000379b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.160 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018891, FileId: 0xb5000000037705, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.176 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018897, FileId: 0xb7000000037705, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.176 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018896, FileId: 0x2d0000000379b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.176 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018903, FileId: 0xb9000000037705, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.176 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018902, FileId: 0x2f0000000379b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.191 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018908, FileId: 0x310000000379b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.191 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018909, FileId: 0xbb000000037705, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.207 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018915, FileId: 0xbd000000037705, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:00:02.207 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4018914, FileId: 0x330000000379b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-27T01:01:54.785 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T01:01:54.785 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T01:01:54.785 [Cloud] Queued cloud request. 2026-09-27T01:01:54.785 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T01:01:54.785 [Cloud] Dequeued cloud request. 2026-09-27T01:01:54.785 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T01:01:54.972 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{285C094E-A916-9D81-626B-CBF2D8F32BE8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 01:01:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T01:01:55.488 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T01:07:39.336 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T01:07:39.336 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T01:07:39.336 [Cloud] Queued cloud request. 2026-09-27T01:07:39.336 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T01:07:39.336 [Cloud] Dequeued cloud request. 2026-09-27T01:07:39.336 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T01:07:39.523 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{913E70BE-3CA4-FC5E-517B-9794998D98FF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 01:07:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T01:07:40.023 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T01:09:45.930 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T01:12:36.930 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T01:12:36.930 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T01:12:36.930 [Cloud] Queued cloud request. 2026-09-27T01:12:36.930 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T01:12:37.133 [Cloud] Dequeued cloud request. 2026-09-27T01:12:37.133 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T01:12:37.321 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{09B2360F-6E07-E61A-132E-05373B3A0D48} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 01:12:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T01:12:37.837 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T01:19:07.856 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:7D982190-B612-4493-A028-443C6F9B86E7, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-27T01:19:07.856 Scheduled scan with Id 7D982190-B612-4493-A028-443C6F9B86E7 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-27T01:19:07.872 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-27T01:19:07.872 [SFC] System file cache build is not needed (already completed) 2026-09-27T01:19:29.731 Engine:Triggered AR EMS scan 2026-09-27T01:19:29.731 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.747 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.762 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.762 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.762 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.794 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.794 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.809 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.809 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.809 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.809 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.809 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.825 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.825 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.825 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.841 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.841 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.856 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.856 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.856 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.872 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.872 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.872 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.872 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.872 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.887 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.903 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.903 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.919 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.919 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.919 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.934 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.950 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.950 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.950 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.966 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.966 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.981 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.981 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.981 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.981 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.997 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.997 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:29.997 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.028 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.028 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.028 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.044 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.044 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.059 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.059 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.059 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.059 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.075 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.075 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.075 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.091 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.091 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.106 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.106 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:19:30.122 Engine:EMS scan for process: svchost pid: 5636, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-27T01:20:07.559 QuickScan:ScanID:7D982190-B612-4493-A028-443C6F9B86E7: Quick scan finished with error 0 2026-09-27T01:20:08.075 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-27T01:20:08.075 [RTP] Duplicating the current plugin configuration object... 2026-09-27T01:20:08.075 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-27T01:20:08.075 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-27T01:20:08.075 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-27T01:20:08.075 [RTP] No config change detected. Not updating plugin configuration. 2026-09-27T01:20:08.075 [RTP] No config changes found. No configuration switch. 2026-09-27T01:20:08.075 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-27T01:24:50.936 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T01:39:41.459 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 18522, Count: 1287, MaxTime: 468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-27T01:39:41.459 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 4073, Count: 352, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-27T01:39:41.459 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 3214, Count: 293, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T01:39:41.459 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-27T01:39:41.459 ProcessImageName: AgentShellService.exe, Pid: 7376, TotalTime: 806, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 56% 2026-09-27T01:39:41.459 ProcessImageName: WmiPrvSE.exe, Pid: 6452, TotalTime: 615, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-27T01:39:41.459 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 287, Count: 19, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-27T01:39:41.459 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-27T01:39:41.459 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T01:39:41.459 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-27T01:39:41.459 ProcessImageName: python.exe, Pid: 6424, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 2% 2026-09-27T01:39:41.459 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 60, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-27T01:39:41.459 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2.MAI, EstimatedImpact: 0% 2026-09-27T01:39:41.459 ProcessImageName: mysqldump.exe, Pid: 4864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-27T01:39:41.459 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-27T01:39:41.459 ProcessImageName: ngentask.exe, Pid: 7412, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 27% 2026-09-27T01:39:41.459 ProcessImageName: powershell.exe, Pid: 4876, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-27T01:39:41.459 ProcessImageName: cmd.exe, Pid: 1532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-27T01:39:55.944 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T01:51:49.042 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T01:51:49.042 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T01:51:49.042 [Cloud] Queued cloud request. 2026-09-27T01:51:49.042 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T01:51:49.042 [Cloud] Dequeued cloud request. 2026-09-27T01:51:49.042 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T01:51:49.229 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F04432A3-17A7-C085-ACF3-1960E1A8AD4F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 01:51:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T01:51:49.745 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T01:55:00.948 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T01:56:29.044 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T01:56:29.044 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T01:56:29.044 [Cloud] Queued cloud request. 2026-09-27T01:56:29.044 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T01:56:29.044 [Cloud] Dequeued cloud request. 2026-09-27T01:56:29.044 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T01:56:29.231 [Cloud] End of cloud request. 2026-09-27T01:56:29.731 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T02:10:05.956 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T02:24:03.320 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T02:24:03.320 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T02:24:03.320 [Cloud] Queued cloud request. 2026-09-27T02:24:03.320 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T02:24:03.320 [Cloud] Dequeued cloud request. 2026-09-27T02:24:03.320 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T02:24:03.507 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C303577E-0D46-2F32-1A6D-02570854F04C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 02:24:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T02:24:04.008 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T02:25:10.962 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T02:40:15.969 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T02:54:35.724 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T02:54:35.724 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T02:54:35.724 [Cloud] Queued cloud request. 2026-09-27T02:54:35.724 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T02:54:35.724 [Cloud] Dequeued cloud request. 2026-09-27T02:54:35.724 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T02:54:35.911 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F246749E-A8DB-A3CE-A7C1-3457CF89F6C9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 02:54:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T02:54:36.411 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T02:55:20.975 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T02:59:42.930 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T02:59:42.930 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T02:59:42.930 [Cloud] Queued cloud request. 2026-09-27T02:59:42.930 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T02:59:42.930 [Cloud] Dequeued cloud request. 2026-09-27T02:59:42.930 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T02:59:43.117 [Cloud] End of cloud request. 2026-09-27T02:59:43.617 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:07:07.011 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-27T03:07:07.043 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-27T03:07:07.043 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-27T03:07:07.043 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-27T03:07:07.043 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-27T03:07:07.043 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-27T03:07:07.089 [AutoPurge] Cleanup Routine tasks have started. 2026-09-27T03:07:07.125 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-27T03:07:07.125 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-27T03:07:07.125 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-27-2026 03:07:07 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-27-2026 03:07:07 2026-09-27T03:07:07.136 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-27T03:07:07.136 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-27T03:07:07.136 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-27T03:07:07.136 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-27T03:07:07.136 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-27T03:07:07.136 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-27T03:07:07.152 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:07.183 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-27T03:07:07.183 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-27T03:07:07.230 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-27T03:07:07.230 [AutoPurge] Removing expired default signature package ... 2026-09-27T03:07:07.449 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-27T03:07:07.464 Job Notification: New process added to job (4820) 2026-09-27T03:07:07.589 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-27T03:07:07.996 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:07:08.386 Job Notification: Process exited from job (4820) 2026-09-27T03:07:08.449 [AutoPurge] Verification Routine tasks have ended. 2026-09-27T03:07:08.589 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-27T03:07:08.714 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-27T03:07:09.136 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-27T03:07:09.230 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-27T03:07:09.402 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:10.964 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:11.308 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-27T03:07:11.558 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-27T03:07:11.574 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:11.777 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-27T03:07:12.355 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-27T03:07:12.949 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-27T03:07:13.058 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-27T03:07:13.168 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-27T03:07:13.386 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:07:13.558 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-27T03:07:13.871 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-27T03:07:13.980 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-27T03:07:14.152 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:14.261 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:14.308 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:14.324 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-27T03:07:14.464 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:07:14.527 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-27T03:07:14.574 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-27T03:07:14.621 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-27T03:07:14.746 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-27T03:07:15.089 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:15.121 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-27T03:07:15.511 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:15.636 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-27T03:07:16.261 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-27T03:07:16.746 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:16.886 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:17.168 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-27T03:07:17.558 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-27T03:07:17.652 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-27T03:07:17.996 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.271.7\microsoftedgeupdatesetup_x86_1.3.271.7.exe", hr=0x0 2026-09-27T03:07:18.074 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-27T03:07:18.183 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:18.621 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:07:18.761 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-27T03:07:18.761 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-27T03:07:18.824 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-27T03:07:18.980 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-27T03:07:19.043 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-27T03:07:19.089 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:19.168 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-27T03:07:19.371 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-27T03:07:19.761 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-27T03:07:19.996 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-27T03:07:20.480 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-27T03:07:22.027 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-27T03:07:22.511 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-27T03:07:22.543 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-27T03:07:22.574 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:22.574 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-27T03:07:22.605 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-27T03:07:22.730 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-27T03:07:22.933 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-27T03:07:22.949 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:23.027 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-27T03:07:23.387 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-27T03:07:23.433 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-27T03:07:23.449 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-27T03:07:23.496 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-27T03:07:23.965 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:24.043 Engine:Setting original file name "Microsoft(r) DirectX for Windows(r) - Out Of Band" for "c:\program files (x86)\microsoft\edge\application\154.0.4258.37\dxil.dll", hr=0x0 2026-09-27T03:07:24.152 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:24.168 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-27T03:07:24.215 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-27T03:07:24.230 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:24.668 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-27T03:07:24.980 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-27T03:07:24.996 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:25.668 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-27T03:07:25.683 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-27T03:07:26.277 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:26.621 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-27T03:07:27.027 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-27T03:07:27.184 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:27.324 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:27.480 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-27T03:07:27.746 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-27T03:07:27.824 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-27T03:07:27.871 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:28.371 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-27T03:07:28.684 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-27T03:07:28.730 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-27T03:07:28.777 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:07:29.090 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:07:29.340 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-27T03:07:29.449 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-27T03:07:29.574 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-27T03:07:29.605 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-27T03:07:29.684 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-27T03:07:30.246 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-27T03:07:30.730 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-27T03:07:30.824 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-27T03:07:30.949 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:31.527 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-27T03:07:31.574 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:31.918 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-27T03:07:32.027 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-27T03:07:32.043 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-27T03:07:32.090 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-27T03:07:32.184 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-27T03:07:32.231 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-27T03:07:32.262 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-27T03:07:32.621 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-27T03:07:32.621 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-27T03:07:32.949 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-27T03:07:33.106 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:33.215 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-27T03:07:33.231 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-27T03:07:33.449 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:33.652 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-27T03:07:34.043 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:34.324 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-27T03:07:34.465 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-27T03:07:34.809 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-27T03:07:34.824 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:34.996 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-27T03:07:35.106 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-27T03:07:35.590 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-27T03:07:35.652 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-27T03:07:35.856 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:35.871 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-27T03:07:36.074 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-27T03:07:36.137 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-27T03:07:36.340 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:07:36.887 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:37.027 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-27T03:07:37.090 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-27T03:07:37.324 Engine:Setting original file name " " for "c:\program files (x86)\microsoft\edge\application\154.0.4258.37\dxcompiler.dll", hr=0x0 2026-09-27T03:07:37.996 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-27T03:07:37.996 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-27T03:07:38.246 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-27T03:07:38.402 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:38.777 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-27T03:07:39.371 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:07:39.543 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:40.012 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-27T03:07:40.309 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-27T03:07:40.465 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-27T03:07:40.496 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:40.496 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-27T03:07:40.606 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-27T03:07:40.809 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-27T03:07:41.153 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-27T03:07:41.231 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-27T03:07:41.449 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-27T03:07:41.699 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-27T03:07:41.746 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-27T03:07:42.043 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:07:42.246 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-27T03:07:42.434 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-27T03:07:43.231 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:43.293 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-27T03:07:43.371 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-27T03:07:43.418 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-27T03:07:44.324 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-27T03:07:44.403 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-27T03:07:44.496 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-27T03:07:44.637 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-27T03:07:44.840 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-27T03:07:45.012 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-27T03:07:45.699 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-27T03:07:45.746 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-27T03:07:45.762 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-27T03:07:45.824 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-27T03:07:45.918 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-27T03:07:46.246 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-27T03:07:46.387 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-27T03:07:46.403 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-27T03:07:46.418 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-27T03:07:46.512 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:46.543 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-27T03:07:46.574 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:46.903 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-27T03:07:47.028 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-27T03:07:47.309 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-27T03:07:47.418 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:47.653 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-27T03:07:48.012 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-27T03:07:48.106 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-27T03:07:48.293 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-27T03:07:48.528 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-27T03:07:48.590 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-27T03:07:48.668 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:48.840 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:49.028 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-27T03:07:49.293 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-27T03:07:49.496 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:07:49.637 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-27T03:07:49.715 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:49.981 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:07:50.028 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:50.074 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-27T03:07:50.246 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-27T03:07:50.293 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-27T03:07:50.293 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-27T03:07:50.731 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-27T03:07:50.793 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:50.824 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-27T03:07:50.918 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:51.090 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:07:51.215 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-27T03:07:51.340 Engine:Setting original file name "CopilotUpdate.exe" for "c:\windows\systemtemp\copilotupdate.exe.old{9c304e8d-10bc-445a-8771-81a12ae6dd9b}", hr=0x0 2026-09-27T03:07:51.746 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-27T03:07:51.856 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-27T03:07:51.903 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-27T03:07:52.184 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-27T03:07:52.215 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-27T03:07:52.262 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-27T03:07:52.590 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-27T03:07:52.637 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-27T03:07:52.949 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-27T03:07:53.028 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-27T03:07:53.059 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-27T03:07:53.074 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:53.090 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:53.121 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:07:53.121 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-27T03:07:53.153 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:53.746 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-27T03:07:54.028 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:54.293 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:54.324 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-27T03:07:54.559 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:54.574 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:07:54.699 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-27T03:07:54.981 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:54.996 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-27T03:07:55.153 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-27T03:07:55.168 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-27T03:07:55.278 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-27T03:07:55.356 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-27T03:07:55.356 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:55.590 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-27T03:07:55.621 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-27T03:07:55.621 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-27T03:07:55.762 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-27T03:07:55.918 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:56.090 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-27T03:07:56.418 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\winsxs\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.20348.3692_none_ea9c313aecda491b\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-27T03:07:56.528 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-27T03:07:56.637 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:56.824 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-27T03:07:56.981 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:56.996 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-27T03:07:56.996 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:07:57.231 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-27T03:07:57.231 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-27T03:07:57.434 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:57.559 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-27T03:07:57.574 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-27T03:07:58.278 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:07:58.278 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-27T03:07:58.371 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-27T03:07:58.481 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:07:58.496 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:07:59.200 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:07:59.590 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-27T03:07:59.762 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-27T03:07:59.778 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-27T03:07:59.996 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:00.059 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-27T03:08:00.246 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-27T03:08:00.356 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-27T03:08:00.403 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-27T03:08:00.715 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-27T03:08:00.746 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:08:00.981 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:08:00.996 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:01.043 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-27T03:08:01.653 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-27T03:08:02.215 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-27T03:08:02.246 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:02.293 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-27T03:08:02.403 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:08:02.575 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:02.653 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-27T03:08:02.934 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-27T03:08:03.387 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:03.418 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-27T03:08:03.653 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:08:03.793 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-27T03:08:04.012 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-27T03:08:04.028 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:04.278 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-27T03:08:04.637 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-27T03:08:04.684 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:04.778 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:04.903 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-27T03:08:04.918 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-27T03:08:05.278 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-27T03:08:05.387 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:05.543 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-27T03:08:05.575 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-27T03:08:05.590 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:05.637 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:08:05.793 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-27T03:08:05.856 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:08:06.262 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-27T03:08:06.340 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-27T03:08:06.825 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-27T03:08:06.887 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-27T03:08:06.950 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-27T03:08:07.059 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-27T03:08:07.106 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:08:07.153 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-27T03:08:07.215 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-27T03:08:07.637 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-27T03:08:07.793 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-27T03:08:08.012 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-27T03:08:08.012 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-27T03:08:08.340 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-27T03:08:08.356 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:08.637 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-27T03:08:08.965 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-27T03:08:09.293 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-27T03:08:09.371 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-27T03:08:09.418 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-27T03:08:09.465 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:08:09.590 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-27T03:08:09.637 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-27T03:08:09.684 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-27T03:08:09.762 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-27T03:08:10.090 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-27T03:08:10.121 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:08:10.168 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:08:10.481 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-27T03:08:10.575 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:08:10.746 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-27T03:08:10.950 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-27T03:08:11.231 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-27T03:08:11.246 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:11.575 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-27T03:08:11.590 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-27T03:08:11.621 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-27T03:08:11.856 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-27T03:08:12.090 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-27T03:08:12.106 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-27T03:08:12.434 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-27T03:08:12.528 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-27T03:08:12.621 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-27T03:08:12.715 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:08:12.731 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-27T03:08:12.887 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-27T03:08:13.106 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-27T03:08:13.278 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-27T03:08:13.371 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-27T03:08:13.528 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-27T03:08:14.871 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-27T03:08:15.262 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-27T03:08:15.403 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-27T03:08:15.637 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:08:15.996 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-27T03:08:16.153 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-27T03:08:16.403 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-27T03:08:16.653 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-27T03:08:16.746 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-27T03:08:16.778 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-27T03:08:16.778 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-27T03:08:16.903 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-27T03:08:17.200 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-27T03:08:17.215 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:17.231 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-27T03:08:17.293 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-27T03:08:17.325 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-27T03:08:17.403 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-27T03:08:17.762 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-27T03:08:17.840 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-27T03:08:18.028 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-27T03:08:18.028 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:18.121 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-27T03:08:18.137 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-27T03:08:18.325 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-27T03:08:18.371 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:08:18.606 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-27T03:08:18.903 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-27T03:08:19.356 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:08:19.840 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-27T03:08:19.918 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-27T03:08:20.340 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-27T03:08:20.684 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:08:20.778 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:21.028 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-27T03:08:21.278 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-27T03:08:21.340 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-27T03:08:21.481 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-27T03:08:21.653 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-27T03:08:22.059 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-27T03:08:22.778 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-27T03:08:22.856 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-27T03:08:22.950 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-27T03:08:23.512 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-27T03:08:23.621 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-27T03:08:23.903 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-27T03:08:23.981 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-27T03:08:24.075 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-27T03:08:24.075 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-27T03:08:24.496 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-27T03:08:24.606 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-27T03:08:24.621 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:24.653 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-27T03:08:24.918 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-27T03:08:24.934 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:08:25.121 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-27T03:08:25.309 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-27T03:08:25.606 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-27T03:08:26.090 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-27T03:08:26.184 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:08:26.371 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:26.543 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-27T03:08:26.856 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:26.934 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-27T03:08:27.137 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-27T03:08:27.293 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-27T03:08:27.418 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:27.528 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-27T03:08:27.746 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-27T03:08:28.090 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-27T03:08:28.137 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-27T03:08:28.168 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-27T03:08:28.309 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:28.340 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-27T03:08:28.668 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-27T03:08:28.793 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-27T03:08:28.903 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:29.778 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-27T03:08:30.293 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-27T03:08:30.356 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-27T03:08:30.403 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-27T03:08:30.450 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-27T03:08:30.793 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:30.856 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-27T03:08:31.043 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-27T03:08:31.137 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-27T03:08:31.200 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-27T03:08:31.278 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:31.356 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-27T03:08:31.543 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-27T03:08:31.606 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-27T03:08:31.934 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-27T03:08:32.012 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-27T03:08:32.090 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-27T03:08:32.090 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-27T03:08:32.106 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-27T03:08:32.121 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-27T03:08:32.215 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-27T03:08:32.231 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:08:32.246 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-27T03:08:32.293 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-27T03:08:32.637 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-27T03:08:32.668 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-27T03:08:32.981 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:08:33.028 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-27T03:08:33.059 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-27T03:08:33.075 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-27T03:08:33.856 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-27T03:08:33.996 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:08:34.168 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:08:34.168 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-27T03:08:34.340 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-27T03:08:34.590 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-27T03:08:34.700 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-27T03:08:34.778 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:35.434 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-27T03:08:35.465 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-27T03:08:35.606 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-27T03:08:35.621 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-27T03:08:35.621 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:08:36.184 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:08:36.184 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-27T03:08:36.309 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-27T03:08:36.325 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-27T03:08:36.465 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-27T03:08:36.840 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-27T03:08:37.215 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-27T03:08:37.450 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:37.543 Engine:Setting original file name "Vulkan Runtime" for "c:\program files (x86)\microsoft\edgecore\optimized\vulkan-1.dll", hr=0x0 2026-09-27T03:08:37.871 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-27T03:08:38.106 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-27T03:08:38.137 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-27T03:08:38.293 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-27T03:08:38.325 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-27T03:08:38.434 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-27T03:08:38.528 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-27T03:08:38.590 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-27T03:08:38.606 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:08:38.871 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-27T03:08:38.950 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-27T03:08:39.231 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-27T03:08:39.340 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-27T03:08:39.496 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-27T03:08:39.512 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:08:39.653 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\de-de\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:39.793 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-console-l1-1-0.dll", hr=0x0 2026-09-27T03:08:39.934 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0 2026-09-27T03:08:39.934 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-registry-l2-1-0.dll", hr=0x0 2026-09-27T03:08:40.325 Engine:Setting original file name "MrmCore.dll" for "c:\windows\winsxs\wow64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.20348.5020_none_9e6a80bbc86408d7\mrmcorer.dll", hr=0x0 2026-09-27T03:08:40.340 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:40.450 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_en-gb_56416fd74780e848\vsswmi.dll.mui", hr=0x0 2026-09-27T03:08:40.450 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\es-es\aerolite.msstyles.mui", hr=0x0 2026-09-27T03:08:40.606 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_7573f1c6d4639f87\penimc.dll", hr=0x0 2026-09-27T03:08:40.621 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.data.winmd", hr=0x0 2026-09-27T03:08:40.793 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\de-de\ndisimplatcim.dll.mui", hr=0x0 2026-09-27T03:08:40.856 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_4e347e352039867c\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:40.981 Engine:Setting original file name "winsqlite3" for "c:\windows\winsxs\wow64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.20348.4647_none_c9096b99901f19cd\winsqlite3.dll", hr=0x0 2026-09-27T03:08:41.012 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0 2026-09-27T03:08:41.012 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000c.dll", hr=0x0 2026-09-27T03:08:41.559 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-1-0.dll", hr=0x0 2026-09-27T03:08:41.559 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata000a.dll", hr=0x0 2026-09-27T03:08:41.871 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-2-0.dll", hr=0x0 2026-09-27T03:08:41.965 Engine:Setting original file name "wmic.exe" for "c:\windows\winsxs\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.20348.2849_none_54405a5933961199\wmic.exe", hr=0x0 2026-09-27T03:08:42.121 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.storage.winmd", hr=0x0 2026-09-27T03:08:42.450 Engine:Setting original file name "CRYPT32.DLL" for "c:\windows\systemresources\crypt32.dll.mun", hr=0x0 2026-09-27T03:08:42.684 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_7d8ffbc5cb37c8e0\bootmgr.exe.mui", hr=0x0 2026-09-27T03:08:42.746 Engine:Setting original file name "mstsc.exe" for "c:\windows\systemresources\mstsc.exe.mun", hr=0x0 2026-09-27T03:08:42.965 Engine:Setting original file name "SYSTEMCPL.DLL" for "c:\windows\systemresources\systemcpl.dll.mun", hr=0x0 2026-09-27T03:08:42.996 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0 2026-09-27T03:08:43.121 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1e6e07718388e886\diagpackage.dll.mui", hr=0x0 2026-09-27T03:08:43.168 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0 2026-09-27T03:08:43.825 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0 2026-09-27T03:08:43.825 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mpg4decd_31bf3856ad364e35_10.0.20348.2849_none_08e768f194682e23\mpg4decd.dll", hr=0x0 2026-09-27T03:08:43.840 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0 2026-09-27T03:08:43.871 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0 2026-09-27T03:08:44.059 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-1.dll", hr=0x0 2026-09-27T03:08:44.075 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\naturallanguage6.dll", hr=0x0 2026-09-27T03:08:44.543 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0 2026-09-27T03:08:44.778 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0 2026-09-27T03:08:45.059 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ja-jp_5634cc97d85965d9\bootmgr_ex.efi.mui", hr=0x0 2026-09-27T03:08:45.059 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0 2026-09-27T03:08:45.231 OriginalFileName Maintenance::28517 files in Moac, 0 skipped (cached), 539 filename set 2026-09-27T03:08:45.231 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-27T03:10:25.981 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T03:11:27.121 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T03:11:27.121 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T03:11:27.121 [Cloud] Queued cloud request. 2026-09-27T03:11:27.121 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T03:11:27.121 [Cloud] Dequeued cloud request. 2026-09-27T03:11:27.121 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T03:11:27.309 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4B432AB0-82E5-CA78-48FA-0A2223B73D2C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 03:11:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T03:11:27.825 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-27T03:11:27.856 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:11:27.856 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-27T03:11:27.856 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-27T03:11:27.856 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-27T03:11:27.856 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-27T03:11:27.856 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-27T03:11:27.856 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-27T03:11:27.856 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-27T03:11:27.856 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-27T03:11:27.856 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-27T03:11:27.856 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-27T03:11:27.856 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-27T03:11:27.856 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-27T03:11:27.856 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-27T03:11:27.856 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-27T03:11:27.856 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:11:27.856 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-27T03:11:27.856 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-27T03:11:27.856 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-27T03:11:27.856 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-27T03:11:27.856 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-27T03:11:27.856 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-27T03:11:27.856 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:11:27.856 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:11:27.856 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:11:30.434 [RTP] Duplicating the current plugin configuration object... 2026-09-27T03:11:30.434 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-27T03:11:30.434 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-27T03:11:30.434 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-27T03:11:30.434 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-27T03:11:30.434 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-27T03:16:17.233 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T03:16:17.233 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T03:16:17.233 [Cloud] Queued cloud request. 2026-09-27T03:16:17.233 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T03:16:17.233 [Cloud] Dequeued cloud request. 2026-09-27T03:16:17.233 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T03:16:17.405 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F218A02F-2A79-925A-BE1E-AC60E00C4257} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 03:16:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T03:16:17.920 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:23:10.423 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T03:23:10.423 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T03:23:10.423 [Cloud] Queued cloud request. 2026-09-27T03:23:10.423 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T03:23:10.423 [Cloud] Dequeued cloud request. 2026-09-27T03:23:10.423 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T03:23:10.610 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A043F3FF-430F-AF0A-4724-ADA46C0A8C6E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 03:23:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T03:23:11.110 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:25:30.988 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T03:26:51.551 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T03:26:51.551 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T03:26:51.551 [Cloud] Queued cloud request. 2026-09-27T03:26:51.551 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T03:26:51.707 [Cloud] Dequeued cloud request. 2026-09-27T03:26:51.879 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T03:26:52.051 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{13CEE2B0-ED28-D8AD-8372-733C3B0ACFA9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 03:26:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T03:26:52.551 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:35:09.475 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T03:35:09.475 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T03:35:09.475 [Cloud] Queued cloud request. 2026-09-27T03:35:09.475 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T03:35:09.475 [Cloud] Dequeued cloud request. 2026-09-27T03:35:09.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T03:35:09.663 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4CD4EA99-63E5-AC6B-7742-686E7341F216} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 03:35:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T03:35:10.163 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:39:34.947 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T03:39:34.947 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T03:39:34.947 [Cloud] Queued cloud request. 2026-09-27T03:39:34.947 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T03:39:34.947 [Cloud] Dequeued cloud request. 2026-09-27T03:39:34.947 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T03:39:35.119 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{84B0B651-8C52-F0F4-3804-0B2F1EDCF5D6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 03:39:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T03:39:35.634 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:39:41.509 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 19622, Count: 1409, MaxTime: 468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-27T03:39:41.509 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 6206, Count: 552, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-27T03:39:41.509 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 3214, Count: 293, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T03:39:41.509 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-27T03:39:41.509 ProcessImageName: AgentShellService.exe, Pid: 7376, TotalTime: 806, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 56% 2026-09-27T03:39:41.509 ProcessImageName: WmiPrvSE.exe, Pid: 6452, TotalTime: 615, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-27T03:39:41.509 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 333, Count: 21, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-27T03:39:41.509 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-27T03:39:41.509 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T03:39:41.509 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-27T03:39:41.509 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 90, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-27T03:39:41.509 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2.MAI, EstimatedImpact: 0% 2026-09-27T03:39:41.509 ProcessImageName: python.exe, Pid: 6424, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 2% 2026-09-27T03:39:41.509 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-27T03:39:41.509 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-27T03:39:41.509 ProcessImageName: mysqldump.exe, Pid: 4864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-27T03:39:41.509 ProcessImageName: ngentask.exe, Pid: 7412, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 27% 2026-09-27T03:39:41.509 ProcessImageName: powershell.exe, Pid: 4876, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-27T03:39:41.509 ProcessImageName: cmd.exe, Pid: 1532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-27T03:39:41.509 ProcessImageName: DeviceCensus.exe, Pid: 7992, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\WaaSAssessmentSettings.json, EstimatedImpact: 1% 2026-09-27T03:40:23.462 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T03:40:23.462 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T03:40:23.462 [Cloud] Queued cloud request. 2026-09-27T03:40:23.462 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T03:40:23.462 [Cloud] Dequeued cloud request. 2026-09-27T03:40:23.462 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T03:40:23.541 [Cloud] End of cloud request. 2026-09-27T03:40:24.041 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:40:35.994 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T03:40:48.681 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T03:40:48.681 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T03:40:48.681 [Cloud] Queued cloud request. 2026-09-27T03:40:48.681 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T03:40:48.681 [Cloud] Dequeued cloud request. 2026-09-27T03:40:48.681 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T03:40:48.759 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CC4C1B23-E39E-67A3-8A37-F52EA55A9ACE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 03:40:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T03:40:49.275 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:46:22.354 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T03:46:22.354 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T03:46:22.354 [Cloud] Queued cloud request. 2026-09-27T03:46:22.354 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T03:46:22.354 [Cloud] Dequeued cloud request. 2026-09-27T03:46:22.354 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T03:46:22.542 [Cloud] End of cloud request. 2026-09-27T03:46:23.057 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T03:55:41.000 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T04:02:11.830 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:02:11.830 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:02:11.830 [Cloud] Queued cloud request. 2026-09-27T04:02:11.830 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:02:11.830 [Cloud] Dequeued cloud request. 2026-09-27T04:02:11.830 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:02:11.986 [Cloud] End of cloud request. 2026-09-27T04:02:12.502 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T04:02:55.642 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:02:55.642 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:02:55.642 [Cloud] Queued cloud request. 2026-09-27T04:02:55.642 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:02:55.642 [Cloud] Dequeued cloud request. 2026-09-27T04:02:55.642 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:02:55.721 [Cloud] End of cloud request. 2026-09-27T04:02:56.236 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T04:05:10.815 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:05:10.815 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:05:10.815 [Cloud] Queued cloud request. 2026-09-27T04:05:10.815 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:05:10.815 [Cloud] Dequeued cloud request. 2026-09-27T04:05:10.815 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:05:20.910 [Cloud] End of cloud request. 2026-09-27T04:05:21.425 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T04:09:24.834 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:09:24.834 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:09:24.834 [Cloud] Queued cloud request. 2026-09-27T04:09:24.834 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:09:24.834 [Cloud] Dequeued cloud request. 2026-09-27T04:09:24.834 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:09:24.975 [Cloud] End of cloud request. 2026-09-27T04:09:25.490 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T04:10:46.006 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T04:14:27.944 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:14:27.944 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:14:27.944 [Cloud] Queued cloud request. 2026-09-27T04:14:27.944 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:14:27.944 [Cloud] Dequeued cloud request. 2026-09-27T04:14:27.944 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:14:28.147 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{65D5E44F-1222-9E1E-54EC-627E3831DF24} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 04:14:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T04:14:28.647 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T04:23:54.526 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:23:54.526 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:23:54.526 [Cloud] Queued cloud request. 2026-09-27T04:23:54.526 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:23:54.526 [Cloud] Dequeued cloud request. 2026-09-27T04:23:54.526 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:23:54.698 [Cloud] End of cloud request. 2026-09-27T04:23:55.214 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T04:25:51.011 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T04:28:49.014 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:28:49.014 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:28:49.014 [Cloud] Queued cloud request. 2026-09-27T04:28:49.014 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:28:49.014 [Cloud] Dequeued cloud request. 2026-09-27T04:28:49.014 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:28:49.202 [Cloud] End of cloud request. 2026-09-27T04:28:49.718 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T04:32:01.374 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:32:01.374 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:32:01.374 [Cloud] Queued cloud request. 2026-09-27T04:32:01.374 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:32:01.374 [Cloud] Dequeued cloud request. 2026-09-27T04:32:01.374 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:32:01.561 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{944120C8-3212-11E4-7E5C-17F37C524977} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 04:32:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T04:32:02.061 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T04:32:05.874 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:32:05.874 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:32:05.874 [Cloud] Queued cloud request. 2026-09-27T04:32:05.874 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:32:05.874 [Cloud] Dequeued cloud request. 2026-09-27T04:32:05.874 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:32:05.952 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{56ABF136-BC3F-7598-0B38-2C389903707D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 04:32:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T04:32:06.468 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T04:40:56.019 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T04:44:26.285 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:44:26.285 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:44:26.285 [Cloud] Queued cloud request. 2026-09-27T04:44:26.285 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:44:26.285 [Cloud] Dequeued cloud request. 2026-09-27T04:44:26.285 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:44:36.378 [Cloud] End of cloud request. 2026-09-27T04:44:36.894 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T04:49:11.788 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:49:11.788 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:49:11.788 [Cloud] Queued cloud request. 2026-09-27T04:49:11.788 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:49:11.788 [Cloud] Dequeued cloud request. 2026-09-27T04:49:11.788 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:49:18.757 [Cloud] End of cloud request. 2026-09-27T04:49:19.273 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T04:56:01.025 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T04:56:20.416 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:56:20.416 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:56:20.416 [Cloud] Queued cloud request. 2026-09-27T04:56:20.416 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:56:20.416 [Cloud] Dequeued cloud request. 2026-09-27T04:56:20.416 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:56:20.572 [Cloud] End of cloud request. 2026-09-27T04:56:21.072 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T04:57:03.041 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T04:57:03.041 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T04:57:03.041 [Cloud] Queued cloud request. 2026-09-27T04:57:03.041 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T04:57:03.041 [Cloud] Dequeued cloud request. 2026-09-27T04:57:03.041 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T04:57:03.119 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DF4D08F0-50FA-96F9-A876-5814DEBA7C69} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 04:57:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T04:57:03.635 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T05:01:00.824 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T05:01:00.824 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T05:01:00.824 [Cloud] Queued cloud request. 2026-09-27T05:01:00.824 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T05:01:00.824 [Cloud] Dequeued cloud request. 2026-09-27T05:01:00.824 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T05:01:00.964 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{59E6EEEC-C065-9E54-1F21-EAEF1E175CC1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 05:01:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T05:01:01.464 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T05:11:06.031 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T05:25:44.444 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T05:25:44.444 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T05:25:44.444 [Cloud] Queued cloud request. 2026-09-27T05:25:44.444 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T05:25:44.444 [Cloud] Dequeued cloud request. 2026-09-27T05:25:44.444 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T05:25:44.585 [Cloud] End of cloud request. 2026-09-27T05:25:45.101 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T05:26:11.038 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T05:28:05.055 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T05:28:05.055 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T05:28:05.055 [Cloud] Queued cloud request. 2026-09-27T05:28:05.055 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T05:28:05.055 [Cloud] Dequeued cloud request. 2026-09-27T05:28:05.055 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T05:28:05.211 [Cloud] End of cloud request. 2026-09-27T05:28:05.711 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T05:34:28.478 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T05:34:28.478 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T05:34:28.478 [Cloud] Queued cloud request. 2026-09-27T05:34:28.478 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T05:34:28.478 [Cloud] Dequeued cloud request. 2026-09-27T05:34:28.478 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T05:34:28.635 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C469DCA-F58B-FBD5-F3A8-54605D101610} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 05:34:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T05:34:29.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T05:38:10.622 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T05:38:10.622 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T05:38:10.622 [Cloud] Queued cloud request. 2026-09-27T05:38:10.622 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T05:38:10.622 [Cloud] Dequeued cloud request. 2026-09-27T05:38:10.622 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T05:38:10.825 [Cloud] End of cloud request. 2026-09-27T05:38:11.325 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T05:39:23.825 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T05:39:23.825 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T05:39:23.825 [Cloud] Queued cloud request. 2026-09-27T05:39:23.825 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T05:39:23.825 [Cloud] Dequeued cloud request. 2026-09-27T05:39:23.825 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T05:39:23.997 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E646DB63-5765-9309-6B15-196A5DCFA32B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 05:39:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T05:39:24.513 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T05:39:41.575 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 20314, Count: 1454, MaxTime: 468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-27T05:39:41.575 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 8326, Count: 752, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-27T05:39:41.575 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 3214, Count: 293, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T05:39:41.575 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-27T05:39:41.575 ProcessImageName: AgentShellService.exe, Pid: 7376, TotalTime: 806, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 56% 2026-09-27T05:39:41.575 ProcessImageName: WmiPrvSE.exe, Pid: 6452, TotalTime: 615, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-27T05:39:41.575 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 348, Count: 23, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-27T05:39:41.575 ProcessImageName: powershell.exe, Pid: 7460, TotalTime: 263, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-27T05:39:41.575 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-27T05:39:41.575 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T05:39:41.575 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-27T05:39:41.575 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 105, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-27T05:39:41.575 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2.MAI, EstimatedImpact: 0% 2026-09-27T05:39:41.575 ProcessImageName: python.exe, Pid: 5824, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\cffi-1.16.0.dist-info\entry_points.txt, EstimatedImpact: 2% 2026-09-27T05:39:41.575 ProcessImageName: python.exe, Pid: 6424, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 2% 2026-09-27T05:39:41.575 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-27T05:39:41.575 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-27T05:39:41.575 ProcessImageName: mysqldump.exe, Pid: 4864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-27T05:39:41.575 ProcessImageName: powershell.exe, Pid: 4876, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-27T05:39:41.575 ProcessImageName: ngentask.exe, Pid: 7412, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 27% 2026-09-27T05:39:41.575 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-27T05:39:41.575 ProcessImageName: cmd.exe, Pid: 1532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-27T05:39:41.575 ProcessImageName: DeviceCensus.exe, Pid: 7992, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\WaaSAssessmentSettings.json, EstimatedImpact: 1% 2026-09-27T05:41:16.044 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T05:53:46.752 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T05:53:46.752 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T05:53:46.752 [Cloud] Queued cloud request. 2026-09-27T05:53:46.752 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T05:53:46.752 [Cloud] Dequeued cloud request. 2026-09-27T05:53:46.752 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T05:53:46.908 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{21FCAFC9-E7ED-3D94-D757-F42BF8E01A54} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 05:53:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T05:53:47.408 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T05:56:21.051 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T05:58:18.458 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T05:58:18.458 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T05:58:18.458 [Cloud] Queued cloud request. 2026-09-27T05:58:18.458 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T05:58:18.458 [Cloud] Dequeued cloud request. 2026-09-27T05:58:18.458 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T05:58:18.958 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{85116E82-A6A2-28F5-9602-64957EC65268} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 05:58:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T05:58:19.458 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:01:51.194 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:01:51.194 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:01:51.194 [Cloud] Queued cloud request. 2026-09-27T06:01:51.194 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:01:51.194 [Cloud] Dequeued cloud request. 2026-09-27T06:01:51.194 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:01:51.334 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{996162F7-CD62-AA5D-C1D2-FD8E559C2F20} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 06:01:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T06:01:51.834 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:03:15.929 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:03:15.929 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:03:15.929 [Cloud] Queued cloud request. 2026-09-27T06:03:15.929 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:03:15.929 [Cloud] Dequeued cloud request. 2026-09-27T06:03:15.929 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:03:26.023 [Cloud] End of cloud request. 2026-09-27T06:03:26.523 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:04:32.382 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:04:32.382 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:04:32.382 [Cloud] Queued cloud request. 2026-09-27T06:04:32.382 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:04:32.382 [Cloud] Dequeued cloud request. 2026-09-27T06:04:32.382 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:04:32.523 [Cloud] End of cloud request. 2026-09-27T06:04:33.023 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:07:13.868 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:07:13.868 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:07:13.868 [Cloud] Queued cloud request. 2026-09-27T06:07:13.868 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:07:13.883 [Cloud] Dequeued cloud request. 2026-09-27T06:07:13.883 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:07:14.008 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7299B947-5869-8D5E-C106-4D20C0889EB3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 06:07:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T06:07:14.508 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:07:52.681 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:07:52.681 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:07:52.681 [Cloud] Queued cloud request. 2026-09-27T06:07:52.681 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:07:52.681 [Cloud] Dequeued cloud request. 2026-09-27T06:07:52.681 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:07:55.275 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DDC83FA0-284A-4381-A5EF-15C6BF5E1981} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 06:07:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T06:07:55.775 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:10:29.713 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:10:29.713 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:10:29.713 [Cloud] Queued cloud request. 2026-09-27T06:10:29.713 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:10:29.713 [Cloud] Dequeued cloud request. 2026-09-27T06:10:29.713 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:10:29.869 [Cloud] End of cloud request. 2026-09-27T06:10:30.384 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:11:26.056 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T06:19:48.357 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:19:48.357 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:19:48.357 [Cloud] Queued cloud request. 2026-09-27T06:19:48.357 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:19:48.545 [Cloud] Dequeued cloud request. 2026-09-27T06:19:48.779 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:19:48.967 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{466DA660-F841-4A70-2694-6FEBBBE1A1BD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 06:19:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T06:19:49.482 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:25:14.000 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:25:14.000 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:25:14.000 [Cloud] Queued cloud request. 2026-09-27T06:25:14.000 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:25:14.000 [Cloud] Dequeued cloud request. 2026-09-27T06:25:14.000 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:25:16.234 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{24972C96-06D1-636D-5FBF-4592281501BC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 06:25:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T06:25:16.734 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:26:31.063 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T06:27:25.080 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:27:25.080 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:27:25.080 [Cloud] Queued cloud request. 2026-09-27T06:27:25.080 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:27:25.080 [Cloud] Dequeued cloud request. 2026-09-27T06:27:25.080 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:27:35.158 [Cloud] End of cloud request. 2026-09-27T06:27:35.658 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:28:08.408 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:28:08.408 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:28:08.408 [Cloud] Queued cloud request. 2026-09-27T06:28:08.408 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:28:08.408 [Cloud] Dequeued cloud request. 2026-09-27T06:28:08.408 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:28:18.440 [Cloud] End of cloud request. 2026-09-27T06:28:18.940 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:29:16.080 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:29:16.080 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:29:16.080 [Cloud] Queued cloud request. 2026-09-27T06:29:16.080 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:29:16.080 [Cloud] Dequeued cloud request. 2026-09-27T06:29:16.080 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:29:16.158 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B79E155E-5985-5F6F-7EE3-198CBF459F06} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 06:29:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T06:29:16.565 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:31:54.800 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:31:54.800 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:31:54.800 [Cloud] Queued cloud request. 2026-09-27T06:31:54.800 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:31:54.956 [Cloud] Dequeued cloud request. 2026-09-27T06:31:54.956 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:31:55.128 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9537E725-82E4-9DC3-1EDC-3AC0E34799AB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 06:31:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T06:31:55.644 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:41:36.069 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T06:45:19.742 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:45:19.742 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:45:19.742 [Cloud] Queued cloud request. 2026-09-27T06:45:19.742 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:45:19.742 [Cloud] Dequeued cloud request. 2026-09-27T06:45:19.742 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:45:19.899 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{30600126-659C-E7DA-E96D-4444D5576711} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 06:45:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T06:45:20.399 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:46:23.260 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T06:46:23.260 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T06:46:23.260 [Cloud] Queued cloud request. 2026-09-27T06:46:23.260 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T06:46:23.260 [Cloud] Dequeued cloud request. 2026-09-27T06:46:23.260 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T06:46:23.416 [Cloud] End of cloud request. 2026-09-27T06:46:23.931 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T06:56:41.076 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T07:05:46.516 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:05:46.516 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:05:46.516 [Cloud] Queued cloud request. 2026-09-27T07:05:46.516 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:05:46.516 [Cloud] Dequeued cloud request. 2026-09-27T07:05:46.516 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:05:46.688 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1950F5BE-8AD6-910D-12CF-210322BA0AE9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 07:05:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T07:05:47.188 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:06:19.642 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:06:19.642 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:06:19.642 [Cloud] Queued cloud request. 2026-09-27T07:06:19.642 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:06:19.642 [Cloud] Dequeued cloud request. 2026-09-27T07:06:19.642 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:06:19.720 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4F1219C2-A17C-47E1-32B6-C886215FBA41} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 07:06:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T07:06:20.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:10:36.035 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:10:36.035 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:10:36.035 [Cloud] Queued cloud request. 2026-09-27T07:10:36.035 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:10:36.035 [Cloud] Dequeued cloud request. 2026-09-27T07:10:36.035 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:10:36.207 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{744A36BF-F9AC-6735-ADAC-DD7F923FB28C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 07:10:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T07:10:36.707 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:11:46.082 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T07:22:11.711 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:22:11.711 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:22:11.711 [Cloud] Queued cloud request. 2026-09-27T07:22:11.711 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:22:11.711 [Cloud] Dequeued cloud request. 2026-09-27T07:22:11.711 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:22:11.898 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9038335D-D4C3-0483-FE15-DE309D316A21} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 07:22:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T07:22:12.398 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:22:37.023 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:22:37.023 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:22:37.023 [Cloud] Queued cloud request. 2026-09-27T07:22:37.023 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:22:37.023 [Cloud] Dequeued cloud request. 2026-09-27T07:22:37.023 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:22:37.101 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{790AB30B-10FB-E2B7-605A-5E323E815BDE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 07:22:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T07:22:37.601 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:26:51.089 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T07:28:28.199 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:28:28.199 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:28:28.199 [Cloud] Queued cloud request. 2026-09-27T07:28:28.199 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:28:28.199 [Cloud] Dequeued cloud request. 2026-09-27T07:28:28.199 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:28:36.652 [Cloud] End of cloud request. 2026-09-27T07:28:37.152 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:39:41.641 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 32084, Count: 2269, MaxTime: 468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-27T07:39:41.641 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 10243, Count: 952, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-27T07:39:41.641 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 3214, Count: 293, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T07:39:41.641 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-27T07:39:41.641 ProcessImageName: AgentShellService.exe, Pid: 7376, TotalTime: 806, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 56% 2026-09-27T07:39:41.641 ProcessImageName: WmiPrvSE.exe, Pid: 6452, TotalTime: 615, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-27T07:39:41.641 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 378, Count: 25, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-27T07:39:41.641 ProcessImageName: powershell.exe, Pid: 7460, TotalTime: 263, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-27T07:39:41.641 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-27T07:39:41.641 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T07:39:41.641 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-27T07:39:41.641 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 105, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-27T07:39:41.641 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 62, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2.MAI, EstimatedImpact: 0% 2026-09-27T07:39:41.641 ProcessImageName: python.exe, Pid: 6424, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 2% 2026-09-27T07:39:41.641 ProcessImageName: python.exe, Pid: 5824, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\cffi-1.16.0.dist-info\entry_points.txt, EstimatedImpact: 2% 2026-09-27T07:39:41.641 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-27T07:39:41.641 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-27T07:39:41.641 ProcessImageName: mysqldump.exe, Pid: 4864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-27T07:39:41.641 ProcessImageName: ngentask.exe, Pid: 7412, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 27% 2026-09-27T07:39:41.641 ProcessImageName: powershell.exe, Pid: 4876, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-27T07:39:41.641 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-27T07:39:41.641 ProcessImageName: cmd.exe, Pid: 1532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-27T07:39:41.641 ProcessImageName: DeviceCensus.exe, Pid: 7992, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\WaaSAssessmentSettings.json, EstimatedImpact: 1% 2026-09-27T07:41:12.532 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:41:12.532 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:41:12.532 [Cloud] Queued cloud request. 2026-09-27T07:41:12.532 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:41:12.532 [Cloud] Dequeued cloud request. 2026-09-27T07:41:12.532 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:41:12.719 [Cloud] End of cloud request. 2026-09-27T07:41:13.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:41:16.016 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:41:16.016 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:41:16.016 [Cloud] Queued cloud request. 2026-09-27T07:41:16.016 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:41:16.219 [Cloud] Dequeued cloud request. 2026-09-27T07:41:16.219 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:41:26.235 [Cloud] End of cloud request. 2026-09-27T07:41:26.735 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:41:56.094 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T07:44:08.501 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:44:08.501 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:44:08.501 [Cloud] Queued cloud request. 2026-09-27T07:44:08.501 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:44:08.501 [Cloud] Dequeued cloud request. 2026-09-27T07:44:08.501 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:44:08.672 [Cloud] End of cloud request. 2026-09-27T07:44:09.188 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:47:12.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:47:12.097 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:47:12.097 [Cloud] Queued cloud request. 2026-09-27T07:47:12.097 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:47:12.097 [Cloud] Dequeued cloud request. 2026-09-27T07:47:12.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:47:12.269 [Cloud] End of cloud request. 2026-09-27T07:47:12.769 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:47:40.551 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:47:40.551 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:47:40.551 [Cloud] Queued cloud request. 2026-09-27T07:47:40.551 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:47:40.551 [Cloud] Dequeued cloud request. 2026-09-27T07:47:40.551 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:47:40.629 [Cloud] End of cloud request. 2026-09-27T07:47:41.129 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:47:44.723 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:47:44.723 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:47:44.723 [Cloud] Queued cloud request. 2026-09-27T07:47:44.723 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:47:44.723 [Cloud] Dequeued cloud request. 2026-09-27T07:47:44.723 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:47:44.817 [Cloud] End of cloud request. 2026-09-27T07:47:45.317 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:50:39.520 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:50:39.520 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:50:39.520 [Cloud] Queued cloud request. 2026-09-27T07:50:39.520 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:50:39.520 [Cloud] Dequeued cloud request. 2026-09-27T07:50:39.520 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:50:39.708 [Cloud] End of cloud request. 2026-09-27T07:50:40.208 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:53:48.130 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T07:53:48.130 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T07:53:48.130 [Cloud] Queued cloud request. 2026-09-27T07:53:48.130 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T07:53:48.130 [Cloud] Dequeued cloud request. 2026-09-27T07:53:48.130 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T07:53:48.536 [Cloud] End of cloud request. 2026-09-27T07:53:49.036 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T07:57:01.101 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T08:02:44.119 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T08:02:44.119 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T08:02:44.119 [Cloud] Queued cloud request. 2026-09-27T08:02:44.119 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T08:02:44.119 [Cloud] Dequeued cloud request. 2026-09-27T08:02:44.119 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T08:02:54.213 [Cloud] End of cloud request. 2026-09-27T08:02:54.728 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T08:07:01.403 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T08:07:01.403 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T08:07:01.403 [Cloud] Queued cloud request. 2026-09-27T08:07:01.403 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T08:07:01.403 [Cloud] Dequeued cloud request. 2026-09-27T08:07:01.403 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T08:07:01.590 [Cloud] End of cloud request. 2026-09-27T08:07:02.090 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T08:07:05.950 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T08:07:05.950 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T08:07:05.950 [Cloud] Queued cloud request. 2026-09-27T08:07:05.950 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T08:07:06.121 [Cloud] Dequeued cloud request. 2026-09-27T08:07:06.121 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T08:07:06.184 [Cloud] End of cloud request. 2026-09-27T08:07:06.684 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T08:10:19.201 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T08:10:19.201 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T08:10:19.201 [Cloud] Queued cloud request. 2026-09-27T08:10:19.201 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T08:10:19.201 [Cloud] Dequeued cloud request. 2026-09-27T08:10:19.201 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T08:10:19.388 [Cloud] End of cloud request. 2026-09-27T08:10:19.888 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T08:12:06.107 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T08:13:09.341 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T08:13:09.341 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T08:13:09.341 [Cloud] Queued cloud request. 2026-09-27T08:13:09.341 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T08:13:09.341 [Cloud] Dequeued cloud request. 2026-09-27T08:13:09.341 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T08:13:09.607 [Cloud] End of cloud request. 2026-09-27T08:13:10.107 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T08:13:38.060 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T08:13:38.060 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T08:13:38.060 [Cloud] Queued cloud request. 2026-09-27T08:13:38.060 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T08:13:38.060 [Cloud] Dequeued cloud request. 2026-09-27T08:13:38.060 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T08:13:38.154 [Cloud] End of cloud request. 2026-09-27T08:13:38.670 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T08:14:28.685 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T08:14:28.685 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T08:14:28.685 [Cloud] Queued cloud request. 2026-09-27T08:14:28.685 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T08:14:28.685 [Cloud] Dequeued cloud request. 2026-09-27T08:14:28.685 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T08:14:28.763 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E592B8C4-E232-23CE-8F66-5433A4E79C41} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 08:14:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T08:14:29.279 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T08:19:31.986 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T08:19:31.986 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T08:19:31.986 [Cloud] Queued cloud request. 2026-09-27T08:19:31.986 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T08:19:31.986 [Cloud] Dequeued cloud request. 2026-09-27T08:19:31.986 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T08:19:32.127 [Cloud] End of cloud request. 2026-09-27T08:19:32.627 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T08:27:11.114 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T08:32:44.945 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T08:32:44.945 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T08:32:44.945 [Cloud] Queued cloud request. 2026-09-27T08:32:44.945 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T08:32:45.101 [Cloud] Dequeued cloud request. 2026-09-27T08:32:45.101 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T08:32:55.226 [Cloud] End of cloud request. 2026-09-27T08:32:55.726 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T08:37:54.745 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T08:37:54.745 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T08:37:54.745 [Cloud] Queued cloud request. 2026-09-27T08:37:54.745 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T08:37:54.745 [Cloud] Dequeued cloud request. 2026-09-27T08:37:54.745 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T08:37:54.917 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CB46E478-EFFA-ECA0-638C-5D4A6B75F65E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 08:37:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T08:37:55.417 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T08:39:02.448 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T08:39:02.448 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T08:39:02.448 [Cloud] Queued cloud request. 2026-09-27T08:39:02.448 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T08:39:02.448 [Cloud] Dequeued cloud request. 2026-09-27T08:39:02.448 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T08:39:02.636 [Cloud] End of cloud request. 2026-09-27T08:39:03.151 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T08:42:16.121 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T08:46:25.873 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T08:46:25.873 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T08:46:25.873 [Cloud] Queued cloud request. 2026-09-27T08:46:25.873 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T08:46:25.873 [Cloud] Dequeued cloud request. 2026-09-27T08:46:25.873 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T08:46:26.092 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7D3E245D-FA8C-4728-AB5C-D6E68BAF8B06} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 08:46:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T08:46:26.607 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T08:57:21.128 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T09:07:37.742 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:07:37.742 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:07:37.742 [Cloud] Queued cloud request. 2026-09-27T09:07:37.742 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:07:37.742 [Cloud] Dequeued cloud request. 2026-09-27T09:07:37.742 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:07:37.899 [Cloud] End of cloud request. 2026-09-27T09:07:38.399 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:08:26.524 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:08:26.524 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:08:26.524 [Cloud] Queued cloud request. 2026-09-27T09:08:26.524 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:08:26.524 [Cloud] Dequeued cloud request. 2026-09-27T09:08:26.524 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:08:26.618 [Cloud] End of cloud request. 2026-09-27T09:08:27.118 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:10:42.181 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:10:42.181 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:10:42.181 [Cloud] Queued cloud request. 2026-09-27T09:10:42.181 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:10:42.181 [Cloud] Dequeued cloud request. 2026-09-27T09:10:42.181 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:10:42.338 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BAC8DE63-2389-70B0-AB49-6D7ABE1E6B3A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 09:10:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T09:10:42.838 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:11:06.494 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:11:06.494 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:11:06.494 [Cloud] Queued cloud request. 2026-09-27T09:11:06.494 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:11:06.494 [Cloud] Dequeued cloud request. 2026-09-27T09:11:06.494 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:11:06.635 [Cloud] End of cloud request. 2026-09-27T09:11:07.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:11:27.979 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:11:27.979 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:11:27.979 [Cloud] Queued cloud request. 2026-09-27T09:11:27.979 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:11:27.979 [Cloud] Dequeued cloud request. 2026-09-27T09:11:27.979 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:11:28.104 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8DEC6790-DE75-DB22-50FD-6AA789DA5BF3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 09:11:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T09:11:28.604 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:11:46.572 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:11:46.572 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:11:46.572 [Cloud] Queued cloud request. 2026-09-27T09:11:46.572 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:11:46.572 [Cloud] Dequeued cloud request. 2026-09-27T09:11:46.572 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:11:56.588 [Cloud] End of cloud request. 2026-09-27T09:11:57.104 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:12:26.135 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T09:13:37.838 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:13:37.838 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:13:37.838 [Cloud] Queued cloud request. 2026-09-27T09:13:37.838 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:13:37.838 [Cloud] Dequeued cloud request. 2026-09-27T09:13:37.838 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:13:47.932 [Cloud] End of cloud request. 2026-09-27T09:13:48.447 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:15:01.885 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:15:01.885 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:15:01.885 [Cloud] Queued cloud request. 2026-09-27T09:15:01.885 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:15:01.885 [Cloud] Dequeued cloud request. 2026-09-27T09:15:01.885 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:15:11.963 [Cloud] End of cloud request. 2026-09-27T09:15:12.463 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:19:25.248 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:19:25.248 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:19:25.248 [Cloud] Queued cloud request. 2026-09-27T09:19:25.248 [Cloud] Dequeued cloud request. 2026-09-27T09:19:25.248 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:19:25.248 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:19:25.685 [Cloud] End of cloud request. 2026-09-27T09:19:26.201 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:20:47.154 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:20:47.154 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:20:47.154 [Cloud] Queued cloud request. 2026-09-27T09:20:47.154 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:20:47.154 [Cloud] Dequeued cloud request. 2026-09-27T09:20:47.154 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:20:47.294 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{884524E3-5845-108C-37FC-7E17C0F5E9DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 09:20:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T09:20:47.794 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:27:17.001 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:27:17.001 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:27:17.001 [Cloud] Queued cloud request. 2026-09-27T09:27:17.001 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:27:17.001 [Cloud] Dequeued cloud request. 2026-09-27T09:27:17.001 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:27:17.142 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0FC8AAE8-DB7E-81AA-1D94-DBB375CC3D81} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 09:27:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T09:27:17.642 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:27:31.142 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T09:28:07.768 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:28:07.768 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:28:07.768 [Cloud] Queued cloud request. 2026-09-27T09:28:07.768 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:28:07.768 [Cloud] Dequeued cloud request. 2026-09-27T09:28:07.768 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:28:07.846 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D182E0E1-CAF8-1265-2861-C3E7703F6346} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 09:28:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T09:28:08.362 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:31:28.815 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:31:28.815 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:31:28.815 [Cloud] Queued cloud request. 2026-09-27T09:31:28.815 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:31:28.815 [Cloud] Dequeued cloud request. 2026-09-27T09:31:28.815 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:31:28.971 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4E4C9913-A67A-F7A5-FA3B-82744DFEA2BC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 09:31:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T09:31:29.471 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:37:39.725 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:37:39.725 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:37:39.725 [Cloud] Queued cloud request. 2026-09-27T09:37:39.725 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:37:39.725 [Cloud] Dequeued cloud request. 2026-09-27T09:37:39.725 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:37:39.866 [Cloud] End of cloud request. 2026-09-27T09:37:40.381 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:39:41.694 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 33916, Count: 2403, MaxTime: 468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-27T09:39:41.694 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 12317, Count: 1149, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-27T09:39:41.694 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 3214, Count: 293, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T09:39:41.694 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-27T09:39:41.694 ProcessImageName: AgentShellService.exe, Pid: 7376, TotalTime: 806, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 56% 2026-09-27T09:39:41.694 ProcessImageName: WmiPrvSE.exe, Pid: 6452, TotalTime: 615, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-27T09:39:41.694 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 454, Count: 31, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-27T09:39:41.694 ProcessImageName: powershell.exe, Pid: 7460, TotalTime: 263, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-27T09:39:41.694 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-27T09:39:41.694 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T09:39:41.694 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 120, Count: 11, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-27T09:39:41.694 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-27T09:39:41.694 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 66, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2.MAI, EstimatedImpact: 0% 2026-09-27T09:39:41.694 ProcessImageName: python.exe, Pid: 6424, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 2% 2026-09-27T09:39:41.694 ProcessImageName: python.exe, Pid: 5824, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\cffi-1.16.0.dist-info\entry_points.txt, EstimatedImpact: 2% 2026-09-27T09:39:41.694 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-27T09:39:41.694 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-27T09:39:41.694 ProcessImageName: mysqldump.exe, Pid: 4864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-27T09:39:41.694 ProcessImageName: ngentask.exe, Pid: 7412, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 27% 2026-09-27T09:39:41.694 ProcessImageName: powershell.exe, Pid: 4876, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-27T09:39:41.694 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-27T09:39:41.694 ProcessImageName: cmd.exe, Pid: 1532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-27T09:39:41.694 ProcessImageName: DeviceCensus.exe, Pid: 7992, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\WaaSAssessmentSettings.json, EstimatedImpact: 1% 2026-09-27T09:42:36.149 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T09:43:21.368 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T09:43:21.368 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T09:43:21.368 [Cloud] Queued cloud request. 2026-09-27T09:43:21.368 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T09:43:21.368 [Cloud] Dequeued cloud request. 2026-09-27T09:43:21.368 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T09:43:21.806 [Cloud] End of cloud request. 2026-09-27T09:43:22.306 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T09:57:41.157 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T10:01:40.626 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T10:01:40.626 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T10:01:40.626 [Cloud] Queued cloud request. 2026-09-27T10:01:40.626 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T10:01:40.626 [Cloud] Dequeued cloud request. 2026-09-27T10:01:40.626 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T10:01:40.813 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A4411710-9294-D8DD-E391-E08D712345BC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 10:01:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T10:01:41.329 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T10:11:31.210 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T10:11:31.210 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T10:11:31.210 [Cloud] Queued cloud request. 2026-09-27T10:11:31.210 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T10:11:31.210 [Cloud] Dequeued cloud request. 2026-09-27T10:11:31.210 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T10:11:31.382 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0EB475F2-3FA9-E8FC-77F1-5276B3AD30F9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 10:11:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T10:11:31.882 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{DC1F2845-929D-AFAC-C962-34D3DD8B9161} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-27-2026 10:12:24 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T10:12:25.992 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T10:12:25.992 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T10:12:25.992 [Cloud] Queued cloud request. 2026-09-27T10:12:25.992 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T10:12:25.992 [Cloud] Dequeued cloud request. 2026-09-27T10:12:26.007 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T10:12:26.273 [Cloud] End of cloud request. 2026-09-27T10:12:26.773 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T10:12:46.164 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T10:27:51.171 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T10:34:19.766 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T10:34:19.766 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T10:34:19.766 [Cloud] Queued cloud request. 2026-09-27T10:34:19.766 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T10:34:19.766 [Cloud] Dequeued cloud request. 2026-09-27T10:34:19.766 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T10:34:19.954 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B7CF5647-1990-0FFA-BF91-C7416B6D9CDD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 10:34:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T10:34:20.454 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T10:42:56.178 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T10:58:01.186 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T11:02:27.967 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T11:02:27.967 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T11:02:27.967 [Cloud] Queued cloud request. 2026-09-27T11:02:27.967 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T11:02:27.967 [Cloud] Dequeued cloud request. 2026-09-27T11:02:27.967 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T11:02:28.124 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{57703058-284C-A635-43CD-F4FB03D837D1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 11:02:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T11:02:28.624 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T11:11:59.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T11:11:59.097 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T11:11:59.097 [Cloud] Queued cloud request. 2026-09-27T11:11:59.097 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T11:11:59.097 [Cloud] Dequeued cloud request. 2026-09-27T11:11:59.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T11:11:59.238 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F7360FE1-D563-5F8D-BBDB-392CD786AF2A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 11:11:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T11:11:59.754 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T11:13:00.222 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T11:13:00.222 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T11:13:00.222 [Cloud] Queued cloud request. 2026-09-27T11:13:00.222 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T11:13:00.222 [Cloud] Dequeued cloud request. 2026-09-27T11:13:00.222 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T11:13:00.832 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{64A541A9-A70C-CFC0-2992-63D6F1DC6CF9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 11:13:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T11:13:01.332 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T11:13:06.191 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T11:20:41.587 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T11:20:41.587 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T11:20:41.587 [Cloud] Queued cloud request. 2026-09-27T11:20:41.587 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T11:20:41.587 [Cloud] Dequeued cloud request. 2026-09-27T11:20:41.587 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T11:20:41.727 [Cloud] End of cloud request. 2026-09-27T11:20:42.227 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T11:28:11.201 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T11:34:46.688 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T11:34:46.688 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T11:34:46.688 [Cloud] Queued cloud request. 2026-09-27T11:34:46.688 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T11:34:46.844 [Cloud] Dequeued cloud request. 2026-09-27T11:34:47.032 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T11:34:47.219 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{16BA8954-DEEA-6206-8633-85636FE4A68D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 11:34:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T11:34:47.735 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T11:39:41.769 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 34470, Count: 2429, MaxTime: 468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-27T11:39:41.769 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 14357, Count: 1348, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-27T11:39:41.769 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 3214, Count: 293, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T11:39:41.769 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-27T11:39:41.769 ProcessImageName: AgentShellService.exe, Pid: 7376, TotalTime: 806, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 56% 2026-09-27T11:39:41.769 ProcessImageName: WmiPrvSE.exe, Pid: 6452, TotalTime: 615, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-27T11:39:41.769 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 529, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-27T11:39:41.769 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 391, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 39% 2026-09-27T11:39:41.769 ProcessImageName: powershell.exe, Pid: 7460, TotalTime: 263, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-27T11:39:41.769 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-27T11:39:41.769 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T11:39:41.769 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 150, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-27T11:39:41.769 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-27T11:39:41.769 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 66, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2.MAI, EstimatedImpact: 0% 2026-09-27T11:39:41.769 ProcessImageName: python.exe, Pid: 5824, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\cffi-1.16.0.dist-info\entry_points.txt, EstimatedImpact: 2% 2026-09-27T11:39:41.769 ProcessImageName: python.exe, Pid: 6424, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 2% 2026-09-27T11:39:41.769 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-27T11:39:41.769 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-27T11:39:41.769 ProcessImageName: mysqldump.exe, Pid: 4864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-27T11:39:41.769 ProcessImageName: powershell.exe, Pid: 4876, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-27T11:39:41.769 ProcessImageName: ngentask.exe, Pid: 7412, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 27% 2026-09-27T11:39:41.769 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-27T11:39:41.769 ProcessImageName: cmd.exe, Pid: 1532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-27T11:39:41.769 ProcessImageName: DeviceCensus.exe, Pid: 7992, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\WaaSAssessmentSettings.json, EstimatedImpact: 1% 2026-09-27T11:43:16.208 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T11:44:00.208 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T11:44:00.208 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T11:44:00.208 [Cloud] Queued cloud request. 2026-09-27T11:44:00.208 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T11:44:00.208 [Cloud] Dequeued cloud request. 2026-09-27T11:44:00.208 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T11:44:00.395 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D462279F-33B8-2A14-A0B0-92E80BEBEC52} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 11:44:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T11:44:00.895 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T11:48:10.180 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T11:48:10.180 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T11:48:10.180 [Cloud] Queued cloud request. 2026-09-27T11:48:10.180 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T11:48:10.180 [Cloud] Dequeued cloud request. 2026-09-27T11:48:10.180 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T11:48:10.336 [Cloud] End of cloud request. 2026-09-27T11:48:10.851 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T11:55:06.276 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T11:55:06.276 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T11:55:06.276 [Cloud] Queued cloud request. 2026-09-27T11:55:06.276 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T11:55:06.276 [Cloud] Dequeued cloud request. 2026-09-27T11:55:06.276 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T11:55:16.354 [Cloud] End of cloud request. 2026-09-27T11:55:16.870 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T11:58:21.216 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T12:02:41.309 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:02:41.309 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:02:41.309 [Cloud] Queued cloud request. 2026-09-27T12:02:41.309 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:02:41.309 [Cloud] Dequeued cloud request. 2026-09-27T12:02:41.309 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:02:41.481 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0D0BB8D1-BF58-9A29-685E-336561E1A710} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 12:02:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T12:02:41.981 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:13:26.221 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T12:19:07.772 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:19:07.772 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:19:07.772 [Cloud] Queued cloud request. 2026-09-27T12:19:07.772 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:19:07.772 [Cloud] Dequeued cloud request. 2026-09-27T12:19:07.772 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:19:07.960 [Cloud] End of cloud request. 2026-09-27T12:19:08.460 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:21:36.475 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:21:36.475 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:21:36.475 [Cloud] Queued cloud request. 2026-09-27T12:21:36.475 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:21:36.475 [Cloud] Dequeued cloud request. 2026-09-27T12:21:36.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:21:36.647 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7DF13F22-81E6-6F48-AC31-B2EC84B7C1E4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 12:21:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T12:21:37.147 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:22:08.131 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:22:08.131 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:22:08.131 [Cloud] Queued cloud request. 2026-09-27T12:22:08.131 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:22:08.131 [Cloud] Dequeued cloud request. 2026-09-27T12:22:08.131 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:22:08.210 [Cloud] End of cloud request. 2026-09-27T12:22:08.710 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:22:10.803 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:22:10.803 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:22:10.803 [Cloud] Queued cloud request. 2026-09-27T12:22:10.803 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:22:10.803 [Cloud] Dequeued cloud request. 2026-09-27T12:22:10.819 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:22:11.085 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4EB0AC30-1E32-0C00-D511-6EF5AA09A548} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 12:22:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T12:22:11.600 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:24:15.930 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:24:15.930 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:24:15.930 [Cloud] Queued cloud request. 2026-09-27T12:24:15.930 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:24:16.118 [Cloud] Dequeued cloud request. 2026-09-27T12:24:16.118 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:24:16.290 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4F2DEB53-4EE8-8077-89A7-646C71290EE4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 12:24:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T12:24:16.790 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:26:55.839 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:26:55.839 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:26:55.839 [Cloud] Queued cloud request. 2026-09-27T12:26:55.839 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:26:55.839 [Cloud] Dequeued cloud request. 2026-09-27T12:26:55.839 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:26:56.026 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{271242D5-9180-9966-43C2-CF69BBBE4F10} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 12:26:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T12:26:56.526 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:28:31.230 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T12:31:47.824 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:31:47.824 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:31:47.824 [Cloud] Queued cloud request. 2026-09-27T12:31:47.824 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:31:48.011 [Cloud] Dequeued cloud request. 2026-09-27T12:31:48.011 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:31:53.621 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:31:53.621 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:31:53.621 [Cloud] Queued cloud request. 2026-09-27T12:31:53.621 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:31:53.621 [Cloud] Dequeued cloud request. 2026-09-27T12:31:53.621 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:31:53.793 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{921A05E1-0240-0AEC-6B87-11745CC074DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 12:31:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T12:31:54.293 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:31:58.136 [Cloud] End of cloud request. 2026-09-27T12:31:58.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:36:15.218 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:36:15.218 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:36:15.218 [Cloud] Queued cloud request. 2026-09-27T12:36:15.218 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:36:15.405 [Cloud] Dequeued cloud request. 2026-09-27T12:36:15.405 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:36:15.577 [Cloud] End of cloud request. 2026-09-27T12:36:16.093 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:37:09.062 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:37:09.062 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:37:09.062 [Cloud] Queued cloud request. 2026-09-27T12:37:09.062 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:37:09.062 [Cloud] Dequeued cloud request. 2026-09-27T12:37:09.062 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:37:09.140 [Cloud] End of cloud request. 2026-09-27T12:37:09.655 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:43:36.237 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T12:48:11.318 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:48:11.318 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:48:11.318 [Cloud] Queued cloud request. 2026-09-27T12:48:11.318 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:48:11.318 [Cloud] Dequeued cloud request. 2026-09-27T12:48:11.318 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:48:11.505 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{28C64D7D-17AD-0289-2D04-055B2E341FDA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 12:48:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T12:48:12.005 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:51:29.678 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T12:51:29.678 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T12:51:29.678 [Cloud] Queued cloud request. 2026-09-27T12:51:29.678 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T12:51:29.678 [Cloud] Dequeued cloud request. 2026-09-27T12:51:29.678 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T12:51:29.850 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D3F3BE6E-5597-FB4E-0D7E-1880CA83A234} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 12:51:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T12:51:30.365 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T12:58:41.245 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T13:02:49.276 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T13:02:49.276 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T13:02:49.276 [Cloud] Queued cloud request. 2026-09-27T13:02:49.276 [Cloud] Dequeued cloud request. 2026-09-27T13:02:49.276 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T13:02:49.276 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T13:02:49.479 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{48E4B270-485C-A382-C2B6-AAE41CE22D7C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 13:02:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T13:02:49.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T13:07:07.545 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T13:07:07.545 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T13:07:07.545 [Cloud] Queued cloud request. 2026-09-27T13:07:07.545 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T13:07:07.545 [Cloud] Dequeued cloud request. 2026-09-27T13:07:07.545 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T13:07:07.717 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F4AE57C6-C629-B3AA-C243-2F8FA333FD98} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 13:07:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T13:07:08.233 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T13:13:46.252 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T13:26:56.490 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T13:26:56.490 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T13:26:56.490 [Cloud] Queued cloud request. 2026-09-27T13:26:56.490 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T13:26:56.490 [Cloud] Dequeued cloud request. 2026-09-27T13:26:56.490 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T13:26:56.646 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B6C1F86F-F049-8A2D-F9EE-5F014A80BF70} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 13:26:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T13:26:57.162 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T13:28:51.260 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T13:30:13.057 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T13:30:13.057 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T13:30:13.057 [Cloud] Queued cloud request. 2026-09-27T13:30:13.057 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T13:30:13.057 [Cloud] Dequeued cloud request. 2026-09-27T13:30:13.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T13:30:13.197 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{95C7B16F-9926-2923-62E2-C26DE7A9DEB3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 13:30:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T13:30:13.697 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T13:39:41.827 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 34638, Count: 2441, MaxTime: 468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-27T13:39:41.827 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 16553, Count: 1546, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-27T13:39:41.827 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 3214, Count: 293, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T13:39:41.827 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-27T13:39:41.827 ProcessImageName: AgentShellService.exe, Pid: 7376, TotalTime: 806, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 56% 2026-09-27T13:39:41.827 ProcessImageName: WmiPrvSE.exe, Pid: 6452, TotalTime: 615, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-27T13:39:41.827 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 559, Count: 40, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-27T13:39:41.827 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 391, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 39% 2026-09-27T13:39:41.827 ProcessImageName: powershell.exe, Pid: 7460, TotalTime: 263, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-27T13:39:41.827 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-27T13:39:41.827 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T13:39:41.827 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 165, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-27T13:39:41.827 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-27T13:39:41.827 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2.MAI, EstimatedImpact: 0% 2026-09-27T13:39:41.827 ProcessImageName: python.exe, Pid: 6424, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 2% 2026-09-27T13:39:41.827 ProcessImageName: python.exe, Pid: 5824, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\cffi-1.16.0.dist-info\entry_points.txt, EstimatedImpact: 2% 2026-09-27T13:39:41.827 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-27T13:39:41.827 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-27T13:39:41.827 ProcessImageName: mysqldump.exe, Pid: 4864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-27T13:39:41.827 ProcessImageName: ngentask.exe, Pid: 7412, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 27% 2026-09-27T13:39:41.827 ProcessImageName: powershell.exe, Pid: 4876, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-27T13:39:41.827 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-27T13:39:41.827 ProcessImageName: cmd.exe, Pid: 1532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-27T13:39:41.827 ProcessImageName: DeviceCensus.exe, Pid: 7992, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\WaaSAssessmentSettings.json, EstimatedImpact: 1% 2026-09-27T13:43:56.265 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T13:59:01.274 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T14:01:58.368 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T14:01:58.368 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T14:01:58.368 [Cloud] Queued cloud request. 2026-09-27T14:01:58.368 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T14:01:58.368 [Cloud] Dequeued cloud request. 2026-09-27T14:01:58.368 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T14:01:58.555 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C8A3F838-5BED-CEBD-1374-25712900CD1B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 14:01:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T14:01:59.071 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T14:02:58.914 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T14:02:58.914 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T14:02:58.914 [Cloud] Queued cloud request. 2026-09-27T14:02:58.914 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T14:02:58.914 [Cloud] Dequeued cloud request. 2026-09-27T14:02:58.914 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T14:02:59.133 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6C53BAB6-CAEB-68EB-935F-39BBF34372C4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 14:02:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T14:02:59.649 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T14:14:06.280 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T14:29:11.289 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T14:31:34.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T14:31:34.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T14:31:34.304 [Cloud] Queued cloud request. 2026-09-27T14:31:34.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T14:31:34.304 [Cloud] Dequeued cloud request. 2026-09-27T14:31:34.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T14:31:34.492 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{485543C8-C626-DC37-8E18-981A6CE359DF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 14:31:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T14:31:34.992 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T14:37:00.605 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T14:37:00.605 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T14:37:00.605 [Cloud] Queued cloud request. 2026-09-27T14:37:00.605 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T14:37:00.605 [Cloud] Dequeued cloud request. 2026-09-27T14:37:00.605 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T14:37:00.792 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DD56A7F9-19FB-17C4-E06E-673C7BC9C66A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 14:37:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T14:37:01.308 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T14:39:04.387 [RTP] [Mini-filter] Copy hint telemetry notification (\Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\AgentShell.exe) sent successfully. 2026-09-27T14:43:26.684 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T14:43:26.684 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T14:43:26.684 [Cloud] Queued cloud request. 2026-09-27T14:43:26.684 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T14:43:26.684 [Cloud] Dequeued cloud request. 2026-09-27T14:43:26.684 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T14:43:26.871 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6A453B6F-8283-662A-F3E9-E366CFA349FC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 14:43:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T14:43:27.372 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T14:44:16.296 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T14:56:36.677 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T14:56:36.677 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T14:56:36.677 [Cloud] Queued cloud request. 2026-09-27T14:56:36.677 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T14:56:36.677 [Cloud] Dequeued cloud request. 2026-09-27T14:56:36.677 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T14:56:36.880 [Cloud] End of cloud request. 2026-09-27T14:56:37.380 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T14:59:21.303 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T15:03:33.303 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T15:03:33.303 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T15:03:33.303 [Cloud] Queued cloud request. 2026-09-27T15:03:33.303 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T15:03:33.303 [Cloud] Dequeued cloud request. 2026-09-27T15:03:33.303 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T15:03:33.506 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C709A0FF-3544-C73D-184C-A9F6B2EE8076} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 15:03:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T15:03:34.006 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T15:14:09.279 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T15:14:09.279 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T15:14:09.279 [Cloud] Queued cloud request. 2026-09-27T15:14:09.279 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T15:14:09.279 [Cloud] Dequeued cloud request. 2026-09-27T15:14:09.279 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T15:14:09.513 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4B633A2C-3CCF-C9C2-C653-C23C6CD41CF6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 15:14:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T15:14:10.029 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T15:14:26.326 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T15:14:41.983 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T15:14:41.983 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T15:14:41.983 [Cloud] Queued cloud request. 2026-09-27T15:14:41.983 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T15:14:41.983 [Cloud] Dequeued cloud request. 2026-09-27T15:14:41.983 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T15:14:42.077 [Cloud] End of cloud request. 2026-09-27T15:14:42.577 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T15:15:05.952 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T15:15:05.952 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T15:15:05.952 [Cloud] Queued cloud request. 2026-09-27T15:15:05.952 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T15:15:05.952 [Cloud] Dequeued cloud request. 2026-09-27T15:15:05.952 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T15:15:06.046 [Cloud] End of cloud request. 2026-09-27T15:15:06.561 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T15:16:46.031 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T15:16:46.031 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T15:16:46.031 [Cloud] Queued cloud request. 2026-09-27T15:16:46.031 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T15:16:46.031 [Cloud] Dequeued cloud request. 2026-09-27T15:16:46.031 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T15:16:46.202 [Cloud] End of cloud request. 2026-09-27T15:16:46.718 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T15:22:40.376 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T15:22:40.376 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T15:22:40.376 [Cloud] Queued cloud request. 2026-09-27T15:22:40.376 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T15:22:40.376 [Cloud] Dequeued cloud request. 2026-09-27T15:22:40.376 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T15:22:40.547 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D53514B6-7653-FCDD-CF9A-F97F0110EBB6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 15:22:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T15:22:41.063 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T15:23:44.425 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T15:23:44.425 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T15:23:44.425 [Cloud] Queued cloud request. 2026-09-27T15:23:44.425 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T15:23:44.425 [Cloud] Dequeued cloud request. 2026-09-27T15:23:44.425 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T15:23:44.596 [Cloud] End of cloud request. 2026-09-27T15:23:45.112 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T15:27:18.816 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T15:27:18.816 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T15:27:18.816 [Cloud] Queued cloud request. 2026-09-27T15:27:18.816 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T15:27:18.816 [Cloud] Dequeued cloud request. 2026-09-27T15:27:18.816 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T15:27:18.972 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3B23B3C4-7512-8813-CBEB-ADD7002F12E8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 15:27:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T15:27:19.488 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T15:29:31.318 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T15:34:34.600 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T15:34:34.600 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T15:34:34.600 [Cloud] Queued cloud request. 2026-09-27T15:34:34.600 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T15:34:34.600 [Cloud] Dequeued cloud request. 2026-09-27T15:34:34.600 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T15:34:34.741 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3E140926-1D1A-ADFB-95E7-29E73A71B3AF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 15:34:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T15:34:35.241 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T15:39:41.901 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 36478, Count: 2572, MaxTime: 468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-27T15:39:41.901 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 18753, Count: 1743, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-27T15:39:41.901 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 3214, Count: 293, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T15:39:41.901 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-27T15:39:41.901 ProcessImageName: AgentShellService.exe, Pid: 7376, TotalTime: 806, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 56% 2026-09-27T15:39:41.901 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 664, Count: 48, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-27T15:39:41.901 ProcessImageName: WmiPrvSE.exe, Pid: 6452, TotalTime: 615, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-27T15:39:41.901 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 391, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 39% 2026-09-27T15:39:41.901 ProcessImageName: powershell.exe, Pid: 7460, TotalTime: 263, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-27T15:39:41.901 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-27T15:39:41.901 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T15:39:41.901 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-27T15:39:41.901 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-27T15:39:41.901 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2.MAI, EstimatedImpact: 0% 2026-09-27T15:39:41.901 ProcessImageName: python.exe, Pid: 6424, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 2% 2026-09-27T15:39:41.901 ProcessImageName: python.exe, Pid: 5824, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\cffi-1.16.0.dist-info\entry_points.txt, EstimatedImpact: 2% 2026-09-27T15:39:41.901 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-27T15:39:41.901 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-27T15:39:41.901 ProcessImageName: mysqldump.exe, Pid: 4864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-27T15:39:41.901 ProcessImageName: ngentask.exe, Pid: 7412, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 27% 2026-09-27T15:39:41.901 ProcessImageName: powershell.exe, Pid: 4876, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-27T15:39:41.901 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-27T15:39:41.901 ProcessImageName: cmd.exe, Pid: 1532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-27T15:39:41.901 ProcessImageName: DeviceCensus.exe, Pid: 7992, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\WaaSAssessmentSettings.json, EstimatedImpact: 1% 2026-09-27T15:39:58.479 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T15:39:58.479 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T15:39:58.479 [Cloud] Queued cloud request. 2026-09-27T15:39:58.479 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T15:39:58.479 [Cloud] Dequeued cloud request. 2026-09-27T15:39:58.479 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T15:39:58.620 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DE49F51C-4453-AADE-4525-B2FAFAB5C458} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 15:39:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T15:39:59.120 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T15:44:36.324 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T15:49:05.187 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T15:49:05.187 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T15:49:05.187 [Cloud] Queued cloud request. 2026-09-27T15:49:05.187 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T15:49:05.187 [Cloud] Dequeued cloud request. 2026-09-27T15:49:05.187 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T15:49:05.328 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{37A461E2-1807-A2C0-335D-34FF0EA674CA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 15:49:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T15:49:05.828 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T15:59:41.332 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T16:04:12.084 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T16:04:12.084 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T16:04:12.084 [Cloud] Queued cloud request. 2026-09-27T16:04:12.084 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T16:04:12.084 [Cloud] Dequeued cloud request. 2026-09-27T16:04:12.084 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T16:04:12.241 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AEB3B320-D49B-CB5E-781C-2A82CB46C009} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 16:04:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T16:04:12.741 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T16:08:20.587 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T16:08:20.587 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T16:08:20.587 [Cloud] Queued cloud request. 2026-09-27T16:08:20.587 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T16:08:20.587 [Cloud] Dequeued cloud request. 2026-09-27T16:08:20.587 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T16:08:20.744 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E67E9579-E2C0-E89D-560A-E46552FB5137} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 16:08:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T16:08:21.259 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T16:14:46.338 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T16:29:51.347 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T16:34:50.927 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T16:34:50.927 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T16:34:50.927 [Cloud] Queued cloud request. 2026-09-27T16:34:50.927 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T16:34:50.927 [Cloud] Dequeued cloud request. 2026-09-27T16:34:50.927 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T16:34:51.083 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{155090F5-E54B-F62C-8DD7-AA953ABC0D1E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 16:34:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T16:34:51.599 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T16:36:35.522 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T16:36:35.522 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T16:36:35.522 [Cloud] Queued cloud request. 2026-09-27T16:36:35.522 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T16:36:35.522 [Cloud] Dequeued cloud request. 2026-09-27T16:36:35.522 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T16:36:35.679 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{95ED9D70-CDCB-A762-D938-33801B10EDCE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 16:36:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T16:36:36.179 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T16:44:56.355 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T16:52:19.780 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T16:52:19.780 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T16:52:19.780 [Cloud] Queued cloud request. 2026-09-27T16:52:19.780 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T16:52:19.780 [Cloud] Dequeued cloud request. 2026-09-27T16:52:19.780 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T16:52:19.968 [Cloud] End of cloud request. 2026-09-27T16:52:20.483 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T16:57:33.783 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T16:57:33.783 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T16:57:33.783 [Cloud] Queued cloud request. 2026-09-27T16:57:33.783 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T16:57:33.783 [Cloud] Dequeued cloud request. 2026-09-27T16:57:33.783 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T16:57:33.955 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{124E9EBD-FE6B-8EA4-2EE5-365DFB01B084} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 16:57:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T16:57:34.470 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T17:00:01.362 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T17:01:31.456 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T17:01:31.456 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T17:01:31.456 [Cloud] Queued cloud request. 2026-09-27T17:01:31.456 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T17:01:31.456 [Cloud] Dequeued cloud request. 2026-09-27T17:01:31.456 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T17:01:31.643 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AB1CE1B5-D5AB-DBAE-9A3F-0F999E55CCD9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 17:01:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T17:01:32.143 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T17:10:21.149 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T17:10:21.149 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T17:10:21.149 [Cloud] Queued cloud request. 2026-09-27T17:10:21.149 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T17:10:21.149 [Cloud] Dequeued cloud request. 2026-09-27T17:10:21.149 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T17:10:21.305 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{99223F84-EABB-B36E-6BDE-5782AC87B06B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 17:10:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T17:10:21.805 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T17:12:12.806 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T17:12:12.806 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T17:12:12.806 [Cloud] Queued cloud request. 2026-09-27T17:12:12.806 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T17:12:12.806 [Cloud] Dequeued cloud request. 2026-09-27T17:12:12.806 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T17:12:12.946 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F818F90D-FFE6-C852-FFFA-56172DA2072C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 17:12:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T17:12:13.446 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T17:13:06.618 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T17:13:06.618 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T17:13:06.618 [Cloud] Queued cloud request. 2026-09-27T17:13:06.618 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T17:13:06.618 [Cloud] Dequeued cloud request. 2026-09-27T17:13:06.618 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T17:13:06.712 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4E52F5A5-4B96-E5AC-5EB3-D8B86A861392} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 17:13:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T17:13:07.212 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T17:14:35.665 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T17:14:35.665 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T17:14:35.665 [Cloud] Queued cloud request. 2026-09-27T17:14:35.665 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T17:14:35.665 [Cloud] Dequeued cloud request. 2026-09-27T17:14:35.665 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T17:14:35.806 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{10AE0D8A-D6E9-675F-043F-DCE240F2588F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 17:14:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T17:14:36.321 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T17:15:06.368 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T17:29:20.252 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T17:29:20.252 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T17:29:20.252 [Cloud] Queued cloud request. 2026-09-27T17:29:20.252 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T17:29:20.252 [Cloud] Dequeued cloud request. 2026-09-27T17:29:20.252 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T17:29:20.423 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{302ECE38-4FE3-15EF-39D1-0666BBD2D489} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 17:29:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T17:29:20.939 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T17:30:11.377 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T17:37:03.208 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T17:37:03.208 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T17:37:03.208 [Cloud] Queued cloud request. 2026-09-27T17:37:03.208 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T17:37:03.208 [Cloud] Dequeued cloud request. 2026-09-27T17:37:03.208 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T17:37:03.364 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DCDE324D-620D-6EE0-628B-A58E3AFA54ED} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 17:37:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T17:37:03.864 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T17:39:41.975 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 36599, Count: 2579, MaxTime: 468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-27T17:39:41.975 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 20843, Count: 1941, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-27T17:39:41.975 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 3214, Count: 293, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T17:39:41.975 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-27T17:39:41.975 ProcessImageName: AgentShellService.exe, Pid: 7376, TotalTime: 806, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 56% 2026-09-27T17:39:41.975 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 724, Count: 52, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-27T17:39:41.975 ProcessImageName: WmiPrvSE.exe, Pid: 6452, TotalTime: 615, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-27T17:39:41.975 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 391, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 39% 2026-09-27T17:39:41.975 ProcessImageName: powershell.exe, Pid: 7460, TotalTime: 263, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-27T17:39:41.975 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-27T17:39:41.975 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T17:39:41.975 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 195, Count: 16, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-27T17:39:41.975 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-27T17:39:41.975 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 70, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2.MAI, EstimatedImpact: 0% 2026-09-27T17:39:41.975 ProcessImageName: python.exe, Pid: 6424, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 2% 2026-09-27T17:39:41.975 ProcessImageName: python.exe, Pid: 5824, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\cffi-1.16.0.dist-info\entry_points.txt, EstimatedImpact: 2% 2026-09-27T17:39:41.975 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-27T17:39:41.975 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-27T17:39:41.975 ProcessImageName: mysqldump.exe, Pid: 4864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-27T17:39:41.975 ProcessImageName: ngentask.exe, Pid: 7412, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 27% 2026-09-27T17:39:41.975 ProcessImageName: powershell.exe, Pid: 4876, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-27T17:39:41.975 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-27T17:39:41.975 ProcessImageName: cmd.exe, Pid: 1532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-27T17:39:41.975 ProcessImageName: DeviceCensus.exe, Pid: 7992, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\WaaSAssessmentSettings.json, EstimatedImpact: 1% 2026-09-27T17:43:13.757 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T17:43:13.757 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T17:43:13.757 [Cloud] Queued cloud request. 2026-09-27T17:43:13.757 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T17:43:13.757 [Cloud] Dequeued cloud request. 2026-09-27T17:43:13.757 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T17:43:13.945 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A50931E3-8227-41AB-6EDC-18FE507941C5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 17:43:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T17:43:14.461 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T17:45:16.383 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T17:56:10.718 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T17:56:10.718 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T17:56:10.718 [Cloud] Queued cloud request. 2026-09-27T17:56:10.718 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T17:56:10.718 [Cloud] Dequeued cloud request. 2026-09-27T17:56:10.718 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T17:56:10.905 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AC1F1BA1-6827-28B4-1BC4-C67E64A0C184} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 17:56:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T17:56:11.421 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T17:59:50.844 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T17:59:50.844 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T17:59:50.844 [Cloud] Queued cloud request. 2026-09-27T17:59:50.844 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T17:59:50.844 [Cloud] Dequeued cloud request. 2026-09-27T17:59:50.844 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T17:59:51.032 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9C886FD8-7982-32B0-FF5B-04D8668821CA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 17:59:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T17:59:51.532 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T18:00:21.391 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T18:04:53.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T18:04:53.097 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T18:04:53.097 [Cloud] Queued cloud request. 2026-09-27T18:04:53.097 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T18:04:53.097 [Cloud] Dequeued cloud request. 2026-09-27T18:04:53.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T18:04:53.269 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3ED997E1-464A-1E2C-DE3A-EB35A958C83A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 18:04:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T18:04:53.769 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T18:09:06.536 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T18:09:06.536 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T18:09:06.536 [Cloud] Queued cloud request. 2026-09-27T18:09:06.536 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T18:09:06.536 [Cloud] Dequeued cloud request. 2026-09-27T18:09:06.536 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T18:09:06.724 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B9013A40-1F1B-C894-069F-6C7DCA5B10E1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 18:09:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T18:09:07.240 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T18:15:26.398 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T18:26:03.294 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T18:26:03.294 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T18:26:03.294 [Cloud] Queued cloud request. 2026-09-27T18:26:03.294 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T18:26:03.294 [Cloud] Dequeued cloud request. 2026-09-27T18:26:03.294 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T18:26:03.512 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9E74063D-4D56-5A3F-4C48-F3230A00B530} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 18:26:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T18:26:04.028 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T18:28:11.249 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T18:28:11.249 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T18:28:11.249 [Cloud] Queued cloud request. 2026-09-27T18:28:11.249 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T18:28:11.249 [Cloud] Dequeued cloud request. 2026-09-27T18:28:11.249 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T18:28:11.437 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CB70D6A5-5DFB-61BB-5891-AE4BC2A7FC9E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 18:28:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T18:28:11.937 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T18:29:42.953 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T18:29:42.953 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T18:29:42.953 [Cloud] Queued cloud request. 2026-09-27T18:29:42.953 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T18:29:42.953 [Cloud] Dequeued cloud request. 2026-09-27T18:29:42.953 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T18:29:43.124 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{69E20E6E-72DF-64D6-7E30-6E2B73AC97B1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 18:29:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T18:29:43.640 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T18:30:31.406 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T18:38:18.504 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T18:38:18.504 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T18:38:18.504 [Cloud] Queued cloud request. 2026-09-27T18:38:18.504 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T18:38:18.504 [Cloud] Dequeued cloud request. 2026-09-27T18:38:18.504 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T18:38:18.660 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EFD7C046-2166-8ACB-1F56-69F61C775D43} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 18:38:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T18:38:19.160 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T18:38:26.176 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T18:38:26.176 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T18:38:26.176 [Cloud] Queued cloud request. 2026-09-27T18:38:26.176 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T18:38:26.176 [Cloud] Dequeued cloud request. 2026-09-27T18:38:26.176 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T18:38:26.254 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C32D183-48D0-B2AE-69FF-FB4F20041FA0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 18:38:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T18:38:26.770 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T18:38:50.395 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T18:38:50.395 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T18:38:50.395 [Cloud] Queued cloud request. 2026-09-27T18:38:50.395 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T18:38:50.395 [Cloud] Dequeued cloud request. 2026-09-27T18:38:50.395 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T18:38:50.473 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2DC62382-305A-1FEF-5AE9-4CD91F9290CC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 18:38:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T18:38:50.973 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T18:42:21.005 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T18:42:21.005 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T18:42:21.005 [Cloud] Queued cloud request. 2026-09-27T18:42:21.005 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T18:42:21.005 [Cloud] Dequeued cloud request. 2026-09-27T18:42:21.005 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T18:42:21.162 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B7CF6699-3828-6402-41F8-72D1637F6549} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 18:42:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T18:42:21.677 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T18:45:36.413 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T18:47:13.336 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T18:47:13.336 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T18:47:13.336 [Cloud] Queued cloud request. 2026-09-27T18:47:13.336 [Cloud] Dequeued cloud request. 2026-09-27T18:47:13.336 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T18:47:13.336 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T18:47:13.489 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{07C93580-E6CF-28B2-F142-8CF5C64D4B7F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 18:47:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T18:47:13.992 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T18:47:46.978 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T18:47:46.978 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T18:47:46.978 [Cloud] Queued cloud request. 2026-09-27T18:47:46.978 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T18:47:46.978 [Cloud] Dequeued cloud request. 2026-09-27T18:47:46.978 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T18:47:47.056 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E250B5EE-2702-2EAB-A2BB-FB9C9E834D0B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 18:47:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T18:47:47.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T18:56:44.778 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T18:56:44.778 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T18:56:44.778 [Cloud] Queued cloud request. 2026-09-27T18:56:44.778 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T18:56:44.778 [Cloud] Dequeued cloud request. 2026-09-27T18:56:44.778 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T18:56:44.966 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2B6B2EB8-DE69-D23A-85F8-B86F50F5DA04} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 18:56:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T18:56:45.466 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:00:31.576 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T19:00:31.576 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T19:00:31.576 [Cloud] Queued cloud request. 2026-09-27T19:00:31.576 [Cloud] Dequeued cloud request. 2026-09-27T19:00:31.576 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T19:00:31.576 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T19:00:31.764 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3ED18A59-01DD-0049-33AE-E5692309CDC9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 19:00:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T19:00:32.264 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:00:41.420 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T19:00:59.421 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T19:00:59.421 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T19:00:59.421 [Cloud] Queued cloud request. 2026-09-27T19:00:59.421 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T19:00:59.421 [Cloud] Dequeued cloud request. 2026-09-27T19:00:59.421 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T19:00:59.499 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5A2B5EF5-999D-7559-638E-973757DAD588} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 19:00:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T19:00:59.999 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:02:59.859 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T19:02:59.859 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T19:02:59.859 [Cloud] Queued cloud request. 2026-09-27T19:02:59.859 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T19:02:59.859 [Cloud] Dequeued cloud request. 2026-09-27T19:02:59.859 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T19:03:00.047 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{465678E1-7FDD-3A2D-C975-F17EB41655A0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 19:03:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T19:03:00.547 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:04:39.922 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T19:04:39.922 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T19:04:39.922 [Cloud] Queued cloud request. 2026-09-27T19:04:39.922 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T19:04:39.922 [Cloud] Dequeued cloud request. 2026-09-27T19:04:39.922 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T19:04:40.109 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3809E9BF-28A5-C032-38FE-A3FEB1EE1C09} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 19:04:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T19:04:40.609 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:15:46.428 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T19:28:55.169 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T19:28:55.169 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T19:28:55.169 [Cloud] Queued cloud request. 2026-09-27T19:28:55.169 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T19:28:55.169 [Cloud] Dequeued cloud request. 2026-09-27T19:28:55.169 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T19:28:55.388 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DCE89053-6FDF-0BEA-A82C-8B17CF37AEFD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 19:28:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T19:28:55.903 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:30:19.606 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T19:30:19.606 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T19:30:19.606 [Cloud] Queued cloud request. 2026-09-27T19:30:19.606 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T19:30:19.606 [Cloud] Dequeued cloud request. 2026-09-27T19:30:19.606 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T19:30:19.778 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3771ED38-2820-2E95-22BD-4AB4635982E9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 19:30:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T19:30:20.294 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:30:51.435 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T19:38:59.892 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T19:38:59.892 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T19:38:59.892 [Cloud] Queued cloud request. 2026-09-27T19:38:59.892 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T19:38:59.892 [Cloud] Dequeued cloud request. 2026-09-27T19:38:59.892 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T19:39:00.095 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{780CD29A-8B7E-C13C-5104-A4F924539510} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 19:39:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T19:39:00.595 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:39:16.439 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-27T19:39:16.470 Job Notification: New process added to job (1564) 2026-09-27T19:39:16.470 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-27T19:39:16.470 Aggressive catchup quick scan threshold: 660086108108 / 25920000000000 2026-09-27T19:39:16.470 Job Notification: New process added to job (7144) 2026-09-27T19:39:16.486 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:1564] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7144]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-27T19:39:16.627 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-27T19:39:16.627 Job Notification: New process added to job (6164) 2026-09-27T19:39:16.627 Job Notification: New process added to job (6448) 2026-09-27T19:39:16.673 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:6164] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:6448]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-27T19:39:16.767 Job Notification: New process added to job (8020) 2026-09-27T19:39:16.830 Task(GetDeviceTicket -AccessKey CF3E82E4-589C-8595-B1B7-AD6EA9668820 ) launched as network service 2026-09-27T19:39:16.986 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-27T19:39:17.002 [RTP] Duplicating the current plugin configuration object... 2026-09-27T19:39:17.002 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-27T19:39:17.002 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-27T19:39:17.002 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-27T19:39:17.002 [RTP] No config change detected. Not updating plugin configuration. 2026-09-27T19:39:17.002 [RTP] No config changes found. No configuration switch. 2026-09-27T19:39:17.002 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-27T19:39:17.361 Job Notification: Process exited from job (8020) 2026-09-27T19:39:17.517 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-27T19:39:17.517 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T19:39:17.517 [Cloud] Queued cloud request. 2026-09-27T19:39:17.517 [Cloud] Dequeued cloud request. 2026-09-27T19:39:17.517 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T19:39:17.611 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-27T19:39:17.611 [Cloud] End of cloud request. 2026-09-27T19:39:18.033 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:39:30.627 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\CDB8312D-FE29-435A-8108-3F10AEFB68601b24.1dd4eb7e83f4357 2026-09-27T19:39:30.720 Verifying engine and signature files (source: 0) ... 2026-09-27T19:39:30.720 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8}\mpengine.dll] due to PPL. 2026-09-27T19:39:30.720 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8}\mpasbase.vdm]. File not in cache (0x1) 2026-09-27T19:39:31.658 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8}\mpasbase.vdm] 2026-09-27T19:39:31.658 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-27T19:39:31.705 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8}\mpasdlta.vdm] 2026-09-27T19:39:31.705 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8}\mpavbase.vdm]. File not in cache (0x1) 2026-09-27T19:39:32.127 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8}\mpavbase.vdm] 2026-09-27T19:39:32.127 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-27T19:39:32.142 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8}\mpavdlta.vdm] 2026-09-27T19:39:32.330 [Engine] IsHybridMode: 0 2026-09-27T19:39:32.330 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-27T19:39:32.345 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-70AA32C2851AFC455F8D1214B5E14B806A7BE054.bin): 0x00000002 2026-09-27T19:39:32.345 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-70AA32C2851AFC455F8D1214B5E14B806A7BE054.bin) 2026-09-27T19:39:32.345 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-27T19:39:32.345 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-27T19:39:32.345 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-27T19:39:32.345 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff 2026-09-27T19:39:42.049 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 36891, Count: 2592, MaxTime: 468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-27T19:39:42.049 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 22998, Count: 2140, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-27T19:39:42.049 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 3214, Count: 293, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T19:39:42.049 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-27T19:39:42.049 ProcessImageName: AgentShellService.exe, Pid: 7376, TotalTime: 806, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 56% 2026-09-27T19:39:42.049 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 754, Count: 56, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-27T19:39:42.049 ProcessImageName: WmiPrvSE.exe, Pid: 6452, TotalTime: 615, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-27T19:39:42.049 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 391, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 39% 2026-09-27T19:39:42.049 ProcessImageName: powershell.exe, Pid: 7460, TotalTime: 263, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-27T19:39:42.049 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-27T19:39:42.049 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T19:39:42.049 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 210, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-27T19:39:42.049 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-27T19:39:42.049 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 70, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2.MAI, EstimatedImpact: 0% 2026-09-27T19:39:42.049 ProcessImageName: python.exe, Pid: 6424, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 2% 2026-09-27T19:39:42.049 ProcessImageName: python.exe, Pid: 5824, TotalTime: 60, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\cffi-1.16.0.dist-info\entry_points.txt, EstimatedImpact: 2% 2026-09-27T19:39:42.049 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-27T19:39:42.049 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-27T19:39:42.049 ProcessImageName: mysqldump.exe, Pid: 4864, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-27T19:39:42.049 ProcessImageName: ngentask.exe, Pid: 7412, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 27% 2026-09-27T19:39:42.049 ProcessImageName: powershell.exe, Pid: 4876, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-27T19:39:42.049 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-27T19:39:42.049 ProcessImageName: cmd.exe, Pid: 1532, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-27T19:39:42.049 ProcessImageName: DeviceCensus.exe, Pid: 7992, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Windows\OneSettings\WaaSAssessmentSettings.json, EstimatedImpact: 1% IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-27T19:39:44.174 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-27T19:39:44.174 [AutoExclusion] Applied roles from cache. 2026-09-27T19:39:44.174 [AutoExclusion] Started roles monitoring. 2026-09-27T19:39:44.252 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF4ABB020, lRefCount: 6, hr=0 2026-09-27T19:39:44.252 [Engine] New active engine 00007FFCF68AB020 replacing engine 00007FFCF4ABB020. Number of active engines: 2 2026-09-27T19:39:44.267 EngineInit:Global ASOC is enabled 2026-09-27T19:39:44.267 EngineInit:ASOO is enabled for developer volumes 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.361 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.377 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.377 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.377 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.377 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-27T19:39:44.392 MpWriteUupSignatureVersion 1.459.432.0, hr = 0 2026-09-27T19:39:44.392 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-27T19:39:44.424 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-27T19:39:44.424 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-27T19:39:44.424 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-27T19:39:44.424 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-27T19:39:44.439 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-27T19:39:44.439 [Plugin] Initializing RTP plugin state... 2026-09-27T19:39:44.439 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-27T19:39:44.439 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎26‎-‎2026 21:39:41 Last Perf:‎09‎-‎26‎-‎2026 21:39:41 First RTP Scan:‎09‎-‎26‎-‎2026 21:39:41 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1579 Misses:7898 BM Queue:0,199,0 Proc:0,27,0 File:0,194,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:4389895 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:968805322 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:3707 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:228364 TotalHits:2378926 InstanceCacheInserts:32542 InstanceCacheUpdates:0 InstanceCacheDeletes:18412 InstanceCacheHits:1165 InstanceCacheMisses:131980 InstanceCacheOverflows:12907 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:4ms (6998/1481) Success: 1481, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-27T19:39:44.439 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8} 2026-09-27T19:39:44.439 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1C979063-C0B8-46CF-A610-09B6E0E17346} removed 2026-09-27T19:39:44.439 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-27T19:39:44.439 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345}\mpasbase.vdm in use, hr=0x80070020 2026-09-27T19:39:44.439 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-27T19:39:44.439 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-27T19:39:44.439 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-27T19:39:44.439 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-27T19:39:44.439 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-27-2026 19:39:44 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-27-2026 19:39:44 2026-09-27T19:39:44.455 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-27T19:39:44.455 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-27T19:39:44.455 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-27T19:39:44.455 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-27T19:39:44.455 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:39:44.455 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-27T19:39:44.455 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-27T19:39:44.455 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-27T19:39:44.455 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-27T19:39:44.455 MdCoreSvc is supported in this platform and OS Signature updated on 09-27-2026 19:39:44 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.432.0 AV Signature Version: 1.459.432.0 ************************************************************ 2026-09-27T19:39:44.471 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-27T19:39:44.471 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\CDB8312D-FE29-435A-8108-3F10AEFB68601b24.1dd4eb7e83f4357 2026-09-27T19:39:44.502 Process scan (postsignatureupdatescan) started. 2026-09-27T19:39:44.517 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-27T19:39:44.533 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-27-2026 19:39:44 ************************************************************ 2026-09-27T19:39:44.736 Job Notification: Process exited from job (6164) 2026-09-27T19:39:44.736 Job Notification: Process exited from job (1564) 2026-09-27T19:39:44.736 Job Notification: Process exited from job (6448) 2026-09-27T19:39:44.752 Job Notification: Process exited from job (7144) 2026-09-27T19:39:44.861 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-27T19:39:44.861 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-27T19:39:44.861 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-27T19:39:44.861 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-27T19:39:44.861 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-27T19:39:44.877 [Engine] Engine 00007FFCF4ABB020 no longer in use. Number of active engines: 1 2026-09-27T19:39:44.877 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-27T19:39:44.877 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-27T19:39:44.892 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-27T19:39:44.892 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-27T19:39:44.892 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-27T19:39:45.424 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 36891, Count: 2592, MaxTime: 468, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-27T19:39:45.424 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 23013, Count: 2141, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-27T19:39:45.424 ProcessImageName: AgentShell.exe, Pid: 264, TotalTime: 3214, Count: 293, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T19:39:45.424 ProcessImageName: powershell.exe, Pid: 7704, TotalTime: 1260, Count: 91, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\5fddc2f9ec727fcc563ae01beb752701\Microsoft.PowerShell.Commands.Management.ni.dll, EstimatedImpact: 36% 2026-09-27T19:39:45.424 ProcessImageName: AgentShellService.exe, Pid: 7376, TotalTime: 806, Count: 24, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 56% 2026-09-27T19:39:45.424 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 754, Count: 56, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-27T19:39:45.424 ProcessImageName: WmiPrvSE.exe, Pid: 6452, TotalTime: 615, Count: 26, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-27T19:39:45.424 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 391, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 39% 2026-09-27T19:39:45.424 ProcessImageName: powershell.exe, Pid: 7460, TotalTime: 263, Count: 23, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 25% 2026-09-27T19:39:45.424 ProcessImageName: powershell.exe, Pid: 3036, TotalTime: 246, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 29% 2026-09-27T19:39:45.424 ProcessImageName: WmiPrvSE.exe, Pid: 4616, TotalTime: 232, Count: 5, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T19:39:45.424 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 210, Count: 17, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-27T19:39:45.424 ProcessImageName: taskhostw.exe, Pid: 6108, TotalTime: 107, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 12% 2026-09-27T19:39:45.424 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 70, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-256fd-2.MAI, EstimatedImpact: 0% 2026-09-27T19:39:45.502 [Engine] RSIG_UNLOADENGINE, 00007FFCF4ABB020, err=0x0 2026-09-27T19:39:45.533 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{95E3B280-8676-4669-888E-87023D573345} removed Internal signature match:subtype=Lowfi, sigseq=0x0000157E67AA49DF, sigsha=cd8f16a9d4beb15e15e36fc9a546c2d5bfbafd06, cached=false, source=0, resourceid=0x0d0ba041 2026-09-27T19:39:58.549 Process scan (postsignatureupdatescan) completed. 2026-09-27T19:40:48.971 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T19:40:48.971 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T19:40:48.971 [Cloud] Queued cloud request. 2026-09-27T19:40:48.971 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T19:40:48.971 [Cloud] Dequeued cloud request. 2026-09-27T19:40:48.971 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T19:40:49.159 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{499F4769-847C-0F76-AD28-944A8A01401C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 19:40:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T19:40:49.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:44:44.299 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-27T19:45:56.441 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T19:50:36.381 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T19:50:36.381 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T19:50:36.381 [Cloud] Queued cloud request. 2026-09-27T19:50:36.381 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T19:50:36.381 [Cloud] Dequeued cloud request. 2026-09-27T19:50:36.381 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T19:50:36.569 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{764AF9CF-CC82-B858-EC9F-FAFE21D677FA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 19:50:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T19:50:37.069 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:56:26.603 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T19:56:26.603 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T19:56:26.603 [Cloud] Queued cloud request. 2026-09-27T19:56:26.603 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T19:56:26.603 [Cloud] Dequeued cloud request. 2026-09-27T19:56:26.603 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{940B685F-CA6A-78E8-29D0-75A792407FF3} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 19:56:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T19:56:36.713 [Cloud] End of cloud request. 2026-09-27T19:56:37.228 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T19:57:22.198 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T19:57:22.198 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T19:57:22.198 [Cloud] Queued cloud request. 2026-09-27T19:57:22.198 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T19:57:22.198 [Cloud] Dequeued cloud request. 2026-09-27T19:57:22.198 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T19:57:22.307 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BBE0387B-FA3F-398B-0C1B-3D7C26CB33AC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 19:57:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T19:57:22.807 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T20:01:01.448 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T20:02:31.308 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T20:02:31.308 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T20:02:31.308 [Cloud] Queued cloud request. 2026-09-27T20:02:31.308 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T20:02:31.308 [Cloud] Dequeued cloud request. 2026-09-27T20:02:31.308 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T20:02:31.464 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DA8078F0-AB0B-CCC9-3A83-F30FA7C6FDA9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 20:02:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T20:02:31.980 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T20:03:02.995 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T20:03:02.995 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T20:03:02.995 [Cloud] Queued cloud request. 2026-09-27T20:03:02.995 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T20:03:02.995 [Cloud] Dequeued cloud request. 2026-09-27T20:03:02.995 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T20:03:03.073 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{926442DC-0AB4-DA4B-ABE2-9DA7736F068C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 20:03:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T20:03:03.573 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T20:04:16.903 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T20:04:16.903 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T20:04:16.903 [Cloud] Queued cloud request. 2026-09-27T20:04:16.903 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T20:04:16.903 [Cloud] Dequeued cloud request. 2026-09-27T20:04:16.903 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T20:04:17.059 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7A6177EB-F261-A469-4D46-1E3A9F8B892B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 20:04:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T20:04:17.559 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T20:08:11.016 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T20:08:11.016 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T20:08:11.016 [Cloud] Queued cloud request. 2026-09-27T20:08:11.016 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T20:08:11.016 [Cloud] Dequeued cloud request. 2026-09-27T20:08:11.016 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T20:08:11.156 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B359C69A-7DA0-EA4B-FB89-793C582D3B1B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 20:08:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T20:08:11.672 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T20:11:20.360 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T20:11:20.360 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T20:11:20.360 [Cloud] Queued cloud request. 2026-09-27T20:11:20.360 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T20:11:20.360 [Cloud] Dequeued cloud request. 2026-09-27T20:11:20.360 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T20:11:20.985 [Cloud] End of cloud request. 2026-09-27T20:11:21.485 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T20:16:06.456 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T20:17:40.692 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T20:17:40.692 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T20:17:40.692 [Cloud] Queued cloud request. 2026-09-27T20:17:40.692 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T20:17:40.864 [Cloud] Dequeued cloud request. 2026-09-27T20:17:41.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T20:17:41.176 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DC3256B6-6682-9968-D978-548DC634A4BF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 20:17:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T20:17:41.676 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T20:22:47.897 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T20:22:47.897 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T20:22:47.897 [Cloud] Queued cloud request. 2026-09-27T20:22:47.897 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T20:22:47.897 [Cloud] Dequeued cloud request. 2026-09-27T20:22:47.897 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T20:22:48.085 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{103528DC-4591-D6E1-314F-DEFD8215950A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 20:22:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T20:22:48.585 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T20:31:11.463 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T20:33:02.791 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T20:33:02.791 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T20:33:02.791 [Cloud] Queued cloud request. 2026-09-27T20:33:02.791 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T20:33:02.947 [Cloud] Dequeued cloud request. 2026-09-27T20:33:03.197 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T20:33:03.369 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{603C8CFC-C4ED-8C92-7FFC-6BC3ED115E88} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 20:33:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T20:33:03.884 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T20:44:56.156 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T20:44:56.156 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T20:44:56.156 [Cloud] Queued cloud request. 2026-09-27T20:44:56.156 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T20:44:56.156 [Cloud] Dequeued cloud request. 2026-09-27T20:44:56.156 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T20:44:56.343 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2941BC3D-7740-4A0A-82B1-A3492FFC09AC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 20:44:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T20:44:56.843 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T20:45:02.062 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T20:45:02.062 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T20:45:02.062 [Cloud] Queued cloud request. 2026-09-27T20:45:02.062 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T20:45:02.062 [Cloud] Dequeued cloud request. 2026-09-27T20:45:02.062 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T20:45:02.265 [Cloud] End of cloud request. 2026-09-27T20:45:02.765 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T20:45:47.970 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T20:45:47.970 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T20:45:47.970 [Cloud] Queued cloud request. 2026-09-27T20:45:47.970 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T20:45:47.970 [Cloud] Dequeued cloud request. 2026-09-27T20:45:47.970 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T20:45:48.095 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E102A19-49BD-BCC4-5D99-42AA7DE03BB2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 20:45:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T20:45:48.752 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T20:46:16.471 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T20:58:19.274 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T20:58:19.274 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T20:58:19.274 [Cloud] Queued cloud request. 2026-09-27T20:58:19.274 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T20:58:19.274 [Cloud] Dequeued cloud request. 2026-09-27T20:58:19.274 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T20:58:19.461 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3CBF5526-F9F1-AA77-109B-1514F1A1D3D2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 20:58:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T20:58:19.977 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T21:01:21.477 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T21:13:08.106 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T21:13:08.106 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T21:13:08.106 [Cloud] Queued cloud request. 2026-09-27T21:13:08.106 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T21:13:08.106 [Cloud] Dequeued cloud request. 2026-09-27T21:13:08.106 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T21:13:08.309 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{709C327A-A635-DECC-9A71-6561F4857392} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 21:13:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T21:13:08.825 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T21:13:12.840 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T21:13:12.840 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T21:13:12.840 [Cloud] Queued cloud request. 2026-09-27T21:13:12.840 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T21:13:12.840 [Cloud] Dequeued cloud request. 2026-09-27T21:13:12.840 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T21:13:12.918 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4141E461-2C03-0B90-0658-BB60EB3E1DE5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 21:13:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T21:13:13.434 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T21:16:26.481 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T21:20:10.611 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T21:20:10.611 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T21:20:10.611 [Cloud] Queued cloud request. 2026-09-27T21:20:10.611 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T21:20:10.611 [Cloud] Dequeued cloud request. 2026-09-27T21:20:10.611 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T21:20:10.783 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4C7B74BB-08C6-93EE-7C1B-AF21B9DF819B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 21:20:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T21:20:11.299 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T21:25:38.911 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T21:25:38.911 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T21:25:38.911 [Cloud] Queued cloud request. 2026-09-27T21:25:38.911 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T21:25:38.911 [Cloud] Dequeued cloud request. 2026-09-27T21:25:38.911 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T21:25:47.943 [Cloud] End of cloud request. 2026-09-27T21:25:48.458 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T21:26:31.647 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T21:26:31.647 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T21:26:31.647 [Cloud] Queued cloud request. 2026-09-27T21:26:31.647 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T21:26:31.647 [Cloud] Dequeued cloud request. 2026-09-27T21:26:31.647 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T21:26:31.725 [Cloud] End of cloud request. 2026-09-27T21:26:32.225 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T21:31:31.492 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T21:34:28.243 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T21:34:28.243 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T21:34:28.243 [Cloud] Queued cloud request. 2026-09-27T21:34:28.243 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T21:34:28.243 [Cloud] Dequeued cloud request. 2026-09-27T21:34:28.243 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T21:34:28.383 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{509E09CB-4597-1525-263F-A23020BFFBCC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 21:34:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T21:34:28.899 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T21:39:44.309 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 6928, Count: 482, MaxTime: 234, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\mampress\wp-includes\functions-formatting.php->(SCRIPT0000)->(JSNORM), EstimatedImpact: 0% 2026-09-27T21:39:44.309 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 2150, Count: 200, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T21:39:44.309 ProcessImageName: powershell.exe, Pid: 2768, TotalTime: 1583, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-27T21:39:44.309 ProcessImageName: WmiPrvSE.exe, Pid: 6992, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T21:39:44.309 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 121, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-27T21:39:44.309 ProcessImageName: taskhostw.exe, Pid: 2888, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-27T21:39:44.309 ProcessImageName: ngentask.exe, Pid: 5724, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 25% 2026-09-27T21:39:44.309 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-27T21:39:44.309 ProcessImageName: taskhostw.exe, Pid: 1824, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-27T21:45:10.701 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T21:45:10.701 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T21:45:10.701 [Cloud] Queued cloud request. 2026-09-27T21:45:10.701 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T21:45:10.701 [Cloud] Dequeued cloud request. 2026-09-27T21:45:10.701 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T21:45:10.888 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{49180A50-0185-C656-6815-D5F5E59A7FB0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 21:45:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T21:45:11.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T21:45:59.624 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T21:45:59.624 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T21:45:59.624 [Cloud] Queued cloud request. 2026-09-27T21:45:59.624 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T21:45:59.624 [Cloud] Dequeued cloud request. 2026-09-27T21:45:59.624 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T21:45:59.702 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{20E54D3E-9C92-50BF-A808-939118D18785} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 21:45:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T21:46:00.202 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T21:46:36.500 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T22:01:41.505 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T22:07:50.104 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T22:07:50.104 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T22:07:50.104 [Cloud] Queued cloud request. 2026-09-27T22:07:50.104 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T22:07:50.104 [Cloud] Dequeued cloud request. 2026-09-27T22:07:50.104 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T22:07:50.291 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CA53DECE-22DE-5A33-AF9B-3E69C2EF6488} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 22:07:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T22:07:50.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T22:13:24.417 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T22:13:24.417 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T22:13:24.417 [Cloud] Queued cloud request. 2026-09-27T22:13:24.417 [Cloud] Dequeued cloud request. 2026-09-27T22:13:24.417 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T22:13:24.417 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{55E20F07-639C-F1FF-2876-BFB0C9457AAF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 22:13:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T22:13:24.605 [Cloud] End of cloud request. 2026-09-27T22:13:25.105 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T22:14:08.058 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T22:14:08.058 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T22:14:08.058 [Cloud] Queued cloud request. 2026-09-27T22:14:08.058 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T22:14:08.058 [Cloud] Dequeued cloud request. 2026-09-27T22:14:08.058 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T22:14:08.136 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{43F6004F-E6C3-371A-FE51-7ECE7EB9844D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 22:14:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T22:14:08.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T22:16:46.514 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T22:17:48.046 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T22:17:48.046 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T22:17:48.046 [Cloud] Queued cloud request. 2026-09-27T22:17:48.046 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T22:17:48.046 [Cloud] Dequeued cloud request. 2026-09-27T22:17:48.046 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T22:17:48.218 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2881E769-7C6A-B183-F258-B651601BA14F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 22:17:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T22:17:48.733 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T22:22:57.704 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T22:22:57.704 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T22:22:57.704 [Cloud] Queued cloud request. 2026-09-27T22:22:57.704 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T22:22:57.704 [Cloud] Dequeued cloud request. 2026-09-27T22:22:57.704 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T22:23:07.798 [Cloud] End of cloud request. 2026-09-27T22:23:08.298 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T22:31:51.521 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T22:38:33.196 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T22:38:33.196 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T22:38:33.196 [Cloud] Queued cloud request. 2026-09-27T22:38:33.196 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T22:38:33.196 [Cloud] Dequeued cloud request. 2026-09-27T22:38:33.196 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T22:38:33.352 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{428BAFCA-FE09-2A21-53DA-069E85F16496} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 22:38:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T22:38:33.852 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T22:46:56.527 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T23:02:01.534 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T23:10:19.710 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T23:10:19.710 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T23:10:19.710 [Cloud] Queued cloud request. 2026-09-27T23:10:19.710 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T23:10:19.710 [Cloud] Dequeued cloud request. 2026-09-27T23:10:19.710 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T23:10:19.851 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{371E33A5-53B2-C0AE-592B-85BDBE582DFC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 23:10:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T23:10:20.351 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T23:14:00.508 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T23:14:00.508 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T23:14:00.508 [Cloud] Queued cloud request. 2026-09-27T23:14:00.508 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T23:14:00.508 [Cloud] Dequeued cloud request. 2026-09-27T23:14:00.508 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T23:14:00.648 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C673A8D8-6AC8-423C-EA10-F6695D74E59E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 23:14:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T23:14:01.148 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T23:17:06.539 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T23:20:59.151 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T23:20:59.151 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T23:20:59.151 [Cloud] Queued cloud request. 2026-09-27T23:20:59.151 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T23:20:59.338 [Cloud] Dequeued cloud request. 2026-09-27T23:20:59.338 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T23:20:59.479 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1A807DE7-C89B-C9A4-9731-466545E404DC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 23:20:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T23:20:59.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T23:22:21.635 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T23:22:21.635 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T23:22:21.635 [Cloud] Queued cloud request. 2026-09-27T23:22:21.635 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T23:22:21.635 [Cloud] Dequeued cloud request. 2026-09-27T23:22:21.635 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T23:22:21.776 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0D29CC55-4020-5B63-C124-14DC74B37974} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 23:22:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T23:22:22.276 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T23:25:07.529 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T23:25:07.529 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T23:25:07.529 [Cloud] Queued cloud request. 2026-09-27T23:25:07.529 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T23:25:07.529 [Cloud] Dequeued cloud request. 2026-09-27T23:25:07.529 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T23:25:07.669 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9D67DCAF-AAFD-78DD-EA95-81ADDBFF74F1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 23:25:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T23:25:08.169 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T23:28:43.687 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T23:28:43.687 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T23:28:43.687 [Cloud] Queued cloud request. 2026-09-27T23:28:43.687 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T23:28:43.687 [Cloud] Dequeued cloud request. 2026-09-27T23:28:43.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T23:28:43.827 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A1BF48AB-45CA-7CD4-4699-B6BBED14CB44} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 23:28:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T23:28:44.327 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T23:32:11.547 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T23:39:44.363 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 16454, Count: 974, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-27T23:39:44.363 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 4346, Count: 406, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-27T23:39:44.363 ProcessImageName: powershell.exe, Pid: 2768, TotalTime: 1583, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-27T23:39:44.363 ProcessImageName: WmiPrvSE.exe, Pid: 6980, TotalTime: 631, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-27T23:39:44.363 ProcessImageName: WmiPrvSE.exe, Pid: 6992, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-27T23:39:44.363 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 136, Count: 12, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-27T23:39:44.363 ProcessImageName: taskhostw.exe, Pid: 2888, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-27T23:39:44.363 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-27T23:39:44.363 ProcessImageName: ngentask.exe, Pid: 5724, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 25% 2026-09-27T23:39:44.363 ProcessImageName: powershell.exe, Pid: 2760, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-27T23:39:44.363 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-27T23:39:44.363 ProcessImageName: taskhostw.exe, Pid: 1824, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-27T23:39:44.363 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 0, Count: 4, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2758c-0.MAI, EstimatedImpact: 0% 2026-09-27T23:40:03.114 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T23:40:03.114 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T23:40:03.114 [Cloud] Queued cloud request. 2026-09-27T23:40:03.114 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T23:40:03.114 [Cloud] Dequeued cloud request. 2026-09-27T23:40:03.114 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T23:40:03.332 [Cloud] End of cloud request. 2026-09-27T23:40:03.833 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T23:47:16.554 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-27T23:55:58.370 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T23:55:58.370 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T23:55:58.370 [Cloud] Queued cloud request. 2026-09-27T23:55:58.370 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T23:55:58.370 [Cloud] Dequeued cloud request. 2026-09-27T23:55:58.370 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T23:55:58.557 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{80361618-93E1-7412-7982-4EB967D800B5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-27-2026 23:55:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-27T23:55:59.073 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-27T23:57:17.605 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-27T23:57:17.605 [Cloud] Start of cloud request. Passive mode: 0 2026-09-27T23:57:17.605 [Cloud] Queued cloud request. 2026-09-27T23:57:17.605 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-27T23:57:17.605 [Cloud] Dequeued cloud request. 2026-09-27T23:57:17.605 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-27T23:57:17.793 [Cloud] End of cloud request. 2026-09-27T23:57:18.308 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T00:02:21.561 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T00:17:26.567 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T00:32:31.572 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T00:39:15.014 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T00:39:15.014 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T00:39:15.014 [Cloud] Queued cloud request. 2026-09-28T00:39:15.014 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T00:39:15.280 [Cloud] Dequeued cloud request. 2026-09-28T00:39:15.280 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T00:39:15.467 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{26455162-BE4F-0C60-79DA-F7074922643D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 00:39:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T00:39:15.967 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T00:39:19.624 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T00:39:19.624 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T00:39:19.624 [Cloud] Queued cloud request. 2026-09-28T00:39:19.624 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T00:39:19.624 [Cloud] Dequeued cloud request. 2026-09-28T00:39:19.624 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T00:39:19.702 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CB6BF758-B294-BB1D-2C9B-812683A209F5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 00:39:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T00:39:20.217 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T00:47:36.581 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T01:00:02.101 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497427, FileId: 0x2800000003f569, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.101 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497428, FileId: 0xd000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.117 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497434, FileId: 0xf000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.117 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497433, FileId: 0x2a00000003f569, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.133 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497439, FileId: 0x2c00000003f569, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.133 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497440, FileId: 0x11000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.148 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497446, FileId: 0x13000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.148 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497445, FileId: 0x2e00000003f569, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.164 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497452, FileId: 0x15000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.164 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497451, FileId: 0x3000000003f569, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.179 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497461, FileId: 0x17000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.179 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497460, FileId: 0x3200000003f569, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.179 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497467, FileId: 0x19000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.179 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497466, FileId: 0x3400000003f569, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.195 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497472, FileId: 0x3600000003f569, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.195 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497473, FileId: 0x1b000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.211 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497479, FileId: 0x1d000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.211 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497478, FileId: 0x3800000003f569, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.226 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497486, FileId: 0x1f000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.226 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497485, FileId: 0x3a00000003f569, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.242 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497492, FileId: 0x21000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.242 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497491, FileId: 0x3c00000003f569, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.242 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497498, FileId: 0x23000000009fbe, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:00:02.242 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-27723-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4497497, FileId: 0x3e00000003f569, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-28T01:02:41.586 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T01:02:59.789 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T01:02:59.789 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T01:02:59.789 [Cloud] Queued cloud request. 2026-09-28T01:02:59.789 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T01:02:59.789 [Cloud] Dequeued cloud request. 2026-09-28T01:02:59.789 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T01:02:59.976 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{46418622-8DAC-0932-2404-B384602F9EE1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 01:02:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T01:03:00.476 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T01:17:46.594 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T01:19:07.860 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:C651C431-EE5C-48FC-AA71-F00A149B67C8, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-28T01:19:07.860 Scheduled scan with Id C651C431-EE5C-48FC-AA71-F00A149B67C8 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-28T01:19:07.860 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-28T01:19:07.860 [SFC] System file cache build is not needed (already completed) Internal signature match:subtype=Lowfi, sigseq=0x0000157E67AA49DF, sigsha=cd8f16a9d4beb15e15e36fc9a546c2d5bfbafd06, cached=false, source=0, resourceid=0x0d0ba041 2026-09-28T01:19:30.954 Engine:Triggered AR EMS scan 2026-09-28T01:19:30.954 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:30.970 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:30.985 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:30.985 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.001 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.016 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.016 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.032 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.048 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.048 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.048 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.048 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.063 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.063 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.063 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.079 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.079 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.079 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.095 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.095 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.095 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.110 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.110 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.110 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.110 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.126 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.126 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.126 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.141 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.141 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.141 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.141 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.157 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.157 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.157 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.173 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.173 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.188 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.188 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.188 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.188 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.204 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.204 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.204 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.220 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.220 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.220 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.235 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.235 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.235 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.251 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.251 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.251 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.266 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.266 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.266 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.266 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.282 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.298 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.298 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.313 Engine:EMS scan for process: svchost pid: 1632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:19:31.313 Engine:EMS scan for process: svchost pid: 5024, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-28T01:20:11.110 QuickScan:ScanID:C651C431-EE5C-48FC-AA71-F00A149B67C8: Quick scan finished with error 0 2026-09-28T01:20:11.626 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-28T01:20:11.626 [RTP] Duplicating the current plugin configuration object... 2026-09-28T01:20:11.626 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-28T01:20:11.626 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-28T01:20:11.626 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-28T01:20:11.626 [RTP] No config change detected. Not updating plugin configuration. 2026-09-28T01:20:11.626 [RTP] No config changes found. No configuration switch. 2026-09-28T01:20:11.626 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-28T01:21:15.704 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T01:21:15.704 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T01:21:15.704 [Cloud] Queued cloud request. 2026-09-28T01:21:15.704 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T01:21:15.704 [Cloud] Dequeued cloud request. 2026-09-28T01:21:15.704 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T01:21:15.923 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{37C52C3D-BE9A-EC6E-FEE1-1ECF8ABBB05A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 01:21:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T01:21:16.438 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T01:32:51.601 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T01:33:01.960 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-28T01:33:01.960 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-28T01:33:01.960 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-28T01:33:01.960 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-28T01:33:01.960 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-28T01:33:01.960 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-28T01:33:01.960 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-28T01:33:01.976 [AutoPurge] Cleanup Routine tasks have started. 2026-09-28T01:33:01.991 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-28T01:33:01.991 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-28T01:33:01.991 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-28-2026 01:33:01 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-28-2026 01:33:01 2026-09-28T01:33:02.023 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-28T01:33:02.023 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-28T01:33:02.023 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-28T01:33:02.023 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-28T01:33:02.023 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-28T01:33:02.023 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-28T01:33:02.101 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-28T01:33:02.101 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-28T01:33:02.116 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-28T01:33:02.132 [AutoPurge] Removing expired default signature package ... 2026-09-28T01:33:02.351 Job Notification: New process added to job (7232) 2026-09-28T01:33:03.038 Job Notification: Process exited from job (7232) 2026-09-28T01:33:03.085 [AutoPurge] Verification Routine tasks have ended. 2026-09-28T01:39:44.416 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 19363, Count: 1178, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-28T01:39:44.416 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 6140, Count: 559, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-28T01:39:44.416 ProcessImageName: powershell.exe, Pid: 2768, TotalTime: 1583, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-28T01:39:44.416 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 1335, Count: 80, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-28T01:39:44.416 ProcessImageName: AgentShellService.exe, Pid: 2664, TotalTime: 729, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-28T01:39:44.416 ProcessImageName: WmiPrvSE.exe, Pid: 6980, TotalTime: 631, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-28T01:39:44.416 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 333, Count: 25, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-28T01:39:44.416 ProcessImageName: WmiPrvSE.exe, Pid: 6992, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-28T01:39:44.416 ProcessImageName: python.exe, Pid: 2916, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 5% 2026-09-28T01:39:44.416 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-276f1-0.MAI, EstimatedImpact: 0% 2026-09-28T01:39:44.416 ProcessImageName: taskhostw.exe, Pid: 2888, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-28T01:39:44.416 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-28T01:39:44.416 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-28T01:39:44.416 ProcessImageName: powershell.exe, Pid: 7840, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp94EC.tmp, EstimatedImpact: 0% 2026-09-28T01:39:44.416 ProcessImageName: ngentask.exe, Pid: 5724, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 25% 2026-09-28T01:39:44.416 ProcessImageName: powershell.exe, Pid: 2760, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-28T01:39:44.416 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-28T01:39:44.416 ProcessImageName: mysqldump.exe, Pid: 2440, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-28T01:39:44.416 ProcessImageName: taskhostw.exe, Pid: 1824, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-28T01:47:56.607 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T02:03:01.613 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T02:05:40.146 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T02:05:40.146 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T02:05:40.146 [Cloud] Queued cloud request. 2026-09-28T02:05:40.146 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T02:05:40.146 [Cloud] Dequeued cloud request. 2026-09-28T02:05:40.146 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T02:05:40.349 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D60CC7DB-861F-640D-D69D-A4B91CCE2F12} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 02:05:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T02:05:40.849 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-28T02:05:40.865 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T02:05:40.880 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-28T02:05:40.880 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-28T02:05:40.880 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-28T02:05:40.880 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-28T02:05:40.880 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-28T02:05:40.880 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-28T02:05:40.880 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-28T02:05:40.880 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-28T02:05:40.880 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-28T02:05:40.880 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-28T02:05:40.880 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-28T02:05:40.880 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-28T02:05:40.880 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-28T02:05:40.880 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-28T02:05:40.880 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T02:05:40.880 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-28T02:05:40.880 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-28T02:05:40.880 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-28T02:05:40.880 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-28T02:05:40.880 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-28T02:05:40.880 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-28T02:05:40.880 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T02:05:40.880 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T02:05:40.880 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T02:05:43.458 [RTP] Duplicating the current plugin configuration object... 2026-09-28T02:05:43.458 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-28T02:05:43.458 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-28T02:05:43.458 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-28T02:05:43.458 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-28T02:05:43.458 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-28T02:07:31.053 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T02:07:31.053 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T02:07:31.053 [Cloud] Queued cloud request. 2026-09-28T02:07:31.053 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T02:07:31.053 [Cloud] Dequeued cloud request. 2026-09-28T02:07:31.053 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T02:07:31.241 [Cloud] End of cloud request. 2026-09-28T02:07:31.741 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T02:18:06.620 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T02:33:11.624 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T02:42:21.380 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T02:42:21.380 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T02:42:21.380 [Cloud] Queued cloud request. 2026-09-28T02:42:21.380 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T02:42:21.380 [Cloud] Dequeued cloud request. 2026-09-28T02:42:21.380 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T02:42:21.567 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{987A5838-0498-DE7C-422F-4598702FD6FD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 02:42:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T02:42:22.067 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T02:48:16.633 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T02:59:20.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T02:59:20.700 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T02:59:20.700 [Cloud] Queued cloud request. 2026-09-28T02:59:20.700 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T02:59:20.700 [Cloud] Dequeued cloud request. 2026-09-28T02:59:20.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T02:59:20.934 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A02D7CD1-A337-93BD-8F18-8284E7DD23D9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 02:59:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T02:59:21.450 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T03:03:06.154 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T03:03:06.154 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T03:03:06.154 [Cloud] Queued cloud request. 2026-09-28T03:03:06.154 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T03:03:06.154 [Cloud] Dequeued cloud request. 2026-09-28T03:03:06.154 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T03:03:06.341 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CD002CB4-2565-BF28-23B9-B81F41FFF341} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 03:03:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T03:03:06.841 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T03:03:21.638 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T03:07:08.717 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T03:07:08.717 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T03:07:08.717 [Cloud] Queued cloud request. 2026-09-28T03:07:08.717 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T03:07:08.717 [Cloud] Dequeued cloud request. 2026-09-28T03:07:08.717 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T03:07:12.373 [Cloud] End of cloud request. 2026-09-28T03:07:12.889 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T03:18:26.646 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T03:33:31.651 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T03:39:44.483 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 23863, Count: 1532, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-28T03:39:44.483 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 6140, Count: 559, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-28T03:39:44.483 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 3427, Count: 273, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-28T03:39:44.483 ProcessImageName: powershell.exe, Pid: 2768, TotalTime: 1583, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-28T03:39:44.483 ProcessImageName: AgentShellService.exe, Pid: 2664, TotalTime: 729, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-28T03:39:44.483 ProcessImageName: WmiPrvSE.exe, Pid: 6980, TotalTime: 631, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-28T03:39:44.483 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 363, Count: 27, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-28T03:39:44.483 ProcessImageName: WmiPrvSE.exe, Pid: 6992, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-28T03:39:44.483 ProcessImageName: python.exe, Pid: 2916, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 5% 2026-09-28T03:39:44.483 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-276f1-0.MAI, EstimatedImpact: 0% 2026-09-28T03:39:44.483 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-28T03:39:44.483 ProcessImageName: taskhostw.exe, Pid: 2888, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-28T03:39:44.483 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-28T03:39:44.483 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-28T03:39:44.483 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-28T03:39:44.483 ProcessImageName: powershell.exe, Pid: 7840, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp94EC.tmp, EstimatedImpact: 0% 2026-09-28T03:39:44.483 ProcessImageName: ngentask.exe, Pid: 5724, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 25% 2026-09-28T03:39:44.483 ProcessImageName: powershell.exe, Pid: 2760, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-28T03:39:44.483 ProcessImageName: DeviceCensus.exe, Pid: 7240, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 2% 2026-09-28T03:39:44.483 ProcessImageName: mysqldump.exe, Pid: 2440, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-28T03:39:44.483 ProcessImageName: taskhostw.exe, Pid: 1824, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-28T03:39:44.483 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-28T03:46:23.812 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T03:46:23.812 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T03:46:23.812 [Cloud] Queued cloud request. 2026-09-28T03:46:23.812 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T03:46:23.812 [Cloud] Dequeued cloud request. 2026-09-28T03:46:23.812 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T03:46:24.000 [Cloud] End of cloud request. 2026-09-28T03:46:24.500 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T03:48:36.659 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T03:49:58.096 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T03:49:58.096 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T03:49:58.096 [Cloud] Queued cloud request. 2026-09-28T03:49:58.096 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T03:49:58.096 [Cloud] Dequeued cloud request. 2026-09-28T03:49:58.096 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T03:49:58.237 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BCE43868-D72A-89FD-2390-BB95B7EDF369} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 03:49:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T03:49:58.737 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T03:51:07.550 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T03:51:07.550 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T03:51:07.550 [Cloud] Queued cloud request. 2026-09-28T03:51:07.550 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T03:51:07.550 [Cloud] Dequeued cloud request. 2026-09-28T03:51:07.550 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T03:51:07.690 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A12497E8-4AD8-6092-986E-26330DA007FC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 03:51:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T03:51:08.190 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T03:55:13.128 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T03:55:13.128 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T03:55:13.128 [Cloud] Queued cloud request. 2026-09-28T03:55:13.128 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T03:55:13.128 [Cloud] Dequeued cloud request. 2026-09-28T03:55:13.128 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T03:55:13.285 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4C0037A3-0333-7449-FE2D-B09F3BB3EA17} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 03:55:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T03:55:13.785 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T04:03:02.945 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T04:03:02.945 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T04:03:02.945 [Cloud] Queued cloud request. 2026-09-28T04:03:02.945 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T04:03:02.945 [Cloud] Dequeued cloud request. 2026-09-28T04:03:02.945 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T04:03:03.135 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{01490D26-E261-0FFF-CB44-AA01F779CE09} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 04:03:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T04:03:03.648 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T04:03:41.664 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T04:07:25.056 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T04:07:25.056 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T04:07:25.056 [Cloud] Queued cloud request. 2026-09-28T04:07:25.056 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T04:07:25.056 [Cloud] Dequeued cloud request. 2026-09-28T04:07:25.056 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T04:07:25.243 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{45051CA1-2D8B-A651-5BDD-1106BCF9F376} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 04:07:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T04:07:25.743 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T04:13:01.151 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T04:13:01.151 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T04:13:01.151 [Cloud] Queued cloud request. 2026-09-28T04:13:01.151 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T04:13:01.151 [Cloud] Dequeued cloud request. 2026-09-28T04:13:01.151 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T04:13:01.354 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{09F4BC99-630A-D791-DC2E-AB44BF6B293A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 04:13:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T04:13:01.854 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T04:13:58.198 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T04:13:58.198 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T04:13:58.198 [Cloud] Queued cloud request. 2026-09-28T04:13:58.198 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T04:13:58.198 [Cloud] Dequeued cloud request. 2026-09-28T04:13:58.198 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T04:13:58.277 [Cloud] End of cloud request. 2026-09-28T04:13:58.792 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T04:18:46.671 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T04:19:55.624 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T04:19:55.624 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T04:19:55.624 [Cloud] Queued cloud request. 2026-09-28T04:19:55.624 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T04:19:55.718 [Cloud] Dequeued cloud request. 2026-09-28T04:19:55.718 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T04:19:55.859 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D326953E-CFA1-A0D7-A1A2-033E218114FC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 04:19:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T04:19:56.374 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T04:33:51.676 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T04:36:40.723 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T04:36:40.723 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T04:36:40.723 [Cloud] Queued cloud request. 2026-09-28T04:36:40.723 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T04:36:40.958 [Cloud] Dequeued cloud request. 2026-09-28T04:36:41.223 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T04:36:41.411 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AE52DEB0-5A48-651F-52AA-84D7264D2038} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 04:36:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T04:36:41.926 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T04:48:56.683 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T04:53:38.998 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T04:53:38.998 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T04:53:38.998 [Cloud] Queued cloud request. 2026-09-28T04:53:38.998 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T04:53:38.998 [Cloud] Dequeued cloud request. 2026-09-28T04:53:38.998 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T04:53:39.154 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{768D3E2A-7F3F-1E52-3037-723060E2D7B1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 04:53:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T04:53:39.654 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T04:59:20.141 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T04:59:20.141 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T04:59:20.141 [Cloud] Queued cloud request. 2026-09-28T04:59:20.141 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T04:59:20.359 [Cloud] Dequeued cloud request. 2026-09-28T04:59:20.359 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T04:59:20.953 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{30089EB4-785C-2072-6D54-0CF32BA00D39} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 04:59:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T04:59:21.469 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:00:25.063 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:00:25.063 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:00:25.063 [Cloud] Queued cloud request. 2026-09-28T05:00:25.063 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:00:25.063 [Cloud] Dequeued cloud request. 2026-09-28T05:00:25.063 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:00:25.954 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F3C36B9-7C52-A22E-93CC-EE73E9DFB5B2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 05:00:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T05:00:26.470 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:04:01.689 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T05:12:46.677 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:12:46.677 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:12:46.677 [Cloud] Queued cloud request. 2026-09-28T05:12:46.677 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:12:46.677 [Cloud] Dequeued cloud request. 2026-09-28T05:12:46.677 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:12:46.864 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7C589AA8-5EB4-E660-27C6-24212DAFBBB6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 05:12:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T05:12:47.364 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:13:14.708 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:13:14.708 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:13:14.708 [Cloud] Queued cloud request. 2026-09-28T05:13:14.708 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:13:14.708 [Cloud] Dequeued cloud request. 2026-09-28T05:13:14.708 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:13:14.786 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8267290-7E83-5A4A-2E20-33F0E8292111} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 05:13:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T05:13:15.286 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:19:06.696 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T05:24:16.165 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:24:16.165 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:24:16.165 [Cloud] Queued cloud request. 2026-09-28T05:24:16.165 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:24:16.165 [Cloud] Dequeued cloud request. 2026-09-28T05:24:16.165 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:24:16.431 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{22B2DB4B-9B9E-DA24-A7DF-C04C93CB2602} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 05:24:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T05:24:16.931 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:29:37.669 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:29:37.669 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:29:37.669 [Cloud] Queued cloud request. 2026-09-28T05:29:37.669 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:29:37.669 [Cloud] Dequeued cloud request. 2026-09-28T05:29:37.669 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:29:37.841 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{38A29C73-22B7-1D3F-CF93-F4B535C82085} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 05:29:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T05:29:38.357 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:29:44.169 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:29:44.169 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:29:44.169 [Cloud] Queued cloud request. 2026-09-28T05:29:44.169 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:29:44.169 [Cloud] Dequeued cloud request. 2026-09-28T05:29:44.169 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:29:44.279 [Cloud] End of cloud request. 2026-09-28T05:29:44.779 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:34:11.701 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T05:39:44.549 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 26124, Count: 1707, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-28T05:39:44.549 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 6140, Count: 559, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-28T05:39:44.549 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 5518, Count: 459, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-28T05:39:44.549 ProcessImageName: powershell.exe, Pid: 2768, TotalTime: 1583, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-28T05:39:44.549 ProcessImageName: AgentShellService.exe, Pid: 2664, TotalTime: 729, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-28T05:39:44.549 ProcessImageName: WmiPrvSE.exe, Pid: 6980, TotalTime: 631, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-28T05:39:44.549 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 423, Count: 31, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-28T05:39:44.549 ProcessImageName: WmiPrvSE.exe, Pid: 6992, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-28T05:39:44.549 ProcessImageName: python.exe, Pid: 2916, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 5% 2026-09-28T05:39:44.549 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-276f1-0.MAI, EstimatedImpact: 0% 2026-09-28T05:39:44.549 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-28T05:39:44.549 ProcessImageName: taskhostw.exe, Pid: 2888, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-28T05:39:44.549 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-28T05:39:44.549 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-28T05:39:44.549 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-28T05:39:44.549 ProcessImageName: powershell.exe, Pid: 7840, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp94EC.tmp, EstimatedImpact: 0% 2026-09-28T05:39:44.549 ProcessImageName: ngentask.exe, Pid: 5724, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 25% 2026-09-28T05:39:44.549 ProcessImageName: powershell.exe, Pid: 2760, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-28T05:39:44.549 ProcessImageName: DeviceCensus.exe, Pid: 7240, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 2% 2026-09-28T05:39:44.549 ProcessImageName: mysqldump.exe, Pid: 2440, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-28T05:39:44.549 ProcessImageName: taskhostw.exe, Pid: 1824, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-28T05:39:44.549 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-28T05:40:59.096 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:40:59.096 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:40:59.096 [Cloud] Queued cloud request. 2026-09-28T05:40:59.096 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:40:59.096 [Cloud] Dequeued cloud request. 2026-09-28T05:40:59.096 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:40:59.283 [Cloud] End of cloud request. 2026-09-28T05:40:59.783 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:41:08.814 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:41:08.814 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:41:08.814 [Cloud] Queued cloud request. 2026-09-28T05:41:08.814 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:41:08.814 [Cloud] Dequeued cloud request. 2026-09-28T05:41:08.814 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:41:08.908 [Cloud] End of cloud request. 2026-09-28T05:41:09.424 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:42:02.486 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:42:02.486 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:42:02.486 [Cloud] Queued cloud request. 2026-09-28T05:42:02.486 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:42:02.486 [Cloud] Dequeued cloud request. 2026-09-28T05:42:02.486 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:42:02.596 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3BD9FD94-4D8D-8A13-A491-CD5D44C4300D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 05:42:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T05:42:03.096 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:44:00.299 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:44:00.299 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:44:00.299 [Cloud] Queued cloud request. 2026-09-28T05:44:00.299 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:44:00.299 [Cloud] Dequeued cloud request. 2026-09-28T05:44:00.299 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:44:00.502 [Cloud] End of cloud request. 2026-09-28T05:44:01.002 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:44:09.361 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:44:09.361 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:44:09.361 [Cloud] Queued cloud request. 2026-09-28T05:44:09.361 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:44:09.361 [Cloud] Dequeued cloud request. 2026-09-28T05:44:09.361 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:44:09.783 [Cloud] End of cloud request. 2026-09-28T05:44:10.283 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:49:16.709 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T05:57:34.853 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:57:34.853 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:57:34.853 [Cloud] Queued cloud request. 2026-09-28T05:57:34.853 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:57:34.853 [Cloud] Dequeued cloud request. 2026-09-28T05:57:34.853 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:57:35.040 [Cloud] End of cloud request. 2026-09-28T05:57:35.556 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:59:03.744 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:59:03.744 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:59:03.744 [Cloud] Queued cloud request. 2026-09-28T05:59:03.744 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:59:03.744 [Cloud] Dequeued cloud request. 2026-09-28T05:59:03.744 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:59:03.932 [Cloud] End of cloud request. 2026-09-28T05:59:04.432 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T05:59:15.776 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T05:59:15.776 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T05:59:15.776 [Cloud] Queued cloud request. 2026-09-28T05:59:15.776 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T05:59:15.776 [Cloud] Dequeued cloud request. 2026-09-28T05:59:15.776 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T05:59:15.854 [Cloud] End of cloud request. 2026-09-28T05:59:16.354 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T06:04:21.715 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T06:07:57.077 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T06:07:57.077 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T06:07:57.077 [Cloud] Queued cloud request. 2026-09-28T06:07:57.077 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T06:07:57.077 [Cloud] Dequeued cloud request. 2026-09-28T06:07:57.077 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T06:07:57.264 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B46FE46C-0547-74D3-73AE-D2F89F47970D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 06:07:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T06:07:57.764 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T06:08:55.264 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T06:08:55.264 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T06:08:55.264 [Cloud] Queued cloud request. 2026-09-28T06:08:55.264 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T06:08:55.264 [Cloud] Dequeued cloud request. 2026-09-28T06:08:55.264 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T06:08:55.421 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CC7A9DBE-B45E-5422-6971-B1AEA86ABB9A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 06:08:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T06:08:55.936 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T06:13:29.953 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T06:13:29.953 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T06:13:29.953 [Cloud] Queued cloud request. 2026-09-28T06:13:29.953 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T06:13:29.953 [Cloud] Dequeued cloud request. 2026-09-28T06:13:30.172 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T06:13:30.359 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D679A953-7829-4FD9-7482-DF63ECE471EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 06:13:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T06:13:30.859 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T06:19:03.019 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T06:19:03.019 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T06:19:03.019 [Cloud] Queued cloud request. 2026-09-28T06:19:03.019 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T06:19:03.019 [Cloud] Dequeued cloud request. 2026-09-28T06:19:03.175 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T06:19:03.378 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D9DE64DC-C9FE-7F88-C498-4234692B046E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 06:19:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T06:19:03.878 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T06:19:26.722 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T06:32:14.179 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T06:32:14.179 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T06:32:14.179 [Cloud] Queued cloud request. 2026-09-28T06:32:14.179 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T06:32:14.179 [Cloud] Dequeued cloud request. 2026-09-28T06:32:14.179 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T06:32:14.398 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{26FB0587-7961-5F8B-6275-13E141F7AC2F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 06:32:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T06:32:14.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T06:34:31.727 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T06:37:04.368 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T06:37:04.368 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T06:37:04.368 [Cloud] Queued cloud request. 2026-09-28T06:37:04.368 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T06:37:04.368 [Cloud] Dequeued cloud request. 2026-09-28T06:37:04.368 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T06:37:04.509 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{198D832F-AA5D-A7F3-A3BB-5C723A850CBB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 06:37:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T06:37:05.025 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T06:49:36.735 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T06:53:03.971 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T06:53:03.971 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T06:53:03.971 [Cloud] Queued cloud request. 2026-09-28T06:53:03.971 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T06:53:03.971 [Cloud] Dequeued cloud request. 2026-09-28T06:53:03.971 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T06:53:04.158 [Cloud] End of cloud request. 2026-09-28T06:53:04.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T06:54:00.580 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T06:54:00.580 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T06:54:00.580 [Cloud] Queued cloud request. 2026-09-28T06:54:00.580 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T06:54:00.580 [Cloud] Dequeued cloud request. 2026-09-28T06:54:00.580 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T06:54:00.674 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5F05E029-55BD-8CE6-6A04-5676A6758140} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 06:54:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T06:54:01.174 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T07:03:48.053 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T07:03:48.053 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T07:03:48.053 [Cloud] Queued cloud request. 2026-09-28T07:03:48.053 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T07:03:48.053 [Cloud] Dequeued cloud request. 2026-09-28T07:03:48.053 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T07:03:48.334 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{050D5D71-987A-0C77-D01E-9EC0703AE4C1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 07:03:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T07:03:48.834 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T07:04:41.740 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T07:13:50.197 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T07:13:50.197 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T07:13:50.197 [Cloud] Queued cloud request. 2026-09-28T07:13:50.197 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T07:13:50.197 [Cloud] Dequeued cloud request. 2026-09-28T07:13:50.197 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T07:13:50.400 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{45B48BD2-5A59-09BF-E906-E94A0B03E2ED} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 07:13:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T07:13:50.900 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T07:15:36.964 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T07:15:36.964 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T07:15:36.964 [Cloud] Queued cloud request. 2026-09-28T07:15:36.964 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T07:15:36.964 [Cloud] Dequeued cloud request. 2026-09-28T07:15:37.121 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T07:15:37.277 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{45385A1B-540F-FE52-D7F2-289E914846DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 07:15:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T07:15:37.792 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T07:19:46.747 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T07:31:09.112 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T07:31:09.112 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T07:31:09.112 [Cloud] Queued cloud request. 2026-09-28T07:31:09.112 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T07:31:09.112 [Cloud] Dequeued cloud request. 2026-09-28T07:31:09.112 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T07:31:09.300 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BB6BFCF8-DFF8-54A5-055E-69A163ABA20F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 07:31:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T07:31:09.816 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T07:34:51.754 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T07:39:44.600 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 31785, Count: 2176, MaxTime: 421, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-28T07:39:44.600 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 7637, Count: 642, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-28T07:39:44.600 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 6140, Count: 559, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-28T07:39:44.600 ProcessImageName: powershell.exe, Pid: 2768, TotalTime: 1583, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-28T07:39:44.600 ProcessImageName: AgentShellService.exe, Pid: 2664, TotalTime: 729, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-28T07:39:44.600 ProcessImageName: WmiPrvSE.exe, Pid: 6980, TotalTime: 631, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-28T07:39:44.600 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 438, Count: 33, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-28T07:39:44.600 ProcessImageName: WmiPrvSE.exe, Pid: 6992, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-28T07:39:44.600 ProcessImageName: python.exe, Pid: 2916, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 5% 2026-09-28T07:39:44.600 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 64, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-276f1-0.MAI, EstimatedImpact: 0% 2026-09-28T07:39:44.600 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-28T07:39:44.600 ProcessImageName: taskhostw.exe, Pid: 2888, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-28T07:39:44.600 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-28T07:39:44.600 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-28T07:39:44.600 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-28T07:39:44.600 ProcessImageName: powershell.exe, Pid: 7840, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp94EC.tmp, EstimatedImpact: 0% 2026-09-28T07:39:44.600 ProcessImageName: ngentask.exe, Pid: 5724, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 25% 2026-09-28T07:39:44.600 ProcessImageName: powershell.exe, Pid: 2760, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-28T07:39:44.600 ProcessImageName: DeviceCensus.exe, Pid: 7240, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 2% 2026-09-28T07:39:44.600 ProcessImageName: mysqldump.exe, Pid: 2440, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-28T07:39:44.600 ProcessImageName: taskhostw.exe, Pid: 1824, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-28T07:39:44.600 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-28T07:46:11.102 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T07:46:11.102 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T07:46:11.102 [Cloud] Queued cloud request. 2026-09-28T07:46:11.102 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T07:46:11.102 [Cloud] Dequeued cloud request. 2026-09-28T07:46:11.102 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T07:46:17.086 [Cloud] End of cloud request. 2026-09-28T07:46:17.602 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T07:49:56.761 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T07:50:15.777 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T07:50:15.777 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T07:50:15.777 [Cloud] Queued cloud request. 2026-09-28T07:50:15.777 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T07:50:15.777 [Cloud] Dequeued cloud request. 2026-09-28T07:50:15.777 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T07:50:16.698 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E2B2A81-5B6F-755F-21B8-78142B67BF74} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 07:50:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T07:50:17.214 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T08:05:01.766 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T08:07:53.269 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T08:07:53.269 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T08:07:53.269 [Cloud] Queued cloud request. 2026-09-28T08:07:53.269 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T08:07:53.269 [Cloud] Dequeued cloud request. 2026-09-28T08:07:53.269 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T08:08:14.816 [Cloud] End of cloud request. 2026-09-28T08:08:15.316 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T08:20:06.775 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T08:23:32.087 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T08:23:32.087 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T08:23:32.087 [Cloud] Queued cloud request. 2026-09-28T08:23:32.087 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T08:23:32.087 [Cloud] Dequeued cloud request. 2026-09-28T08:23:32.087 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T08:23:32.337 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7FBC71B1-E961-D735-13EB-843BA724257E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 08:23:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T08:23:32.853 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T08:30:32.060 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T08:30:32.060 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T08:30:32.060 [Cloud] Queued cloud request. 2026-09-28T08:30:32.060 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T08:30:32.060 [Cloud] Dequeued cloud request. 2026-09-28T08:30:32.060 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T08:30:39.326 [Cloud] End of cloud request. 2026-09-28T08:30:39.841 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T08:32:55.826 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T08:32:55.826 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T08:32:55.826 [Cloud] Queued cloud request. 2026-09-28T08:32:55.826 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T08:32:55.826 [Cloud] Dequeued cloud request. 2026-09-28T08:32:55.826 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T08:32:56.357 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2081F796-0AE7-734E-0391-E5F3AA46B2F5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 08:32:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T08:32:56.857 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T08:32:59.935 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T08:32:59.935 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T08:32:59.935 [Cloud] Queued cloud request. 2026-09-28T08:32:59.935 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T08:32:59.935 [Cloud] Dequeued cloud request. 2026-09-28T08:32:59.935 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T08:33:00.044 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3289417B-E9DC-4CE2-6537-BA77518EAE1E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 08:33:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T08:33:00.544 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T08:35:11.779 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T08:39:55.158 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T08:39:55.158 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T08:39:55.158 [Cloud] Queued cloud request. 2026-09-28T08:39:55.158 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T08:39:55.158 [Cloud] Dequeued cloud request. 2026-09-28T08:39:55.158 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T08:39:55.315 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8F5E7024-6C80-F32D-653C-94C68F5CC445} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 08:39:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T08:39:55.815 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T08:50:16.788 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{B4ED7664-857E-3FB1-72F8-4E6F3A164737} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-28-2026 08:55:33 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T08:55:34.710 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T08:55:34.710 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T08:55:34.710 [Cloud] Queued cloud request. 2026-09-28T08:55:34.710 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T08:55:34.710 [Cloud] Dequeued cloud request. 2026-09-28T08:55:34.710 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T08:55:35.163 [Cloud] End of cloud request. 2026-09-28T08:55:35.663 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T08:56:20.447 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T08:56:20.447 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T08:56:20.447 [Cloud] Queued cloud request. 2026-09-28T08:56:20.447 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T08:56:20.447 [Cloud] Dequeued cloud request. 2026-09-28T08:56:20.447 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T08:56:20.525 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6467A01F-8E7E-FCA4-0E5D-2276EE08E058} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 08:56:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T08:56:21.040 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T09:05:21.795 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T09:06:23.311 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T09:06:23.311 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T09:06:23.311 [Cloud] Queued cloud request. 2026-09-28T09:06:23.311 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T09:06:23.311 [Cloud] Dequeued cloud request. 2026-09-28T09:06:23.311 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T09:06:23.467 [Cloud] End of cloud request. 2026-09-28T09:06:23.967 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T09:13:19.346 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T09:13:19.346 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T09:13:19.346 [Cloud] Queued cloud request. 2026-09-28T09:13:19.346 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T09:13:19.346 [Cloud] Dequeued cloud request. 2026-09-28T09:13:19.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T09:13:27.268 [Cloud] End of cloud request. 2026-09-28T09:13:27.768 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T09:20:26.803 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T09:21:02.224 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T09:21:02.224 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T09:21:02.224 [Cloud] Queued cloud request. 2026-09-28T09:21:02.224 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T09:21:02.318 [Cloud] Dequeued cloud request. 2026-09-28T09:21:02.318 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T09:21:02.506 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A265EC40-19DF-68F1-838F-6C6C93E40AB7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 09:21:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T09:21:03.006 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T09:27:10.399 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T09:27:10.399 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T09:27:10.399 [Cloud] Queued cloud request. 2026-09-28T09:27:10.399 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T09:27:10.399 [Cloud] Dequeued cloud request. 2026-09-28T09:27:10.399 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T09:27:10.587 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{69ED09C6-A66B-E948-6AE3-0506686223EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 09:27:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T09:27:11.087 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T09:31:44.135 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T09:31:44.135 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T09:31:44.135 [Cloud] Queued cloud request. 2026-09-28T09:31:44.135 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T09:31:44.135 [Cloud] Dequeued cloud request. 2026-09-28T09:31:44.135 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T09:31:44.292 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3F2F6F06-2B03-6A21-C125-442F3CF84F27} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 09:31:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T09:31:44.807 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T09:35:10.651 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T09:35:10.651 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T09:35:10.651 [Cloud] Queued cloud request. 2026-09-28T09:35:10.651 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T09:35:10.651 [Cloud] Dequeued cloud request. 2026-09-28T09:35:10.651 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T09:35:10.807 [Cloud] End of cloud request. 2026-09-28T09:35:11.307 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T09:35:23.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T09:35:23.088 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T09:35:23.088 [Cloud] Queued cloud request. 2026-09-28T09:35:23.088 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T09:35:23.088 [Cloud] Dequeued cloud request. 2026-09-28T09:35:23.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T09:35:23.167 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3603A20C-561D-ADE3-6EB6-EAA45EF19348} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 09:35:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T09:35:23.682 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T09:35:31.807 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T09:37:40.170 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T09:37:40.170 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T09:37:40.170 [Cloud] Queued cloud request. 2026-09-28T09:37:40.170 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T09:37:40.170 [Cloud] Dequeued cloud request. 2026-09-28T09:37:40.170 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T09:37:40.326 [Cloud] End of cloud request. 2026-09-28T09:37:40.842 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T09:39:44.671 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 34552, Count: 2252, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\js\jquery.js, EstimatedImpact: 0% 2026-09-28T09:39:44.671 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 9759, Count: 823, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-28T09:39:44.671 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 6140, Count: 559, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-28T09:39:44.671 ProcessImageName: powershell.exe, Pid: 2768, TotalTime: 1583, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-28T09:39:44.671 ProcessImageName: AgentShellService.exe, Pid: 2664, TotalTime: 729, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-28T09:39:44.671 ProcessImageName: WmiPrvSE.exe, Pid: 6980, TotalTime: 631, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-28T09:39:44.671 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 498, Count: 37, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-28T09:39:44.671 ProcessImageName: WmiPrvSE.exe, Pid: 6992, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-28T09:39:44.671 ProcessImageName: python.exe, Pid: 2916, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 5% 2026-09-28T09:39:44.671 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-276f1-0.MAI, EstimatedImpact: 0% 2026-09-28T09:39:44.671 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-28T09:39:44.671 ProcessImageName: taskhostw.exe, Pid: 2888, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-28T09:39:44.671 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-28T09:39:44.671 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-28T09:39:44.671 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-28T09:39:44.671 ProcessImageName: powershell.exe, Pid: 7840, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp94EC.tmp, EstimatedImpact: 0% 2026-09-28T09:39:44.671 ProcessImageName: ngentask.exe, Pid: 5724, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 25% 2026-09-28T09:39:44.671 ProcessImageName: powershell.exe, Pid: 2760, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-28T09:39:44.671 ProcessImageName: DeviceCensus.exe, Pid: 7240, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 2% 2026-09-28T09:39:44.671 ProcessImageName: mysqldump.exe, Pid: 2440, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-28T09:39:44.671 ProcessImageName: taskhostw.exe, Pid: 1824, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-28T09:39:44.671 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-28T09:43:26.140 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T09:43:26.140 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T09:43:26.140 [Cloud] Queued cloud request. 2026-09-28T09:43:26.140 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T09:43:26.140 [Cloud] Dequeued cloud request. 2026-09-28T09:43:26.140 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T09:43:26.328 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B5657D8C-F59B-72F7-A07A-77B9B2D55177} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 09:43:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T09:43:26.843 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T09:50:36.816 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T09:57:19.412 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T09:57:19.412 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T09:57:19.412 [Cloud] Queued cloud request. 2026-09-28T09:57:19.412 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T09:57:19.584 [Cloud] Dequeued cloud request. 2026-09-28T09:57:19.584 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T09:57:19.789 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{14DFC4AE-C23B-92C9-ECBC-D7C1BC414444} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 09:57:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T09:57:20.303 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T10:01:24.259 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T10:01:24.259 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T10:01:24.259 [Cloud] Queued cloud request. 2026-09-28T10:01:24.259 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T10:01:24.259 [Cloud] Dequeued cloud request. 2026-09-28T10:01:24.259 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T10:01:24.431 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{20E53DC9-9CA1-8BBD-666D-B2E7510F4AF8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 10:01:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T10:01:24.946 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T10:05:41.823 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T10:20:46.832 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T10:33:06.868 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T10:33:06.868 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T10:33:06.868 [Cloud] Queued cloud request. 2026-09-28T10:33:06.868 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T10:33:06.868 [Cloud] Dequeued cloud request. 2026-09-28T10:33:06.868 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T10:33:07.056 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{45515CFB-8D8C-0A77-8FF0-DFBD4886CF5A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 10:33:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T10:33:07.556 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T10:35:51.837 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T10:45:02.607 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T10:45:02.607 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T10:45:02.607 [Cloud] Queued cloud request. 2026-09-28T10:45:02.607 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T10:45:02.607 [Cloud] Dequeued cloud request. 2026-09-28T10:45:02.607 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T10:45:03.138 [Cloud] End of cloud request. 2026-09-28T10:45:03.638 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T10:50:56.846 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T10:51:03.908 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T10:51:03.908 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T10:51:03.908 [Cloud] Queued cloud request. 2026-09-28T10:51:03.908 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T10:51:03.908 [Cloud] Dequeued cloud request. 2026-09-28T10:51:03.908 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T10:51:04.080 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{97A79CE2-43C1-89AE-24BD-39510DA432F6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 10:51:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T10:51:04.580 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T11:06:01.852 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T11:08:47.152 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T11:08:47.152 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T11:08:47.152 [Cloud] Queued cloud request. 2026-09-28T11:08:47.152 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T11:08:47.152 [Cloud] Dequeued cloud request. 2026-09-28T11:08:47.152 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T11:08:57.824 [Cloud] End of cloud request. 2026-09-28T11:08:58.340 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T11:21:06.861 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T11:24:27.892 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T11:24:27.892 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T11:24:27.892 [Cloud] Queued cloud request. 2026-09-28T11:24:27.892 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T11:24:27.892 [Cloud] Dequeued cloud request. 2026-09-28T11:24:27.892 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T11:24:28.126 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E0FF6907-ADF1-36BD-8D9D-72E6F3BA2064} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 11:24:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T11:24:28.642 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T11:30:19.990 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T11:30:19.990 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T11:30:19.990 [Cloud] Queued cloud request. 2026-09-28T11:30:19.990 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T11:30:19.990 [Cloud] Dequeued cloud request. 2026-09-28T11:30:19.990 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T11:30:20.146 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1C05F779-F9E4-460A-66A2-174236ABC5BF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 11:30:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T11:30:20.662 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T11:36:11.869 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T11:37:25.526 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T11:37:25.526 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T11:37:25.526 [Cloud] Queued cloud request. 2026-09-28T11:37:25.526 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T11:37:25.526 [Cloud] Dequeued cloud request. 2026-09-28T11:37:25.526 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T11:37:25.729 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8FAC4A7B-05CA-5EBE-0AFD-72FEFBEBE8C8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 11:37:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T11:37:26.245 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T11:39:44.745 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 35221, Count: 2293, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\js\jquery.js, EstimatedImpact: 0% 2026-09-28T11:39:44.745 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 11821, Count: 997, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-28T11:39:44.745 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 6140, Count: 559, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-28T11:39:44.745 ProcessImageName: powershell.exe, Pid: 2768, TotalTime: 1583, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-28T11:39:44.745 ProcessImageName: AgentShellService.exe, Pid: 2664, TotalTime: 729, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-28T11:39:44.745 ProcessImageName: WmiPrvSE.exe, Pid: 6980, TotalTime: 631, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-28T11:39:44.745 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 558, Count: 43, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-28T11:39:44.745 ProcessImageName: WmiPrvSE.exe, Pid: 6992, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-28T11:39:44.745 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 150, Count: 76, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-276f1-0.MAI, EstimatedImpact: 0% 2026-09-28T11:39:44.745 ProcessImageName: python.exe, Pid: 2916, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 5% 2026-09-28T11:39:44.745 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-28T11:39:44.745 ProcessImageName: taskhostw.exe, Pid: 2888, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-28T11:39:44.745 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-28T11:39:44.745 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-28T11:39:44.745 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-28T11:39:44.745 ProcessImageName: powershell.exe, Pid: 7840, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp94EC.tmp, EstimatedImpact: 0% 2026-09-28T11:39:44.745 ProcessImageName: ngentask.exe, Pid: 5724, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 25% 2026-09-28T11:39:44.745 ProcessImageName: powershell.exe, Pid: 2760, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-28T11:39:44.745 ProcessImageName: DeviceCensus.exe, Pid: 7240, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 2% 2026-09-28T11:39:44.745 ProcessImageName: mysqldump.exe, Pid: 2440, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-28T11:39:44.745 ProcessImageName: taskhostw.exe, Pid: 1824, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-28T11:39:44.745 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-28T11:51:16.875 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T12:06:21.882 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T12:13:01.167 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T12:13:01.167 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T12:13:01.167 [Cloud] Queued cloud request. 2026-09-28T12:13:01.167 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T12:13:01.167 [Cloud] Dequeued cloud request. 2026-09-28T12:13:01.167 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T12:13:01.370 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{650EDCCE-CFBA-DC21-1EC0-B2DED05A61DA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 12:13:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T12:13:01.870 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T12:21:26.890 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T12:22:53.656 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T12:22:53.656 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T12:22:53.656 [Cloud] Queued cloud request. 2026-09-28T12:22:53.656 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T12:22:53.828 [Cloud] Dequeued cloud request. 2026-09-28T12:22:53.828 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T12:22:54.047 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3424181B-C617-EAC1-307C-E9883BBDD7B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 12:22:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T12:22:54.547 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T12:26:25.190 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T12:26:25.190 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T12:26:25.190 [Cloud] Queued cloud request. 2026-09-28T12:26:25.190 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T12:26:25.190 [Cloud] Dequeued cloud request. 2026-09-28T12:26:25.190 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T12:26:25.378 [Cloud] End of cloud request. 2026-09-28T12:26:25.878 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T12:27:10.331 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T12:27:10.331 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T12:27:10.331 [Cloud] Queued cloud request. 2026-09-28T12:27:10.331 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T12:27:10.331 [Cloud] Dequeued cloud request. 2026-09-28T12:27:10.331 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T12:27:10.503 [Cloud] End of cloud request. 2026-09-28T12:27:11.003 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T12:36:31.898 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T12:44:57.465 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T12:44:57.465 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T12:44:57.465 [Cloud] Queued cloud request. 2026-09-28T12:44:57.465 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T12:44:57.465 [Cloud] Dequeued cloud request. 2026-09-28T12:44:57.465 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T12:44:57.621 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A9E32D5C-BB6C-956F-64DA-2656EDC3CA3F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 12:44:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T12:44:58.121 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T12:46:23.090 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T12:46:23.090 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T12:46:23.090 [Cloud] Queued cloud request. 2026-09-28T12:46:23.090 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T12:46:23.090 [Cloud] Dequeued cloud request. 2026-09-28T12:46:23.090 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T12:46:23.246 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F3EC79C-E2D8-F554-2362-9C9B91783181} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 12:46:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T12:46:23.762 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T12:51:36.905 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T12:52:09.561 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T12:52:09.561 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T12:52:09.561 [Cloud] Queued cloud request. 2026-09-28T12:52:09.561 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T12:52:09.561 [Cloud] Dequeued cloud request. 2026-09-28T12:52:09.561 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T12:52:09.796 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A3195693-E7FB-C6C3-EFE7-4A7B2E9CF7DF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 12:52:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T12:52:10.296 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T12:55:33.281 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T12:55:33.281 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T12:55:33.281 [Cloud] Queued cloud request. 2026-09-28T12:55:33.281 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T12:55:33.281 [Cloud] Dequeued cloud request. 2026-09-28T12:55:33.281 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T12:55:33.484 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AEAE06F8-1A4E-2786-10D7-F4A6ED5F231A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 12:55:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T12:55:34.000 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T12:55:44.797 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T12:55:44.797 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T12:55:44.797 [Cloud] Queued cloud request. 2026-09-28T12:55:44.797 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T12:55:44.797 [Cloud] Dequeued cloud request. 2026-09-28T12:55:44.797 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T12:55:44.875 [Cloud] End of cloud request. 2026-09-28T12:55:45.375 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T12:57:04.094 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T12:57:04.094 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T12:57:04.094 [Cloud] Queued cloud request. 2026-09-28T12:57:04.094 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T12:57:04.094 [Cloud] Dequeued cloud request. 2026-09-28T12:57:04.094 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T12:57:04.297 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{94471EF7-BF11-F466-61BA-8D2481DA68EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 12:57:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T12:57:04.797 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T12:58:47.050 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T12:58:47.050 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T12:58:47.050 [Cloud] Queued cloud request. 2026-09-28T12:58:47.050 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T12:58:47.050 [Cloud] Dequeued cloud request. 2026-09-28T12:58:47.050 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T12:58:47.254 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0D890B09-2B76-E5B8-2E83-830294E7C7B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 12:58:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T12:58:47.754 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T13:00:34.644 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T13:00:34.644 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T13:00:34.644 [Cloud] Queued cloud request. 2026-09-28T13:00:34.644 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T13:00:34.644 [Cloud] Dequeued cloud request. 2026-09-28T13:00:34.644 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T13:00:34.847 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F5E044CD-9148-C339-A465-04CB7A848E2E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 13:00:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T13:00:35.363 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T13:06:10.382 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T13:06:10.382 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T13:06:10.382 [Cloud] Queued cloud request. 2026-09-28T13:06:10.382 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T13:06:10.538 [Cloud] Dequeued cloud request. 2026-09-28T13:06:10.538 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T13:06:10.726 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DD815D97-10CA-8F16-9892-14F4ADDB62AE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 13:06:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T13:06:11.226 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T13:06:41.913 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T13:10:17.243 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T13:10:17.243 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T13:10:17.243 [Cloud] Queued cloud request. 2026-09-28T13:10:17.243 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T13:10:17.243 [Cloud] Dequeued cloud request. 2026-09-28T13:10:17.243 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T13:10:17.540 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3F314324-A693-850D-6E92-853CCB2F0D3A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 13:10:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T13:10:18.055 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T13:11:36.868 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T13:11:36.868 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T13:11:36.868 [Cloud] Queued cloud request. 2026-09-28T13:11:36.868 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T13:11:36.868 [Cloud] Dequeued cloud request. 2026-09-28T13:11:36.868 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T13:11:37.055 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CE55E737-EEBA-6687-BF27-5964F26DFC8D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 13:11:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T13:11:37.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T13:14:17.260 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T13:14:17.260 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T13:14:17.260 [Cloud] Queued cloud request. 2026-09-28T13:14:17.260 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T13:14:17.260 [Cloud] Dequeued cloud request. 2026-09-28T13:14:17.260 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T13:14:17.448 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1ADF8DD1-0A7A-8D6B-48A4-CD051F30FA93} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 13:14:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T13:14:17.963 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T13:21:46.921 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T13:24:42.530 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T13:24:42.530 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T13:24:42.530 [Cloud] Queued cloud request. 2026-09-28T13:24:42.530 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T13:24:42.530 [Cloud] Dequeued cloud request. 2026-09-28T13:24:42.530 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T13:24:42.687 [Cloud] End of cloud request. 2026-09-28T13:24:43.187 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T13:32:32.049 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T13:32:32.049 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T13:32:32.049 [Cloud] Queued cloud request. 2026-09-28T13:32:32.049 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T13:32:32.049 [Cloud] Dequeued cloud request. 2026-09-28T13:32:32.049 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T13:32:32.190 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C5757BEB-AE4F-0A26-DECE-73E6E9255F3D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 13:32:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T13:32:32.706 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T13:32:36.393 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T13:32:36.393 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T13:32:36.393 [Cloud] Queued cloud request. 2026-09-28T13:32:36.393 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T13:32:36.393 [Cloud] Dequeued cloud request. 2026-09-28T13:32:36.393 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T13:32:36.487 [Cloud] End of cloud request. 2026-09-28T13:32:36.987 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T13:36:51.928 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T13:39:44.805 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 36284, Count: 2373, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\js\jquery.js, EstimatedImpact: 0% 2026-09-28T13:39:44.805 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 14008, Count: 1171, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-28T13:39:44.805 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 6140, Count: 559, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-28T13:39:44.805 ProcessImageName: powershell.exe, Pid: 2768, TotalTime: 1583, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-28T13:39:44.805 ProcessImageName: AgentShellService.exe, Pid: 2664, TotalTime: 729, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-28T13:39:44.805 ProcessImageName: WmiPrvSE.exe, Pid: 6980, TotalTime: 631, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-28T13:39:44.805 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 603, Count: 47, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-28T13:39:44.805 ProcessImageName: WmiPrvSE.exe, Pid: 6992, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-28T13:39:44.805 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 180, Count: 82, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-276f1-0.MAI, EstimatedImpact: 0% 2026-09-28T13:39:44.805 ProcessImageName: python.exe, Pid: 2916, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 5% 2026-09-28T13:39:44.805 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-28T13:39:44.805 ProcessImageName: taskhostw.exe, Pid: 2888, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-28T13:39:44.805 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-28T13:39:44.805 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-28T13:39:44.805 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-28T13:39:44.805 ProcessImageName: powershell.exe, Pid: 7840, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp94EC.tmp, EstimatedImpact: 0% 2026-09-28T13:39:44.805 ProcessImageName: ngentask.exe, Pid: 5724, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 25% 2026-09-28T13:39:44.805 ProcessImageName: powershell.exe, Pid: 2760, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-28T13:39:44.805 ProcessImageName: DeviceCensus.exe, Pid: 7240, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 2% 2026-09-28T13:39:44.805 ProcessImageName: mysqldump.exe, Pid: 2440, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-28T13:39:44.805 ProcessImageName: taskhostw.exe, Pid: 1824, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-28T13:39:44.805 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-28T13:47:33.308 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T13:47:33.308 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T13:47:33.308 [Cloud] Queued cloud request. 2026-09-28T13:47:33.308 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T13:47:33.308 [Cloud] Dequeued cloud request. 2026-09-28T13:47:33.308 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T13:47:33.465 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9FD16D2A-A4E0-9808-C8C3-12AE520D283A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 13:47:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T13:47:33.980 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T13:49:20.357 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T13:49:20.357 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T13:49:20.357 [Cloud] Queued cloud request. 2026-09-28T13:49:20.357 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T13:49:20.357 [Cloud] Dequeued cloud request. 2026-09-28T13:49:20.357 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T13:49:20.560 [Cloud] End of cloud request. 2026-09-28T13:49:21.076 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T13:51:56.935 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T13:59:31.737 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T13:59:31.737 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T13:59:31.737 [Cloud] Queued cloud request. 2026-09-28T13:59:31.737 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T13:59:31.737 [Cloud] Dequeued cloud request. 2026-09-28T13:59:31.737 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T13:59:32.190 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{14577E76-4186-2A22-2035-97776DD9D5BB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 13:59:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T13:59:32.706 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T14:01:00.378 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T14:01:00.378 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T14:01:00.378 [Cloud] Queued cloud request. 2026-09-28T14:01:00.378 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T14:01:00.378 [Cloud] Dequeued cloud request. 2026-09-28T14:01:00.378 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T14:01:00.549 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CF755503-B20A-1EFF-967E-915AB36EE28D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 14:01:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T14:01:01.065 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T14:07:01.943 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T14:19:24.622 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T14:19:24.622 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T14:19:24.622 [Cloud] Queued cloud request. 2026-09-28T14:19:24.622 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T14:19:24.622 [Cloud] Dequeued cloud request. 2026-09-28T14:19:24.622 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T14:19:24.794 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EABCCAC4-5F7E-B056-0F84-60EE164C6EC0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 14:19:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T14:19:25.294 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T14:22:06.950 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T14:32:27.064 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T14:32:27.064 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T14:32:27.064 [Cloud] Queued cloud request. 2026-09-28T14:32:27.064 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T14:32:27.064 [Cloud] Dequeued cloud request. 2026-09-28T14:32:27.064 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T14:32:27.221 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C7D02559-B552-99BF-A053-0B2DDDA76E54} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 14:32:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T14:32:27.736 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T14:37:11.958 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T14:52:16.965 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T14:55:32.623 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T14:55:32.623 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T14:55:32.623 [Cloud] Queued cloud request. 2026-09-28T14:55:32.623 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T14:55:32.623 [Cloud] Dequeued cloud request. 2026-09-28T14:55:32.623 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T14:55:42.186 [Cloud] End of cloud request. 2026-09-28T14:55:42.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T14:59:24.001 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T14:59:24.001 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T14:59:24.001 [Cloud] Queued cloud request. 2026-09-28T14:59:24.001 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T14:59:24.001 [Cloud] Dequeued cloud request. 2026-09-28T14:59:24.001 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T14:59:24.188 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E834A97-18F5-A71C-6D7E-AD1E80911E69} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 14:59:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T14:59:24.688 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:02:10.438 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:02:10.438 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:02:10.438 [Cloud] Queued cloud request. 2026-09-28T15:02:10.438 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:02:10.438 [Cloud] Dequeued cloud request. 2026-09-28T15:02:10.438 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:02:10.626 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4479969D-92F7-6BA7-A36F-0D617DC756F9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 15:02:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T15:02:11.126 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:07:21.974 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T15:13:16.929 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:13:16.929 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:13:16.929 [Cloud] Queued cloud request. 2026-09-28T15:13:16.929 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:13:16.929 [Cloud] Dequeued cloud request. 2026-09-28T15:13:16.929 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:13:17.179 [Cloud] End of cloud request. 2026-09-28T15:13:17.679 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:15:15.991 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:15:15.991 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:15:15.991 [Cloud] Queued cloud request. 2026-09-28T15:15:15.991 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:15:15.991 [Cloud] Dequeued cloud request. 2026-09-28T15:15:15.991 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:15:16.132 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E724F19C-029C-052F-7EFA-D72E0B1030FC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 15:15:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T15:15:16.632 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:16:59.431 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:16:59.431 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:16:59.431 [Cloud] Queued cloud request. 2026-09-28T15:16:59.431 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:16:59.431 [Cloud] Dequeued cloud request. 2026-09-28T15:16:59.431 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:16:59.587 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{57B39C64-5CAA-A869-495D-CA1C5D879A43} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 15:16:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T15:17:00.087 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:17:27.307 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:17:27.307 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:17:27.307 [Cloud] Queued cloud request. 2026-09-28T15:17:27.307 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:17:27.307 [Cloud] Dequeued cloud request. 2026-09-28T15:17:27.307 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:17:27.385 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7E4FA5FF-754A-3339-083D-03152E050F56} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 15:17:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T15:17:27.885 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:18:13.479 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:18:13.479 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:18:13.479 [Cloud] Queued cloud request. 2026-09-28T15:18:13.479 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:18:13.479 [Cloud] Dequeued cloud request. 2026-09-28T15:18:13.479 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:18:13.573 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{02B43CF3-9858-E8EF-01A9-6C47F7156F0C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 15:18:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T15:18:14.073 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:19:03.229 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:19:03.229 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:19:03.229 [Cloud] Queued cloud request. 2026-09-28T15:19:03.229 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:19:03.229 [Cloud] Dequeued cloud request. 2026-09-28T15:19:03.229 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:19:03.308 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E2DD6299-322A-208B-4056-25F9639D84D7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 15:19:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T15:19:03.823 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:19:38.683 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:19:38.683 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:19:38.683 [Cloud] Queued cloud request. 2026-09-28T15:19:38.683 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:19:38.683 [Cloud] Dequeued cloud request. 2026-09-28T15:19:38.683 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:19:38.761 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B53C5B76-2B5D-B94A-49AE-C853C5903A10} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 15:19:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T15:19:39.276 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:22:26.981 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T15:24:20.420 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:24:20.420 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:24:20.420 [Cloud] Queued cloud request. 2026-09-28T15:24:20.420 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:24:20.420 [Cloud] Dequeued cloud request. 2026-09-28T15:24:20.420 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:24:20.607 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{550A31EE-6728-0340-3DE9-CBB9306CA435} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 15:24:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T15:24:21.107 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:33:42.392 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:33:42.392 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:33:42.392 [Cloud] Queued cloud request. 2026-09-28T15:33:42.392 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:33:42.392 [Cloud] Dequeued cloud request. 2026-09-28T15:33:42.392 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:33:42.595 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E11AC046-41EE-C3E7-5BFC-FE7A99463845} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 15:33:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T15:33:43.111 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:37:31.989 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T15:39:44.881 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 36987, Count: 2409, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\js\jquery.js, EstimatedImpact: 0% 2026-09-28T15:39:44.881 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 16289, Count: 1347, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-28T15:39:44.881 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 6140, Count: 559, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-28T15:39:44.881 ProcessImageName: powershell.exe, Pid: 2768, TotalTime: 1583, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-28T15:39:44.881 ProcessImageName: AgentShellService.exe, Pid: 2664, TotalTime: 729, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-28T15:39:44.881 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 678, Count: 53, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-28T15:39:44.881 ProcessImageName: WmiPrvSE.exe, Pid: 6980, TotalTime: 631, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-28T15:39:44.881 ProcessImageName: WmiPrvSE.exe, Pid: 6992, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-28T15:39:44.881 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 180, Count: 82, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-276f1-0.MAI, EstimatedImpact: 0% 2026-09-28T15:39:44.881 ProcessImageName: python.exe, Pid: 2916, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 5% 2026-09-28T15:39:44.881 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-28T15:39:44.881 ProcessImageName: taskhostw.exe, Pid: 2888, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-28T15:39:44.881 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 60, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-28T15:39:44.881 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-28T15:39:44.881 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-28T15:39:44.881 ProcessImageName: powershell.exe, Pid: 7840, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp94EC.tmp, EstimatedImpact: 0% 2026-09-28T15:39:44.881 ProcessImageName: ngentask.exe, Pid: 5724, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 25% 2026-09-28T15:39:44.881 ProcessImageName: powershell.exe, Pid: 2760, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-28T15:39:44.881 ProcessImageName: DeviceCensus.exe, Pid: 7240, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 2% 2026-09-28T15:39:44.881 ProcessImageName: mysqldump.exe, Pid: 2440, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-28T15:39:44.881 ProcessImageName: taskhostw.exe, Pid: 1824, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-28T15:39:44.881 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-28T15:44:49.318 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:44:49.318 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:44:49.318 [Cloud] Queued cloud request. 2026-09-28T15:44:49.318 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:44:49.318 [Cloud] Dequeued cloud request. 2026-09-28T15:44:49.318 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:44:59.443 [Cloud] End of cloud request. 2026-09-28T15:44:59.943 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:49:25.713 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:49:25.713 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:49:25.713 [Cloud] Queued cloud request. 2026-09-28T15:49:25.713 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:49:25.713 [Cloud] Dequeued cloud request. 2026-09-28T15:49:25.713 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:49:25.854 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{92871C9B-FA8D-72EE-FB40-855E1FAE038E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 15:49:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T15:49:26.354 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T15:52:36.994 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T15:58:27.546 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T15:58:27.546 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T15:58:27.546 [Cloud] Queued cloud request. 2026-09-28T15:58:27.546 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T15:58:27.546 [Cloud] Dequeued cloud request. 2026-09-28T15:58:27.546 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T15:58:27.687 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E23332AD-79E4-068F-643F-688456848533} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 15:58:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T15:58:28.187 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T16:05:27.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T16:05:27.657 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T16:05:27.657 [Cloud] Queued cloud request. 2026-09-28T16:05:27.657 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T16:05:27.657 [Cloud] Dequeued cloud request. 2026-09-28T16:05:27.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T16:05:28.688 [Cloud] End of cloud request. 2026-09-28T16:05:29.204 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T16:07:42.004 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T16:19:55.244 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T16:19:55.244 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T16:19:55.244 [Cloud] Queued cloud request. 2026-09-28T16:19:55.244 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T16:19:55.244 [Cloud] Dequeued cloud request. 2026-09-28T16:19:55.244 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T16:19:55.431 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{889678E5-874E-5AE9-1743-07AA4E8B5FFB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 16:19:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T16:19:55.931 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T16:22:47.009 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T16:23:26.150 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T16:23:26.150 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T16:23:26.150 [Cloud] Queued cloud request. 2026-09-28T16:23:26.150 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T16:23:26.150 [Cloud] Dequeued cloud request. 2026-09-28T16:23:26.150 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T16:23:26.337 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{184A178B-0DC0-BD64-FA42-718BB9D07121} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 16:23:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T16:23:26.838 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T16:24:38.370 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T16:24:38.370 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T16:24:38.370 [Cloud] Queued cloud request. 2026-09-28T16:24:38.370 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T16:24:38.370 [Cloud] Dequeued cloud request. 2026-09-28T16:24:38.370 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T16:24:38.605 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9BC8DC91-7F21-6012-1C6C-B4ED2F0B7339} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 16:24:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T16:24:39.105 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T16:26:47.701 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T16:26:47.701 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T16:26:47.701 [Cloud] Queued cloud request. 2026-09-28T16:26:47.701 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T16:26:47.701 [Cloud] Dequeued cloud request. 2026-09-28T16:26:47.701 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T16:26:47.888 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3EC641AC-45AA-DA79-41CB-B876443B6797} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 16:26:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T16:26:48.388 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T16:27:45.983 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T16:27:45.983 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T16:27:45.983 [Cloud] Queued cloud request. 2026-09-28T16:27:45.983 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T16:27:45.983 [Cloud] Dequeued cloud request. 2026-09-28T16:27:45.983 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T16:27:46.061 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{48F75AEF-6444-4903-B388-742D034F1FA7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 16:27:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T16:27:46.561 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T16:33:55.517 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T16:33:55.517 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T16:33:55.517 [Cloud] Queued cloud request. 2026-09-28T16:33:55.517 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T16:33:55.517 [Cloud] Dequeued cloud request. 2026-09-28T16:33:55.517 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T16:33:55.673 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5BBCD2BA-7B74-5EDD-AB8F-0C93005AD064} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 16:33:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T16:33:56.173 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T16:36:51.924 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T16:36:51.924 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T16:36:51.924 [Cloud] Queued cloud request. 2026-09-28T16:36:51.924 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T16:36:51.924 [Cloud] Dequeued cloud request. 2026-09-28T16:36:51.924 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T16:36:52.065 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0107BCFD-A188-B64D-B322-4ACA7B0C018D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 16:36:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T16:36:52.565 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T16:37:26.565 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T16:37:26.565 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T16:37:26.565 [Cloud] Queued cloud request. 2026-09-28T16:37:26.565 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T16:37:26.565 [Cloud] Dequeued cloud request. 2026-09-28T16:37:26.565 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T16:37:36.581 [Cloud] End of cloud request. 2026-09-28T16:37:37.081 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T16:37:52.019 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T16:52:57.025 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T16:58:39.139 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T16:58:39.139 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T16:58:39.139 [Cloud] Queued cloud request. 2026-09-28T16:58:39.139 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T16:58:39.139 [Cloud] Dequeued cloud request. 2026-09-28T16:58:39.139 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T16:58:39.295 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5B299788-7884-6297-DE21-76268D34A3F0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 16:58:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T16:58:39.810 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T17:05:42.047 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T17:05:42.047 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T17:05:42.047 [Cloud] Queued cloud request. 2026-09-28T17:05:42.047 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T17:05:42.047 [Cloud] Dequeued cloud request. 2026-09-28T17:05:42.047 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T17:05:42.531 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EB6C1F1B-1D99-360E-267D-C021CE4C0BE8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 17:05:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T17:05:43.047 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T17:08:02.034 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T17:13:53.207 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T17:13:53.207 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T17:13:53.207 [Cloud] Queued cloud request. 2026-09-28T17:13:53.207 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T17:13:53.207 [Cloud] Dequeued cloud request. 2026-09-28T17:13:53.207 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T17:13:53.348 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9FD413B1-B119-2A56-72CC-74757BD44B9D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 17:13:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T17:13:53.864 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T17:17:12.820 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T17:17:12.820 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T17:17:12.820 [Cloud] Queued cloud request. 2026-09-28T17:17:12.820 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T17:17:12.820 [Cloud] Dequeued cloud request. 2026-09-28T17:17:12.820 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T17:17:12.960 [Cloud] End of cloud request. 2026-09-28T17:17:13.476 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T17:23:07.041 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T17:25:49.916 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T17:25:49.916 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T17:25:49.916 [Cloud] Queued cloud request. 2026-09-28T17:25:49.916 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T17:25:49.916 [Cloud] Dequeued cloud request. 2026-09-28T17:25:49.916 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T17:25:50.088 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8CDDE00C-BF0E-C359-AA35-6160D9D535F5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 17:25:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T17:25:50.588 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T17:26:25.996 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T17:26:25.996 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T17:26:25.996 [Cloud] Queued cloud request. 2026-09-28T17:26:25.996 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T17:26:25.996 [Cloud] Dequeued cloud request. 2026-09-28T17:26:25.996 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T17:26:26.090 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1649AA75-8A5B-8092-6BC7-8264CC4081BD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 17:26:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T17:26:26.590 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T17:34:57.016 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T17:34:57.016 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T17:34:57.016 [Cloud] Queued cloud request. 2026-09-28T17:34:57.016 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T17:34:57.016 [Cloud] Dequeued cloud request. 2026-09-28T17:34:57.016 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T17:34:57.156 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CEA99594-AE1C-BF8A-A6F4-67579931311E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 17:34:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T17:34:57.657 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T17:38:12.049 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T17:39:44.955 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 38011, Count: 2467, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\js\jquery.js, EstimatedImpact: 0% 2026-09-28T17:39:44.955 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 18583, Count: 1524, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-28T17:39:44.955 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 6140, Count: 559, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-28T17:39:44.955 ProcessImageName: powershell.exe, Pid: 2768, TotalTime: 1583, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-28T17:39:44.955 ProcessImageName: AgentShellService.exe, Pid: 2664, TotalTime: 729, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-28T17:39:44.955 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 693, Count: 55, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-28T17:39:44.955 ProcessImageName: WmiPrvSE.exe, Pid: 6980, TotalTime: 631, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-28T17:39:44.955 ProcessImageName: WmiPrvSE.exe, Pid: 6992, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-28T17:39:44.955 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 180, Count: 86, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-276f1-0.MAI, EstimatedImpact: 0% 2026-09-28T17:39:44.955 ProcessImageName: python.exe, Pid: 2916, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 5% 2026-09-28T17:39:44.955 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-28T17:39:44.955 ProcessImageName: taskhostw.exe, Pid: 2888, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-28T17:39:44.955 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 60, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-28T17:39:44.955 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-28T17:39:44.955 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-28T17:39:44.955 ProcessImageName: powershell.exe, Pid: 7840, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp94EC.tmp, EstimatedImpact: 0% 2026-09-28T17:39:44.955 ProcessImageName: ngentask.exe, Pid: 5724, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 25% 2026-09-28T17:39:44.955 ProcessImageName: powershell.exe, Pid: 2760, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-28T17:39:44.955 ProcessImageName: DeviceCensus.exe, Pid: 7240, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 2% 2026-09-28T17:39:44.955 ProcessImageName: mysqldump.exe, Pid: 2440, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\share\charsets\Index.xml, EstimatedImpact: 10% 2026-09-28T17:39:44.955 ProcessImageName: taskhostw.exe, Pid: 1824, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 6% 2026-09-28T17:39:44.955 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-28T17:48:29.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T17:48:29.445 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T17:48:29.445 [Cloud] Queued cloud request. 2026-09-28T17:48:29.445 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T17:48:29.445 [Cloud] Dequeued cloud request. 2026-09-28T17:48:29.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T17:48:29.679 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A6FACF14-7EBE-E83A-5008-6202988582C9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 17:48:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T17:48:30.195 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T17:50:13.226 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T17:50:13.226 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T17:50:13.226 [Cloud] Queued cloud request. 2026-09-28T17:50:13.226 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T17:50:13.226 [Cloud] Dequeued cloud request. 2026-09-28T17:50:13.226 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T17:50:13.398 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25F5FAF9-F7D9-0C54-45A8-888EE0BB3A29} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 17:50:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T17:50:13.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T17:53:17.054 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T17:59:52.715 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T17:59:52.715 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T17:59:52.715 [Cloud] Queued cloud request. 2026-09-28T17:59:52.715 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T17:59:52.715 [Cloud] Dequeued cloud request. 2026-09-28T17:59:52.715 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T17:59:52.903 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{053578D7-801E-5F45-1C02-B92124FD328F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 17:59:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T17:59:53.418 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T18:02:08.545 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T18:02:08.545 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T18:02:08.545 [Cloud] Queued cloud request. 2026-09-28T18:02:08.545 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T18:02:08.545 [Cloud] Dequeued cloud request. 2026-09-28T18:02:08.545 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T18:02:18.670 [Cloud] End of cloud request. 2026-09-28T18:02:19.170 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T18:07:18.936 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T18:07:18.936 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T18:07:18.936 [Cloud] Queued cloud request. 2026-09-28T18:07:18.936 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T18:07:18.936 [Cloud] Dequeued cloud request. 2026-09-28T18:07:18.936 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T18:07:19.124 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{609D9FE5-BB38-1AD3-121B-76E5D47ED824} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 18:07:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T18:07:19.640 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T18:08:22.064 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T18:10:26.908 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T18:10:26.908 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T18:10:26.908 [Cloud] Queued cloud request. 2026-09-28T18:10:26.908 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T18:10:26.908 [Cloud] Dequeued cloud request. 2026-09-28T18:10:26.908 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T18:10:27.064 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C884728B-6C55-F64C-2E1E-A910A4533998} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 18:10:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T18:10:27.564 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T18:23:27.071 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T18:30:25.824 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T18:30:25.824 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T18:30:25.824 [Cloud] Queued cloud request. 2026-09-28T18:30:25.824 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T18:30:25.824 [Cloud] Dequeued cloud request. 2026-09-28T18:30:25.824 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T18:30:26.027 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A44477A1-AAD3-17BF-9235-E983730EDAF9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 18:30:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T18:30:26.527 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T18:36:15.061 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T18:36:15.061 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T18:36:15.061 [Cloud] Queued cloud request. 2026-09-28T18:36:15.061 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T18:36:15.061 [Cloud] Dequeued cloud request. 2026-09-28T18:36:15.061 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T18:36:15.264 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3D6B1B4B-9F50-DB25-7018-D4FF4DD5ADEF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 18:36:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T18:36:15.780 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T18:38:32.079 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T18:38:51.985 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T18:38:51.985 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T18:38:51.985 [Cloud] Queued cloud request. 2026-09-28T18:38:51.985 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T18:38:51.985 [Cloud] Dequeued cloud request. 2026-09-28T18:38:51.985 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T18:38:52.172 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CCADA111-C053-10CA-81A2-B9C6ACEC3AC3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 18:38:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T18:38:52.688 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T18:51:39.959 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T18:51:39.959 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T18:51:39.959 [Cloud] Queued cloud request. 2026-09-28T18:51:39.959 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T18:51:39.959 [Cloud] Dequeued cloud request. 2026-09-28T18:51:39.959 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T18:51:40.130 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{76942487-A2B3-5E9D-3923-1F0830383911} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 18:51:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T18:51:40.646 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T18:53:37.084 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T19:00:17.292 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:00:17.292 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:00:17.292 [Cloud] Queued cloud request. 2026-09-28T19:00:17.292 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:00:17.292 [Cloud] Dequeued cloud request. 2026-09-28T19:00:17.292 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:00:17.479 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C02025EA-2BA3-5B7D-AC9B-84706CB49D40} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 19:00:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T19:00:17.995 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:03:57.464 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:03:57.464 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:03:57.464 [Cloud] Queued cloud request. 2026-09-28T19:03:57.464 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:03:57.464 [Cloud] Dequeued cloud request. 2026-09-28T19:03:57.464 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:03:57.683 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{36B25319-87B7-6256-C2EC-9C0E70573629} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 19:03:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T19:03:58.199 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:08:42.094 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T19:17:59.364 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:17:59.364 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:17:59.364 [Cloud] Queued cloud request. 2026-09-28T19:17:59.364 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:17:59.364 [Cloud] Dequeued cloud request. 2026-09-28T19:17:59.364 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:17:59.567 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F4697159-3A0E-26D6-0741-BA4D0C5CE1DC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 19:17:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T19:18:00.067 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:23:47.098 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T19:24:13.630 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:24:13.630 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:24:13.630 [Cloud] Queued cloud request. 2026-09-28T19:24:13.630 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:24:13.630 [Cloud] Dequeued cloud request. 2026-09-28T19:24:13.630 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:24:15.145 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8980C463-38A7-45F9-AE14-881670542F08} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 19:24:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T19:24:15.646 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:24:25.286 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:24:25.286 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:24:25.286 [Cloud] Queued cloud request. 2026-09-28T19:24:25.286 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:24:25.286 [Cloud] Dequeued cloud request. 2026-09-28T19:24:25.286 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:24:25.364 [Cloud] End of cloud request. 2026-09-28T19:24:25.864 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:27:25.540 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:27:25.540 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:27:25.540 [Cloud] Queued cloud request. 2026-09-28T19:27:25.540 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:27:25.540 [Cloud] Dequeued cloud request. 2026-09-28T19:27:25.540 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:27:25.728 [Cloud] End of cloud request. 2026-09-28T19:27:26.244 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:32:28.963 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:32:28.963 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:32:28.963 [Cloud] Queued cloud request. 2026-09-28T19:32:28.963 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:32:29.119 [Cloud] Dequeued cloud request. 2026-09-28T19:32:29.119 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:32:29.291 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{055F8BB1-D0FF-E120-ED7D-86042A669CB1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 19:32:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T19:32:29.807 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:34:14.090 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:34:14.090 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:34:14.090 [Cloud] Queued cloud request. 2026-09-28T19:34:14.090 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:34:14.090 [Cloud] Dequeued cloud request. 2026-09-28T19:34:14.090 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:34:14.277 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{17CC7ED4-B213-A2F8-736D-80D4174AD5F1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 19:34:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T19:34:14.777 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:38:52.109 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T19:39:17.109 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-28T19:39:17.140 Job Notification: New process added to job (7484) 2026-09-28T19:39:17.140 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-28T19:39:17.140 Aggressive catchup quick scan threshold: 660092916745 / 25920000000000 2026-09-28T19:39:17.140 Job Notification: New process added to job (7508) 2026-09-28T19:39:17.156 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:7484] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:7508]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-28T19:39:17.265 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-28T19:39:17.265 Job Notification: New process added to job (5544) 2026-09-28T19:39:17.281 Job Notification: New process added to job (6188) 2026-09-28T19:39:17.327 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:5544] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:6188]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-28T19:39:17.452 Job Notification: New process added to job (6988) 2026-09-28T19:39:17.499 Task(GetDeviceTicket -AccessKey 5ED364D6-1F47-E162-171F-0E6FE5C81998 ) launched as network service 2026-09-28T19:39:17.656 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-28T19:39:17.656 [RTP] Duplicating the current plugin configuration object... 2026-09-28T19:39:17.656 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-28T19:39:17.656 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-28T19:39:17.656 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-28T19:39:17.656 [RTP] No config change detected. Not updating plugin configuration. 2026-09-28T19:39:17.656 [RTP] No config changes found. No configuration switch. 2026-09-28T19:39:17.656 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-28T19:39:18.046 Job Notification: Process exited from job (6988) 2026-09-28T19:39:18.202 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-28T19:39:18.202 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:39:18.202 [Cloud] Queued cloud request. 2026-09-28T19:39:18.202 [Cloud] Dequeued cloud request. 2026-09-28T19:39:18.202 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:39:18.390 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-28T19:39:18.390 [Cloud] End of cloud request. 2026-09-28T19:39:18.702 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:39:30.640 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\9B9E68C2-9989-4D07-B944-520A00D4C0FF7cc.1dd4f8112a01f57 2026-09-28T19:39:30.749 Verifying engine and signature files (source: 0) ... 2026-09-28T19:39:30.749 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094}\mpengine.dll] due to PPL. 2026-09-28T19:39:30.749 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094}\mpasbase.vdm]. File not in cache (0x1) 2026-09-28T19:39:31.734 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094}\mpasbase.vdm] 2026-09-28T19:39:31.734 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-28T19:39:31.781 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094}\mpasdlta.vdm] 2026-09-28T19:39:31.781 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094}\mpavbase.vdm]. File not in cache (0x1) 2026-09-28T19:39:32.187 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094}\mpavbase.vdm] 2026-09-28T19:39:32.187 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-28T19:39:32.202 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094}\mpavdlta.vdm] 2026-09-28T19:39:32.390 [Engine] IsHybridMode: 0 2026-09-28T19:39:32.390 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-28T19:39:32.406 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-41485201F353EDFB69855B2BBC2A507D21F7714F.bin): 0x00000002 2026-09-28T19:39:32.406 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-41485201F353EDFB69855B2BBC2A507D21F7714F.bin) 2026-09-28T19:39:32.406 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-28T19:39:32.406 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-28T19:39:32.406 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-28T19:39:32.406 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-28T19:39:44.234 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-28T19:39:44.234 [AutoExclusion] Applied roles from cache. 2026-09-28T19:39:44.234 [AutoExclusion] Started roles monitoring. 2026-09-28T19:39:44.327 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF68AB020, lRefCount: 6, hr=0 2026-09-28T19:39:44.327 [Engine] New active engine 00007FFCF4ABB020 replacing engine 00007FFCF68AB020. Number of active engines: 2 2026-09-28T19:39:44.359 EngineInit:Global ASOC is enabled 2026-09-28T19:39:44.359 EngineInit:ASOO is enabled for developer volumes 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.437 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-28T19:39:44.468 MpWriteUupSignatureVersion 1.459.447.0, hr = 0 2026-09-28T19:39:44.468 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-28T19:39:44.499 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-28T19:39:44.499 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-28T19:39:44.499 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-28T19:39:44.499 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-28T19:39:44.515 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-28T19:39:44.515 [Plugin] Initializing RTP plugin state... 2026-09-28T19:39:44.515 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-28T19:39:44.515 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎27‎-‎2026 21:39:44 Last Perf:‎09‎-‎27‎-‎2026 21:39:44 First RTP Scan:‎09‎-‎27‎-‎2026 21:39:44 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1366 Misses:7643 BM Queue:0,284,0 Proc:0,38,0 File:0,284,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:4868513 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:1073692822 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:4389 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:244566 TotalHits:2665989 InstanceCacheInserts:33559 InstanceCacheUpdates:0 InstanceCacheDeletes:18569 InstanceCacheHits:1204 InstanceCacheMisses:138554 InstanceCacheOverflows:12907 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:4ms (7245/1462) Success: 1462, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-28T19:39:44.515 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094} 2026-09-28T19:39:44.515 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8}\mpasbase.vdm in use, hr=0x80070020 2026-09-28T19:39:44.531 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F32A1E5C-41D8-49EB-8367-C2F8B2EB1284} removed 2026-09-28T19:39:44.531 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-28T19:39:44.531 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-28T19:39:44.531 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-28T19:39:44.531 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-28T19:39:44.531 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-28T19:39:44.531 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-28-2026 19:39:44 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-28-2026 19:39:44 2026-09-28T19:39:44.546 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-28T19:39:44.546 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-28T19:39:44.546 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-28T19:39:44.546 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-28T19:39:44.546 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:39:44.546 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-28T19:39:44.546 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-28T19:39:44.546 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-28T19:39:44.546 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-28T19:39:44.546 MdCoreSvc is supported in this platform and OS Signature updated on 09-28-2026 19:39:44 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.447.0 AV Signature Version: 1.459.447.0 ************************************************************ 2026-09-28T19:39:44.562 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-28T19:39:44.562 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\9B9E68C2-9989-4D07-B944-520A00D4C0FF7cc.1dd4f8112a01f57 2026-09-28T19:39:44.577 Process scan (postsignatureupdatescan) started. 2026-09-28T19:39:44.640 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-28T19:39:44.640 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 09-28-2026 19:39:44 ************************************************************ 2026-09-28T19:39:44.765 Job Notification: Process exited from job (5544) 2026-09-28T19:39:44.765 Job Notification: Process exited from job (6188) 2026-09-28T19:39:44.781 Job Notification: Process exited from job (7484) 2026-09-28T19:39:44.781 Job Notification: Process exited from job (7508) 2026-09-28T19:39:44.890 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-28T19:39:44.890 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-28T19:39:44.890 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-28T19:39:44.890 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-28T19:39:44.890 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-28T19:39:44.937 [Engine] Engine 00007FFCF68AB020 no longer in use. Number of active engines: 1 2026-09-28T19:39:44.937 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-28T19:39:44.937 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-28T19:39:44.984 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-28T19:39:44.984 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-28T19:39:44.984 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-28T19:39:45.640 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 39610, Count: 2594, MaxTime: 437, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\srh\js\jquery.js, EstimatedImpact: 0% 2026-09-28T19:39:45.640 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 20845, Count: 1694, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-28T19:39:45.640 ProcessImageName: AgentShell.exe, Pid: 7852, TotalTime: 6140, Count: 559, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-28T19:39:45.640 ProcessImageName: powershell.exe, Pid: 2768, TotalTime: 1583, Count: 107, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-28T19:39:45.640 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 829, Count: 65, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-09-28T19:39:45.640 ProcessImageName: AgentShellService.exe, Pid: 2664, TotalTime: 729, Count: 24, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 54% 2026-09-28T19:39:45.640 ProcessImageName: WmiPrvSE.exe, Pid: 6980, TotalTime: 631, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-28T19:39:45.640 ProcessImageName: WmiPrvSE.exe, Pid: 6992, TotalTime: 216, Count: 5, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-28T19:39:45.640 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 210, Count: 90, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-276f1-0.MAI, EstimatedImpact: 0% 2026-09-28T19:39:45.640 ProcessImageName: python.exe, Pid: 2916, TotalTime: 135, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\pkgs\distutils-precedence.pth, EstimatedImpact: 5% 2026-09-28T19:39:45.640 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 62, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-28T19:39:45.640 ProcessImageName: taskhostw.exe, Pid: 2888, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-28T19:39:45.640 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-28T19:39:45.702 [Engine] RSIG_UNLOADENGINE, 00007FFCF68AB020, err=0x0 2026-09-28T19:39:45.734 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1125BE5D-8254-4520-9825-A4672F1EA8E8} removed 2026-09-28T19:39:58.921 Process scan (postsignatureupdatescan) completed. 2026-09-28T19:42:25.796 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:42:25.796 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:42:25.796 [Cloud] Queued cloud request. 2026-09-28T19:42:25.796 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:42:25.796 [Cloud] Dequeued cloud request. 2026-09-28T19:42:25.796 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:42:25.968 [Cloud] End of cloud request. 2026-09-28T19:42:26.468 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:44:44.390 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-28T19:45:41.609 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:45:41.609 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:45:41.609 [Cloud] Queued cloud request. 2026-09-28T19:45:41.609 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:45:41.766 [Cloud] Dequeued cloud request. 2026-09-28T19:45:41.922 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:45:42.078 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EA5C239A-EB18-4578-5518-476287A94ABB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 19:45:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T19:45:42.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:46:03.157 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:46:03.157 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:46:03.157 [Cloud] Queued cloud request. 2026-09-28T19:46:03.157 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:46:03.157 [Cloud] Dequeued cloud request. 2026-09-28T19:46:03.157 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:46:03.236 [Cloud] End of cloud request. 2026-09-28T19:46:03.736 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:49:03.316 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:49:03.316 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:49:03.316 [Cloud] Queued cloud request. 2026-09-28T19:49:03.316 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:49:03.316 [Cloud] Dequeued cloud request. 2026-09-28T19:49:03.316 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{BB59FB90-7195-9B9C-0703-6D9E2FAFF1A8} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 19:49:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T19:49:13.394 [Cloud] End of cloud request. 2026-09-28T19:49:13.910 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:51:05.738 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T19:51:05.738 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T19:51:05.738 [Cloud] Queued cloud request. 2026-09-28T19:51:05.738 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T19:51:05.738 [Cloud] Dequeued cloud request. 2026-09-28T19:51:05.738 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T19:51:05.894 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{03D2C8D4-5EEE-53CC-6162-96D1CBDF23D2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 19:51:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T19:51:06.394 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T19:53:57.114 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T20:03:24.167 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T20:03:24.167 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T20:03:24.167 [Cloud] Queued cloud request. 2026-09-28T20:03:24.167 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T20:03:24.167 [Cloud] Dequeued cloud request. 2026-09-28T20:03:24.167 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T20:03:24.635 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1C25B0C4-8A8C-AD64-E5D1-8039240350EB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 20:03:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T20:03:25.151 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T20:09:02.123 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T20:13:36.014 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T20:13:36.014 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T20:13:36.014 [Cloud] Queued cloud request. 2026-09-28T20:13:36.014 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T20:13:36.186 [Cloud] Dequeued cloud request. 2026-09-28T20:13:36.186 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T20:13:36.358 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F29AC25-2C86-DB92-5FB0-C5CE6249DD17} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 20:13:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T20:13:36.873 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T20:14:35.343 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T20:14:35.343 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T20:14:35.343 [Cloud] Queued cloud request. 2026-09-28T20:14:35.343 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T20:14:35.343 [Cloud] Dequeued cloud request. 2026-09-28T20:14:35.343 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T20:14:35.686 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0D1FCCEA-2061-DF07-C638-203593213A2F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 20:14:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T20:14:36.187 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T20:14:57.062 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T20:14:57.062 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T20:14:57.062 [Cloud] Queued cloud request. 2026-09-28T20:14:57.062 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T20:14:57.062 [Cloud] Dequeued cloud request. 2026-09-28T20:14:57.062 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T20:14:57.171 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6320B7C6-CC24-A6DF-5467-46834DEB383D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 20:14:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T20:14:57.671 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T20:17:16.863 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T20:17:16.863 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T20:17:16.863 [Cloud] Queued cloud request. 2026-09-28T20:17:16.863 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T20:17:16.863 [Cloud] Dequeued cloud request. 2026-09-28T20:17:16.863 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T20:17:17.051 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B4BF9ABC-8016-9534-3A82-F60FF41EB408} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 20:17:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T20:17:17.566 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T20:24:07.133 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T20:31:56.153 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T20:31:56.153 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T20:31:56.153 [Cloud] Queued cloud request. 2026-09-28T20:31:56.153 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T20:31:56.153 [Cloud] Dequeued cloud request. 2026-09-28T20:31:56.153 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T20:32:06.263 [Cloud] End of cloud request. 2026-09-28T20:32:06.778 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T20:32:23.606 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T20:32:23.606 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T20:32:23.606 [Cloud] Queued cloud request. 2026-09-28T20:32:23.606 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T20:32:23.606 [Cloud] Dequeued cloud request. 2026-09-28T20:32:23.606 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T20:32:23.685 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7CF8B786-6AF9-E31B-3526-A7EA3F69ADA4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 20:32:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T20:32:24.200 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T20:37:19.281 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T20:37:19.281 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T20:37:19.281 [Cloud] Queued cloud request. 2026-09-28T20:37:19.281 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T20:37:19.281 [Cloud] Dequeued cloud request. 2026-09-28T20:37:19.281 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T20:37:19.438 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4D3A6918-59AA-CC07-6C04-34ECDBE1A4FA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 20:37:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T20:37:19.953 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T20:39:12.141 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T20:40:51.674 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T20:40:51.674 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T20:40:51.674 [Cloud] Queued cloud request. 2026-09-28T20:40:51.674 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T20:40:51.674 [Cloud] Dequeued cloud request. 2026-09-28T20:40:51.674 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T20:40:51.892 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2CEE81AC-2170-D598-F535-4C7AEA1E76DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 20:40:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T20:40:52.392 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T20:47:30.614 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T20:47:30.614 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T20:47:30.614 [Cloud] Queued cloud request. 2026-09-28T20:47:30.614 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T20:47:30.614 [Cloud] Dequeued cloud request. 2026-09-28T20:47:30.614 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T20:47:30.817 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{85A4EEE3-A3F9-A30A-A1B4-DF9D18F7A36A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 20:47:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T20:47:31.317 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T20:54:17.147 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T20:55:52.210 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T20:55:52.210 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T20:55:52.210 [Cloud] Queued cloud request. 2026-09-28T20:55:52.210 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T20:55:52.210 [Cloud] Dequeued cloud request. 2026-09-28T20:55:52.210 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T20:55:52.413 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B49E56C4-C357-2B09-B180-713650C47599} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 20:55:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T20:55:52.929 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T21:00:50.026 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T21:00:50.026 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T21:00:50.026 [Cloud] Queued cloud request. 2026-09-28T21:00:50.026 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T21:00:50.026 [Cloud] Dequeued cloud request. 2026-09-28T21:00:50.026 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T21:00:50.214 [Cloud] End of cloud request. 2026-09-28T21:00:50.730 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T21:02:59.763 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T21:02:59.763 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T21:02:59.763 [Cloud] Queued cloud request. 2026-09-28T21:02:59.763 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T21:02:59.763 [Cloud] Dequeued cloud request. 2026-09-28T21:02:59.763 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T21:02:59.935 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7CA1E356-FDCD-FAE6-B6FE-9156E69F8098} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 21:02:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T21:03:00.450 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T21:05:33.372 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T21:05:33.372 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T21:05:33.372 [Cloud] Queued cloud request. 2026-09-28T21:05:33.372 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T21:05:33.372 [Cloud] Dequeued cloud request. 2026-09-28T21:05:33.372 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T21:05:33.560 [Cloud] End of cloud request. 2026-09-28T21:05:34.060 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T21:09:22.153 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T21:11:37.794 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T21:11:37.794 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T21:11:37.794 [Cloud] Queued cloud request. 2026-09-28T21:11:37.794 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T21:11:37.794 [Cloud] Dequeued cloud request. 2026-09-28T21:11:37.794 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T21:11:37.950 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D5F8F280-0AFF-D26D-2E92-B122E0D11A22} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 21:11:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T21:11:38.466 [NRI] Successfully updated NIS service with platform settings for enforcement level Log IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_NisSrvWatchDogTimerFix new=1 old0 IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-28T21:14:04.841 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T21:14:04.872 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-28T21:14:04.872 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-28T21:14:04.872 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-28T21:14:04.872 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T21:14:04.888 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-28T21:14:04.888 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-28T21:14:04.888 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-28T21:14:04.888 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-28T21:14:04.888 MdCoreSvc is supported in this platform and OS 2026-09-28T21:14:05.357 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-28T21:14:05.357 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-28T21:14:05.357 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-28T21:24:27.163 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T21:26:20.663 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T21:26:20.663 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T21:26:20.663 [Cloud] Queued cloud request. 2026-09-28T21:26:20.663 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T21:26:20.663 [Cloud] Dequeued cloud request. 2026-09-28T21:26:20.663 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T21:26:20.851 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B31BD53F-C09D-9E4F-2851-11F2311FF197} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 21:26:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T21:26:21.366 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T21:28:17.916 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T21:28:17.916 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T21:28:17.916 [Cloud] Queued cloud request. 2026-09-28T21:28:17.916 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T21:28:17.916 [Cloud] Dequeued cloud request. 2026-09-28T21:28:17.916 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T21:28:18.088 [Cloud] End of cloud request. 2026-09-28T21:28:18.603 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T21:38:00.374 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T21:38:00.374 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T21:38:00.374 [Cloud] Queued cloud request. 2026-09-28T21:38:00.374 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T21:38:00.374 [Cloud] Dequeued cloud request. 2026-09-28T21:38:00.374 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T21:38:00.546 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5AD71A65-6232-0656-4232-4077B0C60E47} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 21:38:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T21:38:01.046 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T21:39:32.171 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T21:39:44.405 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 18003, Count: 1037, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-28T21:39:44.405 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2102, Count: 170, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-28T21:39:44.405 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-28T21:39:44.405 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-28T21:39:44.405 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-28T21:39:44.405 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 136, Count: 10, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-28T21:39:44.405 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-28T21:39:44.405 ProcessImageName: python.exe, Pid: 7464, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-28T21:39:44.405 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 1% 2026-09-28T21:39:44.405 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-28T21:39:44.405 ProcessImageName: taskhostw.exe, Pid: 664, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-28T21:54:37.176 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T22:01:51.213 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T22:01:51.213 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T22:01:51.213 [Cloud] Queued cloud request. 2026-09-28T22:01:51.213 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T22:01:51.213 [Cloud] Dequeued cloud request. 2026-09-28T22:01:51.213 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T22:01:51.354 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CA20DE51-DE2B-CB56-6649-5B3809ACF498} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 22:01:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T22:01:51.869 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T22:04:15.120 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T22:04:15.120 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T22:04:15.120 [Cloud] Queued cloud request. 2026-09-28T22:04:15.120 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T22:04:15.120 [Cloud] Dequeued cloud request. 2026-09-28T22:04:15.120 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T22:04:15.276 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A913514F-CA9B-B929-E2DA-5170F53FF642} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 22:04:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T22:04:15.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T22:09:42.185 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T22:16:55.048 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T22:16:55.048 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T22:16:55.048 [Cloud] Queued cloud request. 2026-09-28T22:16:55.048 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T22:16:55.048 [Cloud] Dequeued cloud request. 2026-09-28T22:16:55.048 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T22:16:55.189 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E871F633-352A-3AB6-4CA9-8F339136AE98} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 22:16:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T22:16:55.689 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T22:22:05.409 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T22:22:05.409 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T22:22:05.409 [Cloud] Queued cloud request. 2026-09-28T22:22:05.409 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T22:22:05.409 [Cloud] Dequeued cloud request. 2026-09-28T22:22:05.409 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T22:22:05.565 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8E008424-902B-46D5-20E3-5D77BE47220C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 22:22:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T22:22:06.081 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T22:24:47.192 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T22:33:33.711 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T22:33:33.711 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T22:33:33.711 [Cloud] Queued cloud request. 2026-09-28T22:33:33.711 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T22:33:33.711 [Cloud] Dequeued cloud request. 2026-09-28T22:33:33.711 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T22:33:43.804 [Cloud] End of cloud request. 2026-09-28T22:33:44.304 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T22:39:51.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T22:39:51.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T22:39:51.387 [Cloud] Queued cloud request. 2026-09-28T22:39:51.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T22:39:51.387 [Cloud] Dequeued cloud request. 2026-09-28T22:39:51.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T22:39:51.544 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FFCEC85B-FA6F-4252-5C37-826A8E64DD1D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 22:39:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T22:39:52.059 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T22:39:52.200 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T22:49:08.954 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T22:49:08.954 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T22:49:08.954 [Cloud] Queued cloud request. 2026-09-28T22:49:08.954 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T22:49:08.954 [Cloud] Dequeued cloud request. 2026-09-28T22:49:08.954 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T22:49:19.048 [Cloud] End of cloud request. 2026-09-28T22:49:19.564 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T22:54:57.205 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T23:05:09.569 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T23:05:09.569 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T23:05:09.569 [Cloud] Queued cloud request. 2026-09-28T23:05:09.569 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T23:05:09.569 [Cloud] Dequeued cloud request. 2026-09-28T23:05:09.569 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T23:05:09.726 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{71CCCB8C-9440-40BE-BACB-E70FD247DB0A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 23:05:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T23:05:10.241 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T23:06:13.321 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T23:06:13.321 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T23:06:13.321 [Cloud] Queued cloud request. 2026-09-28T23:06:13.321 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T23:06:13.321 [Cloud] Dequeued cloud request. 2026-09-28T23:06:13.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T23:06:23.399 [Cloud] End of cloud request. 2026-09-28T23:06:23.900 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T23:10:02.213 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T23:21:36.156 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T23:21:36.156 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T23:21:36.156 [Cloud] Queued cloud request. 2026-09-28T23:21:36.156 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T23:21:36.156 [Cloud] Dequeued cloud request. 2026-09-28T23:21:36.156 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T23:21:36.343 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{26F88776-DEC7-CE01-3898-9C94CD4347D5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 23:21:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T23:21:36.843 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T23:22:15.890 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T23:22:15.890 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T23:22:15.890 [Cloud] Queued cloud request. 2026-09-28T23:22:15.890 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T23:22:15.890 [Cloud] Dequeued cloud request. 2026-09-28T23:22:15.890 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T23:22:15.984 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8E2963E-11FA-78A1-4226-A55131CBF156} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-28-2026 23:22:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-28T23:22:16.484 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T23:23:35.140 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T23:23:35.140 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T23:23:35.140 [Cloud] Queued cloud request. 2026-09-28T23:23:35.140 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T23:23:35.140 [Cloud] Dequeued cloud request. 2026-09-28T23:23:35.140 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T23:23:35.312 [Cloud] End of cloud request. 2026-09-28T23:23:35.812 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T23:25:07.219 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T23:26:35.956 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T23:26:35.956 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T23:26:35.956 [Cloud] Queued cloud request. 2026-09-28T23:26:35.956 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T23:26:36.127 [Cloud] Dequeued cloud request. 2026-09-28T23:26:36.127 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T23:26:46.253 [Cloud] End of cloud request. 2026-09-28T23:26:46.753 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T23:31:18.048 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-28T23:31:18.048 [Cloud] Start of cloud request. Passive mode: 0 2026-09-28T23:31:18.048 [Cloud] Queued cloud request. 2026-09-28T23:31:18.048 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-28T23:31:18.048 [Cloud] Dequeued cloud request. 2026-09-28T23:31:18.048 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-28T23:31:22.626 [Cloud] End of cloud request. 2026-09-28T23:31:23.126 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-28T23:39:44.474 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 19354, Count: 1094, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-28T23:39:44.474 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2800, Count: 233, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-28T23:39:44.474 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 2130, Count: 165, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-28T23:39:44.474 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-28T23:39:44.474 ProcessImageName: AgentShellService.exe, Pid: 7992, TotalTime: 681, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53% 2026-09-28T23:39:44.474 ProcessImageName: WmiPrvSE.exe, Pid: 1060, TotalTime: 524, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\afd.sys, EstimatedImpact: 10% 2026-09-28T23:39:44.474 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-28T23:39:44.474 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 241, Count: 18, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-28T23:39:44.474 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-28T23:39:44.474 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-28T23:39:44.474 ProcessImageName: python.exe, Pid: 7464, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-28T23:39:44.474 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-28T23:39:44.474 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 0% 2026-09-28T23:39:44.474 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-28T23:39:44.474 ProcessImageName: taskhostw.exe, Pid: 664, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-28T23:40:12.224 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-28T23:55:17.230 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T00:03:57.764 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T00:03:57.764 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T00:03:57.764 [Cloud] Queued cloud request. 2026-09-29T00:03:57.764 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T00:03:57.764 [Cloud] Dequeued cloud request. 2026-09-29T00:03:57.764 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T00:03:57.952 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AA78AA18-43E6-57CB-2271-7C1D04E912AE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 00:03:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T00:03:58.452 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T00:10:22.237 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T00:25:27.244 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T00:30:50.918 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T00:30:50.918 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T00:30:50.918 [Cloud] Queued cloud request. 2026-09-29T00:30:50.918 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T00:30:50.918 [Cloud] Dequeued cloud request. 2026-09-29T00:30:50.918 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T00:30:51.058 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8D091187-827D-3620-12C0-345EA998C5DF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 00:30:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T00:30:51.559 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T00:40:32.251 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T00:40:35.219 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T00:40:35.219 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T00:40:35.219 [Cloud] Queued cloud request. 2026-09-29T00:40:35.219 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T00:40:35.219 [Cloud] Dequeued cloud request. 2026-09-29T00:40:35.219 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T00:40:35.360 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5528A7FC-7F87-224D-38CB-D99298860C3D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 00:40:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T00:40:35.876 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T00:42:31.690 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T00:42:31.690 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T00:42:31.690 [Cloud] Queued cloud request. 2026-09-29T00:42:31.690 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T00:42:31.690 [Cloud] Dequeued cloud request. 2026-09-29T00:42:31.690 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T00:42:31.846 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4FE4D0B8-93F9-A41D-6992-01A88B58CA44} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 00:42:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T00:42:32.346 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T00:55:37.258 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T01:00:02.104 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976866, FileId: 0x3400000000d094, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.104 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976867, FileId: 0xc000000008578, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.120 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976873, FileId: 0xe000000008578, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.120 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976872, FileId: 0x3600000000d094, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.135 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976878, FileId: 0x3800000000d094, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.135 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976879, FileId: 0x10000000008578, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.151 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976885, FileId: 0x12000000008578, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.151 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976884, FileId: 0x3a00000000d094, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.167 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976891, FileId: 0x14000000008578, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.167 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976890, FileId: 0x3c00000000d094, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.167 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976896, FileId: 0x3e00000000d094, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.167 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976897, FileId: 0x16000000008578, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.182 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976903, FileId: 0x18000000008578, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.182 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976902, FileId: 0x4000000000d094, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.198 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976909, FileId: 0x1a000000008578, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.198 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976908, FileId: 0x4200000000d094, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.213 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976915, FileId: 0x1c000000008578, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.213 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976914, FileId: 0x4400000000d094, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.229 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976920, FileId: 0x4600000000d094, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.229 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976921, FileId: 0x1e000000008578, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.245 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976926, FileId: 0x4800000000d094, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.245 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976927, FileId: 0x20000000008578, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.245 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976933, FileId: 0x22000000008578, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:00:02.245 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2939d-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4976932, FileId: 0x4a00000000d094, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T01:04:58.292 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T01:04:58.292 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T01:04:58.292 [Cloud] Queued cloud request. 2026-09-29T01:04:58.292 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T01:04:58.292 [Cloud] Dequeued cloud request. 2026-09-29T01:04:58.292 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T01:04:58.479 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{91541FB8-6A1C-6D02-9FD2-9B5CB9E73E9D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 01:04:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T01:04:58.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T01:05:11.542 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T01:05:11.542 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T01:05:11.542 [Cloud] Queued cloud request. 2026-09-29T01:05:11.542 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T01:05:11.542 [Cloud] Dequeued cloud request. 2026-09-29T01:05:11.542 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T01:05:11.621 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{328B7852-044E-9E01-540B-751CB75A6443} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 01:05:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T01:05:12.136 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T01:10:42.265 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T01:19:07.863 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:C90FC9BF-E97D-499B-9C58-FBEA90DD2DBA, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-29T01:19:07.863 Scheduled scan with Id C90FC9BF-E97D-499B-9C58-FBEA90DD2DBA configured CPU priority: normal (LowCpuPriority: 0) 2026-09-29T01:19:07.863 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-29T01:19:07.863 [SFC] System file cache build is not needed (already completed) 2026-09-29T01:19:29.160 Engine:Triggered AR EMS scan 2026-09-29T01:19:29.160 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.176 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.192 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.192 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.192 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.223 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.223 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.238 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.238 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.238 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.254 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.254 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.254 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.254 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.270 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.270 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.285 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.285 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.285 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.301 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.301 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.301 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.317 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.317 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.317 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.332 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.332 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.348 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.363 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.363 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.363 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.363 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.379 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.379 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.395 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.395 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.395 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.410 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.410 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.426 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.426 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.426 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.426 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.442 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.442 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.457 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.457 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.457 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.473 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.473 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.488 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.488 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.504 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.504 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.504 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.520 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.520 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.535 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.535 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.551 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:19:29.551 Engine:EMS scan for process: svchost pid: 7604, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-29T01:20:08.551 QuickScan:ScanID:C90FC9BF-E97D-499B-9C58-FBEA90DD2DBA: Quick scan finished with error 0 2026-09-29T01:20:09.067 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-29T01:20:09.067 [RTP] Duplicating the current plugin configuration object... 2026-09-29T01:20:09.067 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-29T01:20:09.067 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-29T01:20:09.067 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-29T01:20:09.067 [RTP] No config change detected. Not updating plugin configuration. 2026-09-29T01:20:09.067 [RTP] No config changes found. No configuration switch. 2026-09-29T01:20:09.067 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-29T01:25:47.272 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T01:36:35.246 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T01:36:35.246 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T01:36:35.246 [Cloud] Queued cloud request. 2026-09-29T01:36:35.246 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T01:36:35.246 [Cloud] Dequeued cloud request. 2026-09-29T01:36:35.246 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T01:36:35.433 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CF944DA1-4761-9843-4678-2DAB28892A80} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 01:36:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T01:36:35.933 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T01:39:13.857 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T01:39:13.857 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T01:39:13.857 [Cloud] Queued cloud request. 2026-09-29T01:39:13.857 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T01:39:13.857 [Cloud] Dequeued cloud request. 2026-09-29T01:39:13.857 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T01:39:14.044 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DED065E8-3B93-1AAF-470F-EFCB1D7900AC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 01:39:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T01:39:14.544 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T01:39:44.544 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 19676, Count: 1107, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T01:39:44.544 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 4235, Count: 354, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-29T01:39:44.544 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2800, Count: 233, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T01:39:44.544 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-29T01:39:44.544 ProcessImageName: AgentShellService.exe, Pid: 7992, TotalTime: 681, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53% 2026-09-29T01:39:44.544 ProcessImageName: WmiPrvSE.exe, Pid: 1060, TotalTime: 524, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\afd.sys, EstimatedImpact: 10% 2026-09-29T01:39:44.544 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-29T01:39:44.544 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 407, Count: 31, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T01:39:44.544 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T01:39:44.544 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-29T01:39:44.544 ProcessImageName: python.exe, Pid: 7464, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-29T01:39:44.544 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 58, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 0% 2026-09-29T01:39:44.544 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-29T01:39:44.544 ProcessImageName: mysqldump.exe, Pid: 1840, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-29T01:39:44.544 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T01:39:44.544 ProcessImageName: cmd.exe, Pid: 2768, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-29T01:39:44.544 ProcessImageName: taskhostw.exe, Pid: 664, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-29T01:40:52.279 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T01:51:40.721 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T01:51:40.721 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T01:51:40.721 [Cloud] Queued cloud request. 2026-09-29T01:51:40.721 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T01:51:40.721 [Cloud] Dequeued cloud request. 2026-09-29T01:51:40.721 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T01:51:40.908 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5C693EFE-1447-5133-61D3-A052C4CE991E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 01:51:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T01:51:41.408 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T01:55:57.286 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T02:03:18.554 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-293ac-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4997962, FileId: 0xa00000000d0f8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T02:03:18.569 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-293ac-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #4997963, FileId: 0x1a00000000a97c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T02:04:42.194 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T02:04:42.194 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T02:04:42.194 [Cloud] Queued cloud request. 2026-09-29T02:04:42.194 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T02:04:42.210 [Cloud] Dequeued cloud request. 2026-09-29T02:04:42.210 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T02:04:42.491 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7B13C6AC-8EC2-439F-4FB3-4FB3BFA47008} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 02:04:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T02:04:43.007 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T02:11:02.292 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T02:13:48.917 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T02:13:48.917 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T02:13:48.917 [Cloud] Queued cloud request. 2026-09-29T02:13:48.917 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T02:13:48.917 [Cloud] Dequeued cloud request. 2026-09-29T02:13:48.917 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T02:13:49.120 [Cloud] End of cloud request. 2026-09-29T02:13:49.620 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T02:26:07.300 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T02:26:54.128 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T02:26:54.128 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T02:26:54.128 [Cloud] Queued cloud request. 2026-09-29T02:26:54.128 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T02:26:54.128 [Cloud] Dequeued cloud request. 2026-09-29T02:26:54.128 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T02:26:54.847 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0A9F8BA6-FD78-A1F9-3970-74E0E0600DF0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 02:26:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T02:26:55.362 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T02:40:13.727 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T02:40:13.727 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T02:40:13.727 [Cloud] Queued cloud request. 2026-09-29T02:40:13.727 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T02:40:13.727 [Cloud] Dequeued cloud request. 2026-09-29T02:40:13.727 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T02:40:13.915 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{085AD84E-0585-DDE1-9590-B90A08103518} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 02:40:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T02:40:14.430 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T02:41:12.305 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T02:56:17.312 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T03:02:04.096 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T03:02:04.096 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T03:02:04.096 [Cloud] Queued cloud request. 2026-09-29T03:02:04.096 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T03:02:04.096 [Cloud] Dequeued cloud request. 2026-09-29T03:02:04.096 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T03:02:04.283 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{37D350E1-E44A-F63F-2401-461685462E27} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 03:02:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T03:02:04.799 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T03:07:07.005 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-29T03:07:07.025 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-29T03:07:07.025 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-29T03:07:07.025 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-29T03:07:07.025 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-29T03:07:07.025 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-29T03:07:07.099 [AutoPurge] Cleanup Routine tasks have started. 2026-09-29T03:07:07.130 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-29T03:07:07.130 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-29T03:07:07.130 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-29-2026 03:07:07 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-29-2026 03:07:07 2026-09-29T03:07:07.146 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-29T03:07:07.146 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-29T03:07:07.146 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-29T03:07:07.146 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-29T03:07:07.146 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-29T03:07:07.146 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-29T03:07:07.146 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-29T03:07:07.146 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-29T03:07:07.162 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-29T03:07:07.177 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-29T03:07:07.177 [AutoPurge] Removing expired default signature package ... 2026-09-29T03:07:07.443 Job Notification: New process added to job (4844) 2026-09-29T03:07:07.474 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-29T03:07:07.646 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-29T03:07:08.068 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:07:08.240 Job Notification: Process exited from job (4844) 2026-09-29T03:07:08.287 [AutoPurge] Verification Routine tasks have ended. 2026-09-29T03:07:08.630 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-29T03:07:08.771 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-29T03:07:09.271 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-29T03:07:09.349 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-29T03:07:09.521 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-29T03:07:11.115 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:11.474 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-29T03:07:11.787 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-29T03:07:11.802 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:11.974 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-29T03:07:12.568 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-29T03:07:13.162 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-29T03:07:13.271 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-29T03:07:13.396 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-29T03:07:13.662 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:07:13.818 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-29T03:07:14.130 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-29T03:07:14.240 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-29T03:07:14.427 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:14.537 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:14.599 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:14.615 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-29T03:07:14.818 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:07:14.880 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-29T03:07:14.912 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-29T03:07:14.959 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-29T03:07:15.099 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-29T03:07:15.443 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:15.490 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-29T03:07:15.896 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:16.021 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-29T03:07:16.599 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-29T03:07:17.068 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:17.209 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:17.490 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-29T03:07:17.896 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-29T03:07:17.990 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-29T03:07:18.302 Engine:Setting original file name "MicrosoftEdgeUpdateSetup.exe" for "c:\program files (x86)\microsoft\edgeupdate\download\{f3c4fe00-efd5-403b-9569-398a20f1ba4a}\1.3.271.7\microsoftedgeupdatesetup_x86_1.3.271.7.exe", hr=0x0 2026-09-29T03:07:18.380 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-29T03:07:18.505 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:18.943 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:07:19.084 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-29T03:07:19.084 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-29T03:07:19.146 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-29T03:07:19.318 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-29T03:07:19.396 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-29T03:07:19.427 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:19.505 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-29T03:07:19.693 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-29T03:07:20.068 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-29T03:07:20.302 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-29T03:07:20.787 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-29T03:07:22.209 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-29T03:07:22.677 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-29T03:07:22.709 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-29T03:07:22.724 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-29T03:07:22.740 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-29T03:07:22.756 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-29T03:07:22.881 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-29T03:07:23.068 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-29T03:07:23.099 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:23.162 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-29T03:07:23.537 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-29T03:07:23.584 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-29T03:07:23.599 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-29T03:07:23.646 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-29T03:07:24.131 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:24.224 Engine:Setting original file name "Microsoft(r) DirectX for Windows(r) - Out Of Band" for "c:\program files (x86)\microsoft\edgecore\optimized\dxil.dll", hr=0x0 2026-09-29T03:07:24.318 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:24.349 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-29T03:07:24.381 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-29T03:07:24.412 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:24.818 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-29T03:07:25.115 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-29T03:07:25.131 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:25.818 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-29T03:07:25.834 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-29T03:07:26.412 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:26.771 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-29T03:07:27.146 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-29T03:07:27.287 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:27.443 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:27.615 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-29T03:07:27.881 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-29T03:07:27.943 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-29T03:07:27.990 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:28.490 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-29T03:07:28.787 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-29T03:07:28.818 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-29T03:07:28.865 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:07:29.162 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:07:29.349 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-29T03:07:29.459 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-29T03:07:29.584 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-29T03:07:29.599 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-29T03:07:29.678 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-29T03:07:30.209 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-29T03:07:30.693 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-29T03:07:30.803 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-29T03:07:30.896 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-29T03:07:31.490 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-29T03:07:31.537 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:31.881 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-29T03:07:31.990 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-29T03:07:31.990 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-29T03:07:32.021 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-29T03:07:32.115 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-29T03:07:32.162 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-29T03:07:32.193 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-29T03:07:32.615 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-29T03:07:32.615 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-29T03:07:32.959 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-29T03:07:33.146 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:33.256 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-29T03:07:33.256 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-29T03:07:33.490 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:33.709 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-29T03:07:34.100 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:34.396 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-29T03:07:34.553 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-29T03:07:34.912 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-29T03:07:34.928 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:35.100 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-29T03:07:35.209 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-29T03:07:35.709 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-29T03:07:35.756 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-29T03:07:35.975 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:35.990 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-29T03:07:36.178 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-29T03:07:36.225 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-29T03:07:36.475 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:07:37.006 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:37.146 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-29T03:07:37.209 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-29T03:07:37.412 Engine:Setting original file name " " for "c:\program files (x86)\microsoft\edgecore\optimized\dxcompiler.dll", hr=0x0 2026-09-29T03:07:38.068 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-29T03:07:38.100 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-29T03:07:38.365 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-29T03:07:38.521 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-29T03:07:38.896 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-29T03:07:39.506 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:07:39.693 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-29T03:07:40.146 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-29T03:07:40.428 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-29T03:07:40.568 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-29T03:07:40.600 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:40.615 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-29T03:07:40.709 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-29T03:07:40.928 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-29T03:07:41.303 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-29T03:07:41.397 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-29T03:07:41.615 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-29T03:07:41.865 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-29T03:07:41.912 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-29T03:07:42.209 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:07:42.412 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-29T03:07:42.584 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-29T03:07:43.365 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:43.428 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-29T03:07:43.506 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-29T03:07:43.553 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-29T03:07:44.459 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-29T03:07:44.537 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-29T03:07:44.631 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-29T03:07:44.756 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-29T03:07:44.959 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-29T03:07:45.131 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-29T03:07:45.818 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-29T03:07:45.865 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-29T03:07:45.881 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-29T03:07:45.943 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-29T03:07:46.037 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-29T03:07:46.350 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-29T03:07:46.490 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-29T03:07:46.522 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-29T03:07:46.537 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-29T03:07:46.615 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:46.647 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-29T03:07:46.678 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-29T03:07:47.006 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-29T03:07:47.147 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-29T03:07:47.443 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-29T03:07:47.553 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:47.787 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-29T03:07:48.131 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-29T03:07:48.209 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-29T03:07:48.381 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-29T03:07:48.600 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-29T03:07:48.662 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-29T03:07:48.740 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:48.897 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:49.084 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-29T03:07:49.162 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-29T03:07:49.350 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:07:49.522 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-29T03:07:49.600 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:49.865 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:07:49.897 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-29T03:07:49.943 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-29T03:07:50.115 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-29T03:07:50.162 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-29T03:07:50.178 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-29T03:07:50.600 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-29T03:07:50.662 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:50.693 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-29T03:07:50.803 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:50.990 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:07:51.115 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-29T03:07:51.240 Engine:Setting original file name "CopilotUpdate.exe" for "c:\windows\systemtemp\copilotupdate.exe.old{9c304e8d-10bc-445a-8771-81a12ae6dd9b}", hr=0x0 2026-09-29T03:07:51.662 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-29T03:07:51.787 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-29T03:07:51.865 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-29T03:07:52.147 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-29T03:07:52.178 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-29T03:07:52.209 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-29T03:07:52.553 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-29T03:07:52.600 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-29T03:07:52.897 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-29T03:07:52.975 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-29T03:07:53.022 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-29T03:07:53.037 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:53.037 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:53.068 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:07:53.084 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-29T03:07:53.100 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:53.725 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-29T03:07:54.006 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-29T03:07:54.256 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:54.303 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-29T03:07:54.537 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:54.553 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:07:54.662 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-29T03:07:54.975 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:54.990 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-29T03:07:55.162 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-29T03:07:55.178 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-29T03:07:55.287 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-29T03:07:55.365 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-29T03:07:55.381 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-29T03:07:55.615 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-29T03:07:55.647 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-29T03:07:55.647 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-29T03:07:55.787 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-29T03:07:55.990 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:56.162 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-29T03:07:56.490 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\winsxs\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.20348.3692_none_ea9c313aecda491b\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-29T03:07:56.600 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-29T03:07:56.756 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-29T03:07:56.959 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-29T03:07:57.115 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-29T03:07:57.115 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-29T03:07:57.131 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:07:57.350 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-29T03:07:57.365 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-29T03:07:57.553 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-29T03:07:57.678 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-29T03:07:57.709 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-29T03:07:58.397 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:07:58.397 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-29T03:07:58.490 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-29T03:07:58.678 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:07:58.693 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:07:59.428 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:07:59.834 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-29T03:08:00.084 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:00.084 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-29T03:08:00.287 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:00.303 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-29T03:08:00.459 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-29T03:08:00.553 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-29T03:08:00.600 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-29T03:08:00.897 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-29T03:08:00.943 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:08:01.178 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:08:01.178 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:01.240 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-29T03:08:01.850 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-29T03:08:02.334 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-29T03:08:02.381 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:02.428 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-29T03:08:02.537 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:08:02.725 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:02.787 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-29T03:08:03.084 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-29T03:08:03.537 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:03.568 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-29T03:08:03.834 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:08:03.959 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-29T03:08:04.162 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-29T03:08:04.178 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:04.459 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-29T03:08:04.834 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-29T03:08:04.881 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:05.006 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:05.131 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-29T03:08:05.162 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-29T03:08:05.506 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-29T03:08:05.615 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:05.756 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-29T03:08:05.787 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-29T03:08:05.803 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:05.834 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:08:05.990 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-29T03:08:06.053 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:08:06.443 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-29T03:08:06.537 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-29T03:08:07.037 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-29T03:08:07.084 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-29T03:08:07.162 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-29T03:08:07.287 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-29T03:08:07.334 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:08:07.365 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-29T03:08:07.428 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-29T03:08:07.897 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-29T03:08:08.069 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-29T03:08:08.303 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-29T03:08:08.303 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-29T03:08:08.615 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-29T03:08:08.615 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:08.912 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-29T03:08:09.240 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-29T03:08:09.553 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-29T03:08:09.615 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-29T03:08:09.678 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-29T03:08:09.725 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:08:09.850 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-29T03:08:09.897 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-29T03:08:09.928 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-29T03:08:10.037 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-29T03:08:10.365 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-29T03:08:10.412 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:08:10.459 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:08:10.803 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-29T03:08:10.881 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:08:11.053 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-29T03:08:11.272 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-29T03:08:11.553 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-29T03:08:11.569 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:11.912 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-29T03:08:11.912 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-29T03:08:11.959 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-29T03:08:12.194 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-29T03:08:12.459 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-29T03:08:12.475 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-29T03:08:12.803 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-29T03:08:12.881 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-29T03:08:13.006 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-29T03:08:13.084 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:08:13.115 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-29T03:08:13.287 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-29T03:08:13.569 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-29T03:08:13.756 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-29T03:08:13.834 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-29T03:08:14.006 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-29T03:08:15.444 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-29T03:08:15.897 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-29T03:08:16.053 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-29T03:08:16.272 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:08:16.647 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-29T03:08:16.803 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-29T03:08:17.053 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-29T03:08:17.287 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-29T03:08:17.381 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-29T03:08:17.412 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-29T03:08:17.428 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-29T03:08:17.553 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-29T03:08:17.819 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-29T03:08:17.850 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:17.850 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-29T03:08:17.928 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-29T03:08:17.959 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-29T03:08:18.037 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-29T03:08:18.381 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-29T03:08:18.475 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-29T03:08:18.647 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-29T03:08:18.662 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:18.756 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-29T03:08:18.772 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-29T03:08:18.959 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-29T03:08:19.006 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:08:19.256 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-29T03:08:19.694 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-29T03:08:20.912 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:08:21.334 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-29T03:08:21.412 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-29T03:08:21.850 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-29T03:08:22.178 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:08:22.287 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:22.553 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-29T03:08:22.819 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-29T03:08:22.897 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-29T03:08:23.037 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-29T03:08:23.194 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-29T03:08:23.600 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-29T03:08:24.319 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-29T03:08:24.397 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-29T03:08:24.490 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-29T03:08:25.069 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-29T03:08:25.194 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-29T03:08:25.506 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-29T03:08:25.569 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-29T03:08:25.678 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-29T03:08:25.678 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-29T03:08:26.131 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-29T03:08:26.225 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-29T03:08:26.241 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:26.272 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-29T03:08:26.553 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-29T03:08:26.569 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:08:26.756 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-29T03:08:26.944 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-29T03:08:27.241 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-29T03:08:27.741 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-29T03:08:27.834 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:08:28.022 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:28.225 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-29T03:08:28.537 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:28.600 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-29T03:08:28.772 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-29T03:08:28.928 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-29T03:08:29.053 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:29.178 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-29T03:08:29.412 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-29T03:08:29.756 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-29T03:08:29.803 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-29T03:08:29.834 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-29T03:08:29.975 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:30.006 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-29T03:08:30.334 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-29T03:08:30.491 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-29T03:08:30.600 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:31.491 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-29T03:08:32.022 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-29T03:08:32.069 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-29T03:08:32.131 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-29T03:08:32.163 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-29T03:08:32.491 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:32.553 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-29T03:08:32.741 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-29T03:08:32.819 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-29T03:08:32.897 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-29T03:08:32.959 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:33.053 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-29T03:08:33.272 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-29T03:08:33.334 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-29T03:08:33.725 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-29T03:08:33.819 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-29T03:08:33.913 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-29T03:08:33.928 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-29T03:08:33.944 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-29T03:08:33.959 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-29T03:08:34.084 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-29T03:08:34.100 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:08:34.116 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-29T03:08:34.163 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-29T03:08:34.584 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-29T03:08:34.616 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-29T03:08:34.959 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:08:35.006 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-29T03:08:35.038 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-29T03:08:35.053 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-29T03:08:35.834 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-29T03:08:35.944 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:08:36.116 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:08:36.116 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-29T03:08:36.272 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-29T03:08:36.475 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-29T03:08:36.600 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-29T03:08:36.678 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:37.350 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-29T03:08:37.366 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-29T03:08:37.506 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-29T03:08:37.538 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-29T03:08:37.538 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:08:38.116 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:08:38.116 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-29T03:08:38.241 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-29T03:08:38.256 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-29T03:08:38.428 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-29T03:08:38.788 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-29T03:08:39.178 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-29T03:08:39.413 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:39.506 Engine:Setting original file name "Vulkan Runtime" for "c:\program files (x86)\microsoft\edgecore\optimized\vulkan-1.dll", hr=0x0 2026-09-29T03:08:39.788 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-29T03:08:40.006 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-29T03:08:40.053 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-29T03:08:40.241 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-29T03:08:40.272 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-29T03:08:40.350 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-29T03:08:40.428 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-29T03:08:40.506 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-29T03:08:40.506 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:08:40.725 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-29T03:08:40.803 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-29T03:08:41.084 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-29T03:08:41.209 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-29T03:08:41.366 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-29T03:08:41.381 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:08:41.538 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\de-de\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:41.678 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-console-l1-1-0.dll", hr=0x0 2026-09-29T03:08:41.850 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0 2026-09-29T03:08:41.850 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-registry-l2-1-0.dll", hr=0x0 2026-09-29T03:08:42.241 Engine:Setting original file name "MrmCore.dll" for "c:\windows\winsxs\wow64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.20348.5020_none_9e6a80bbc86408d7\mrmcorer.dll", hr=0x0 2026-09-29T03:08:42.256 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:42.366 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_en-gb_56416fd74780e848\vsswmi.dll.mui", hr=0x0 2026-09-29T03:08:42.366 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\es-es\aerolite.msstyles.mui", hr=0x0 2026-09-29T03:08:42.506 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_7573f1c6d4639f87\penimc.dll", hr=0x0 2026-09-29T03:08:42.538 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.data.winmd", hr=0x0 2026-09-29T03:08:42.694 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\de-de\ndisimplatcim.dll.mui", hr=0x0 2026-09-29T03:08:42.772 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_4e347e352039867c\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:42.881 Engine:Setting original file name "winsqlite3" for "c:\windows\winsxs\wow64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.20348.4647_none_c9096b99901f19cd\winsqlite3.dll", hr=0x0 2026-09-29T03:08:42.913 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0 2026-09-29T03:08:42.928 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000c.dll", hr=0x0 2026-09-29T03:08:43.444 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-1-0.dll", hr=0x0 2026-09-29T03:08:43.444 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata000a.dll", hr=0x0 2026-09-29T03:08:43.741 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-2-0.dll", hr=0x0 2026-09-29T03:08:43.835 Engine:Setting original file name "wmic.exe" for "c:\windows\winsxs\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.20348.2849_none_54405a5933961199\wmic.exe", hr=0x0 2026-09-29T03:08:43.991 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.storage.winmd", hr=0x0 2026-09-29T03:08:44.303 Engine:Setting original file name "CRYPT32.DLL" for "c:\windows\systemresources\crypt32.dll.mun", hr=0x0 2026-09-29T03:08:44.585 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_7d8ffbc5cb37c8e0\bootmgr.exe.mui", hr=0x0 2026-09-29T03:08:44.647 Engine:Setting original file name "mstsc.exe" for "c:\windows\systemresources\mstsc.exe.mun", hr=0x0 2026-09-29T03:08:44.866 Engine:Setting original file name "SYSTEMCPL.DLL" for "c:\windows\systemresources\systemcpl.dll.mun", hr=0x0 2026-09-29T03:08:44.897 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0 2026-09-29T03:08:45.006 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1e6e07718388e886\diagpackage.dll.mui", hr=0x0 2026-09-29T03:08:45.053 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0 2026-09-29T03:08:45.663 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0 2026-09-29T03:08:45.678 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mpg4decd_31bf3856ad364e35_10.0.20348.2849_none_08e768f194682e23\mpg4decd.dll", hr=0x0 2026-09-29T03:08:45.678 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0 2026-09-29T03:08:45.725 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0 2026-09-29T03:08:45.928 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-1.dll", hr=0x0 2026-09-29T03:08:45.928 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\naturallanguage6.dll", hr=0x0 2026-09-29T03:08:46.413 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0 2026-09-29T03:08:46.663 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0 2026-09-29T03:08:46.913 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ja-jp_5634cc97d85965d9\bootmgr_ex.efi.mui", hr=0x0 2026-09-29T03:08:46.913 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0 2026-09-29T03:08:47.116 OriginalFileName Maintenance::28526 files in Moac, 0 skipped (cached), 539 filename set 2026-09-29T03:08:47.116 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-29T03:11:22.319 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T03:13:06.897 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T03:13:06.897 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T03:13:06.897 [Cloud] Queued cloud request. 2026-09-29T03:13:06.897 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T03:13:06.897 [Cloud] Dequeued cloud request. 2026-09-29T03:13:06.897 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T03:13:07.069 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{627EF6E3-84CD-EA83-0161-CDD9548EFDAD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 03:13:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T03:13:07.585 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-29T03:13:07.616 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T03:13:07.616 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-29T03:13:07.616 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-29T03:13:07.616 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-29T03:13:07.616 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-29T03:13:07.616 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-29T03:13:07.616 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-29T03:13:07.616 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-29T03:13:07.616 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-29T03:13:07.616 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-29T03:13:07.616 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-29T03:13:07.616 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-29T03:13:07.616 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T03:13:07.616 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-29T03:13:07.616 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-29T03:13:07.616 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-29T03:13:07.616 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-29T03:13:07.616 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-29T03:13:07.616 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-29T03:13:07.616 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-29T03:13:07.616 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-29T03:13:07.616 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-29T03:13:07.616 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T03:13:07.616 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T03:13:07.616 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T03:13:10.194 [RTP] Duplicating the current plugin configuration object... 2026-09-29T03:13:10.194 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-29T03:13:10.194 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-29T03:13:10.194 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-29T03:13:10.194 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-29T03:13:10.194 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-29T03:26:27.326 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T03:34:13.687 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T03:34:13.687 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T03:34:13.687 [Cloud] Queued cloud request. 2026-09-29T03:34:13.687 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T03:34:13.687 [Cloud] Dequeued cloud request. 2026-09-29T03:34:13.687 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T03:34:13.844 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E6CA3AC9-495F-47B9-06DA-BAF716315F06} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 03:34:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T03:34:14.359 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T03:34:40.047 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T03:34:40.047 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T03:34:40.047 [Cloud] Queued cloud request. 2026-09-29T03:34:40.047 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T03:34:40.047 [Cloud] Dequeued cloud request. 2026-09-29T03:34:40.047 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T03:34:40.125 [Cloud] End of cloud request. 2026-09-29T03:34:40.625 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T03:37:56.051 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T03:37:56.051 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T03:37:56.051 [Cloud] Queued cloud request. 2026-09-29T03:37:56.051 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T03:37:56.051 [Cloud] Dequeued cloud request. 2026-09-29T03:37:56.051 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T03:38:06.144 [Cloud] End of cloud request. 2026-09-29T03:38:06.660 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T03:39:44.614 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 22113, Count: 1307, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T03:39:44.614 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 6339, Count: 543, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-29T03:39:44.614 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2800, Count: 233, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T03:39:44.614 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-29T03:39:44.614 ProcessImageName: AgentShellService.exe, Pid: 7992, TotalTime: 681, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53% 2026-09-29T03:39:44.614 ProcessImageName: WmiPrvSE.exe, Pid: 1060, TotalTime: 524, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\afd.sys, EstimatedImpact: 10% 2026-09-29T03:39:44.614 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-29T03:39:44.614 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 407, Count: 33, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T03:39:44.614 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T03:39:44.614 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-29T03:39:44.614 ProcessImageName: python.exe, Pid: 7464, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-29T03:39:44.614 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-29T03:39:44.614 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 60, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 0% 2026-09-29T03:39:44.614 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-29T03:39:44.614 ProcessImageName: DeviceCensus.exe, Pid: 3140, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 5% 2026-09-29T03:39:44.614 ProcessImageName: mysqldump.exe, Pid: 1840, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-29T03:39:44.614 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T03:39:44.614 ProcessImageName: cmd.exe, Pid: 2768, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-29T03:39:44.614 ProcessImageName: taskhostw.exe, Pid: 664, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-29T03:41:32.333 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T03:52:26.977 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T03:52:26.977 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T03:52:26.977 [Cloud] Queued cloud request. 2026-09-29T03:52:26.977 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T03:52:26.977 [Cloud] Dequeued cloud request. 2026-09-29T03:52:26.977 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T03:52:27.165 [Cloud] End of cloud request. 2026-09-29T03:52:27.680 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T03:56:37.339 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T03:59:09.622 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T03:59:09.622 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T03:59:09.622 [Cloud] Queued cloud request. 2026-09-29T03:59:09.622 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T03:59:09.622 [Cloud] Dequeued cloud request. 2026-09-29T03:59:09.622 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T03:59:09.825 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E162BC1F-0100-A9CF-B0B5-824D34852E0B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 03:59:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T03:59:10.341 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T04:09:19.470 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T04:09:19.470 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T04:09:19.470 [Cloud] Queued cloud request. 2026-09-29T04:09:19.470 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T04:09:19.470 [Cloud] Dequeued cloud request. 2026-09-29T04:09:19.470 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T04:09:19.611 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{86DB6B61-A9DE-054D-BEE2-6737D616C08B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 04:09:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T04:09:20.126 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T04:09:55.189 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T04:09:55.189 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T04:09:55.189 [Cloud] Queued cloud request. 2026-09-29T04:09:55.189 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T04:09:55.189 [Cloud] Dequeued cloud request. 2026-09-29T04:09:55.189 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T04:10:05.345 [Cloud] End of cloud request. 2026-09-29T04:10:05.845 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T04:11:42.345 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T04:26:47.352 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T04:40:36.999 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T04:40:36.999 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T04:40:36.999 [Cloud] Queued cloud request. 2026-09-29T04:40:36.999 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T04:40:36.999 [Cloud] Dequeued cloud request. 2026-09-29T04:40:36.999 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T04:40:37.186 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1D96CB6A-8D05-9410-02C4-8FE86A577D51} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 04:40:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T04:40:37.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T04:41:15.046 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T04:41:15.046 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T04:41:15.046 [Cloud] Queued cloud request. 2026-09-29T04:41:15.046 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T04:41:15.046 [Cloud] Dequeued cloud request. 2026-09-29T04:41:15.046 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T04:41:15.124 [Cloud] End of cloud request. 2026-09-29T04:41:15.639 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T04:41:52.359 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T04:56:57.364 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T05:03:22.758 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:03:22.758 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:03:22.758 [Cloud] Queued cloud request. 2026-09-29T05:03:22.758 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:03:22.758 [Cloud] Dequeued cloud request. 2026-09-29T05:03:22.758 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:03:22.914 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E0B4A2F0-23C9-6E81-F37B-6106D4E7511E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 05:03:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T05:03:23.429 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:04:26.726 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:04:26.726 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:04:26.726 [Cloud] Queued cloud request. 2026-09-29T05:04:26.726 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:04:26.726 [Cloud] Dequeued cloud request. 2026-09-29T05:04:26.726 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:04:26.867 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{14F58BF1-B021-668E-9D10-760048EEDA8E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 05:04:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T05:04:27.367 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:12:02.371 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T05:17:30.797 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:17:30.797 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:17:30.797 [Cloud] Queued cloud request. 2026-09-29T05:17:30.797 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:17:30.797 [Cloud] Dequeued cloud request. 2026-09-29T05:17:30.797 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:17:30.968 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{89AD9A24-B7FD-9E01-1A91-4AF24DC11268} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 05:17:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T05:17:31.468 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:20:26.094 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:20:26.094 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:20:26.094 [Cloud] Queued cloud request. 2026-09-29T05:20:26.094 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:20:26.094 [Cloud] Dequeued cloud request. 2026-09-29T05:20:26.094 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:20:26.344 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FE88D2E2-58CD-5FF1-FE97-E4E63DA2F857} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 05:20:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T05:20:26.844 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:24:20.720 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:24:20.720 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:24:20.720 [Cloud] Queued cloud request. 2026-09-29T05:24:20.720 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:24:20.720 [Cloud] Dequeued cloud request. 2026-09-29T05:24:20.720 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:24:20.861 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D07C4B10-5E14-89EF-72B7-F0DE09F8ED08} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 05:24:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T05:24:21.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:27:07.378 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T05:31:05.739 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:31:05.739 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:31:05.739 [Cloud] Queued cloud request. 2026-09-29T05:31:05.739 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:31:05.739 [Cloud] Dequeued cloud request. 2026-09-29T05:31:05.739 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:31:05.973 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C8F7C439-6C98-3451-A663-E1C1F0E941C3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 05:31:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T05:31:06.473 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:31:08.817 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:31:08.817 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:31:08.817 [Cloud] Queued cloud request. 2026-09-29T05:31:08.817 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:31:08.817 [Cloud] Dequeued cloud request. 2026-09-29T05:31:08.817 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:31:08.942 [Cloud] End of cloud request. 2026-09-29T05:31:09.442 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:31:27.395 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:31:27.395 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:31:27.395 [Cloud] Queued cloud request. 2026-09-29T05:31:27.395 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:31:27.395 [Cloud] Dequeued cloud request. 2026-09-29T05:31:27.395 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:31:27.473 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{194A4748-6626-3888-796C-3175E5E35239} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 05:31:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T05:31:27.989 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:35:11.631 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:35:11.631 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:35:11.631 [Cloud] Queued cloud request. 2026-09-29T05:35:11.631 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:35:11.631 [Cloud] Dequeued cloud request. 2026-09-29T05:35:11.631 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:35:11.803 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C32EEC5-C5CD-4836-24A4-BF3DF7D89FA6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 05:35:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T05:35:12.318 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:36:33.914 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:36:33.914 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:36:33.914 [Cloud] Queued cloud request. 2026-09-29T05:36:33.914 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:36:33.914 [Cloud] Dequeued cloud request. 2026-09-29T05:36:33.914 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:36:34.070 [Cloud] End of cloud request. 2026-09-29T05:36:34.586 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:39:44.665 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 27319, Count: 1748, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T05:39:44.665 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 8508, Count: 731, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-29T05:39:44.665 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2800, Count: 233, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T05:39:44.665 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-29T05:39:44.665 ProcessImageName: AgentShellService.exe, Pid: 7992, TotalTime: 681, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53% 2026-09-29T05:39:44.665 ProcessImageName: WmiPrvSE.exe, Pid: 1060, TotalTime: 524, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\afd.sys, EstimatedImpact: 10% 2026-09-29T05:39:44.665 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 452, Count: 37, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T05:39:44.665 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-29T05:39:44.665 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T05:39:44.665 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-29T05:39:44.665 ProcessImageName: python.exe, Pid: 7464, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-29T05:39:44.665 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-29T05:39:44.665 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 60, Count: 62, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 0% 2026-09-29T05:39:44.665 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-29T05:39:44.665 ProcessImageName: DeviceCensus.exe, Pid: 3140, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 5% 2026-09-29T05:39:44.665 ProcessImageName: mysqldump.exe, Pid: 1840, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-29T05:39:44.665 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T05:39:44.665 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-29T05:39:44.665 ProcessImageName: cmd.exe, Pid: 2768, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-29T05:39:44.665 ProcessImageName: taskhostw.exe, Pid: 664, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-29T05:39:44.665 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-29T05:42:12.385 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T05:53:14.295 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:53:14.295 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:53:14.295 [Cloud] Queued cloud request. 2026-09-29T05:53:14.295 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:53:14.295 [Cloud] Dequeued cloud request. 2026-09-29T05:53:14.295 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:53:14.483 [Cloud] End of cloud request. 2026-09-29T05:53:14.998 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:54:35.015 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:54:35.015 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:54:35.015 [Cloud] Queued cloud request. 2026-09-29T05:54:35.015 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:54:35.015 [Cloud] Dequeued cloud request. 2026-09-29T05:54:35.015 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:54:35.203 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CF05A91E-999F-3895-8F3C-2A8B0875CF0A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 05:54:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T05:54:35.719 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:56:15.969 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T05:56:15.969 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T05:56:15.969 [Cloud] Queued cloud request. 2026-09-29T05:56:15.969 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T05:56:15.969 [Cloud] Dequeued cloud request. 2026-09-29T05:56:15.969 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T05:56:16.172 [Cloud] End of cloud request. 2026-09-29T05:56:16.672 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T05:57:17.391 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T06:07:59.553 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T06:07:59.553 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T06:07:59.553 [Cloud] Queued cloud request. 2026-09-29T06:07:59.553 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T06:07:59.553 [Cloud] Dequeued cloud request. 2026-09-29T06:07:59.553 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T06:07:59.771 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4F3DC7AB-7DC0-D290-018B-C8A1EA90F3AD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 06:07:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T06:08:00.287 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T06:10:04.663 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T06:10:04.663 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T06:10:04.663 [Cloud] Queued cloud request. 2026-09-29T06:10:04.663 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T06:10:04.663 [Cloud] Dequeued cloud request. 2026-09-29T06:10:04.663 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T06:10:04.850 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D78E0DAC-AB9C-6DEC-93AB-8666A23C4ABA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 06:10:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T06:10:05.350 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T06:11:17.428 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T06:11:17.428 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T06:11:17.428 [Cloud] Queued cloud request. 2026-09-29T06:11:17.428 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T06:11:17.428 [Cloud] Dequeued cloud request. 2026-09-29T06:11:17.428 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T06:11:17.663 [Cloud] End of cloud request. 2026-09-29T06:11:18.178 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T06:12:22.397 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T06:15:41.305 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T06:15:41.305 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T06:15:41.305 [Cloud] Queued cloud request. 2026-09-29T06:15:41.305 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T06:15:41.305 [Cloud] Dequeued cloud request. 2026-09-29T06:15:41.305 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T06:15:41.524 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F3B39864-A227-0813-B6A3-ACD82CACC311} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 06:15:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T06:15:42.024 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T06:19:46.557 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T06:19:46.557 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T06:19:46.557 [Cloud] Queued cloud request. 2026-09-29T06:19:46.557 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T06:19:46.557 [Cloud] Dequeued cloud request. 2026-09-29T06:19:46.557 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T06:19:47.042 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F93671CE-2CFE-AC65-2422-4E08395BEDF6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 06:19:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T06:19:47.557 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T06:27:27.404 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T06:40:55.613 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T06:40:55.613 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T06:40:55.613 [Cloud] Queued cloud request. 2026-09-29T06:40:55.613 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T06:40:55.613 [Cloud] Dequeued cloud request. 2026-09-29T06:40:55.613 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T06:40:55.785 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6B9804AD-A086-F051-F13B-201CACB65841} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 06:40:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T06:40:56.300 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T06:42:32.410 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T06:55:43.995 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T06:55:43.995 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T06:55:43.995 [Cloud] Queued cloud request. 2026-09-29T06:55:43.995 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T06:55:43.995 [Cloud] Dequeued cloud request. 2026-09-29T06:55:43.995 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T06:55:44.276 [Cloud] End of cloud request. 2026-09-29T06:55:44.776 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T06:57:03.339 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T06:57:03.339 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T06:57:03.339 [Cloud] Queued cloud request. 2026-09-29T06:57:03.339 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T06:57:03.339 [Cloud] Dequeued cloud request. 2026-09-29T06:57:03.339 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T06:57:03.558 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{808362E3-1C27-5C97-5FAD-04716E83C0D5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 06:57:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T06:57:04.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T06:57:37.418 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T07:05:11.013 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T07:05:11.013 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T07:05:11.013 [Cloud] Queued cloud request. 2026-09-29T07:05:11.013 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T07:05:11.013 [Cloud] Dequeued cloud request. 2026-09-29T07:05:11.013 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T07:05:11.216 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8C282FEF-84BB-21A8-219D-5133AFF41A8C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 07:05:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T07:05:11.731 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T07:12:42.422 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T07:27:47.431 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T07:39:44.733 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 34036, Count: 2226, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T07:39:44.733 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 10629, Count: 907, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-29T07:39:44.733 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2800, Count: 233, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T07:39:44.733 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-29T07:39:44.733 ProcessImageName: AgentShellService.exe, Pid: 7992, TotalTime: 681, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53% 2026-09-29T07:39:44.733 ProcessImageName: WmiPrvSE.exe, Pid: 1060, TotalTime: 524, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\afd.sys, EstimatedImpact: 10% 2026-09-29T07:39:44.733 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 452, Count: 37, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T07:39:44.733 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-29T07:39:44.733 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T07:39:44.733 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-29T07:39:44.733 ProcessImageName: python.exe, Pid: 7464, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-29T07:39:44.733 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-29T07:39:44.733 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 66, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 0% 2026-09-29T07:39:44.733 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-29T07:39:44.733 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-29T07:39:44.733 ProcessImageName: DeviceCensus.exe, Pid: 3140, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 5% 2026-09-29T07:39:44.733 ProcessImageName: mysqldump.exe, Pid: 1840, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-29T07:39:44.733 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T07:39:44.733 ProcessImageName: cmd.exe, Pid: 2768, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-29T07:39:44.733 ProcessImageName: taskhostw.exe, Pid: 664, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-29T07:39:44.733 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-29T07:42:52.436 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T07:57:57.444 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T08:06:57.556 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T08:06:57.556 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T08:06:57.556 [Cloud] Queued cloud request. 2026-09-29T08:06:57.556 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T08:06:57.712 [Cloud] Dequeued cloud request. 2026-09-29T08:06:57.712 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T08:06:57.900 [Cloud] End of cloud request. 2026-09-29T08:06:58.400 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T08:09:58.324 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T08:09:58.324 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T08:09:58.324 [Cloud] Queued cloud request. 2026-09-29T08:09:58.324 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T08:09:58.324 [Cloud] Dequeued cloud request. 2026-09-29T08:09:58.480 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T08:09:58.668 [Cloud] End of cloud request. 2026-09-29T08:09:59.183 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T08:13:02.449 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T08:13:15.027 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T08:13:15.027 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T08:13:15.027 [Cloud] Queued cloud request. 2026-09-29T08:13:15.027 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T08:13:15.027 [Cloud] Dequeued cloud request. 2026-09-29T08:13:15.027 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T08:13:15.246 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B221F8E8-32DB-366E-4D89-4925B2E629B5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 08:13:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T08:13:15.746 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T08:14:02.215 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T08:14:02.215 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T08:14:02.215 [Cloud] Queued cloud request. 2026-09-29T08:14:02.215 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T08:14:02.215 [Cloud] Dequeued cloud request. 2026-09-29T08:14:02.215 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T08:14:02.371 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6701D4B2-900F-D04F-7C44-0DFB943F0049} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 08:14:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T08:14:02.871 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T08:17:39.313 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T08:17:39.313 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T08:17:39.313 [Cloud] Queued cloud request. 2026-09-29T08:17:39.313 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T08:17:39.313 [Cloud] Dequeued cloud request. 2026-09-29T08:17:39.313 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T08:17:39.469 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3542715F-43EB-DC37-3F2B-C43C8002BCC5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 08:17:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T08:17:39.969 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T08:28:07.458 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T08:31:19.396 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T08:31:19.396 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T08:31:19.396 [Cloud] Queued cloud request. 2026-09-29T08:31:19.396 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T08:31:19.396 [Cloud] Dequeued cloud request. 2026-09-29T08:31:19.396 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T08:31:19.584 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{301C48EF-BBAA-59DE-63D7-EFFA3970D7C4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 08:31:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T08:31:20.084 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T08:37:49.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T08:37:49.088 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T08:37:49.088 [Cloud] Queued cloud request. 2026-09-29T08:37:49.088 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T08:37:49.088 [Cloud] Dequeued cloud request. 2026-09-29T08:37:49.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{3D3FE645-7B51-9664-EFC6-F5D3C8627897} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 08:37:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T08:37:49.244 [Cloud] End of cloud request. 2026-09-29T08:37:49.744 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T08:40:34.510 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T08:40:34.510 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T08:40:34.510 [Cloud] Queued cloud request. 2026-09-29T08:40:34.510 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T08:40:34.510 [Cloud] Dequeued cloud request. 2026-09-29T08:40:34.510 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T08:40:34.666 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{80419A67-5D1B-34A6-2CB9-A96013C1A881} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 08:40:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T08:40:35.182 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T08:43:12.463 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T08:58:17.472 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T09:01:29.879 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T09:01:29.879 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T09:01:29.879 [Cloud] Queued cloud request. 2026-09-29T09:01:29.879 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T09:01:29.879 [Cloud] Dequeued cloud request. 2026-09-29T09:01:29.879 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T09:01:30.082 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{36BC6A18-07A7-1272-9AA9-2C1B3A8150D6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 09:01:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T09:01:30.597 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T09:02:25.488 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T09:02:25.488 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T09:02:25.488 [Cloud] Queued cloud request. 2026-09-29T09:02:25.488 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T09:02:25.488 [Cloud] Dequeued cloud request. 2026-09-29T09:02:25.488 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T09:02:25.566 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{001D38D6-8B30-F371-96FC-305E1CF99B56} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 09:02:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T09:02:26.082 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T09:04:43.334 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T09:04:43.334 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T09:04:43.334 [Cloud] Queued cloud request. 2026-09-29T09:04:43.334 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T09:04:43.334 [Cloud] Dequeued cloud request. 2026-09-29T09:04:43.334 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T09:04:43.599 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{557F282B-C5DC-5869-5DCF-37B7E8A831A7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 09:04:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T09:04:44.099 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{E1E2BA81-F5A6-DBB5-6B93-833EB9C7407D} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-29-2026 09:07:22 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T09:07:23.070 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T09:07:23.070 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T09:07:23.070 [Cloud] Queued cloud request. 2026-09-29T09:07:23.070 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T09:07:23.070 [Cloud] Dequeued cloud request. 2026-09-29T09:07:23.070 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T09:07:23.523 [Cloud] End of cloud request. 2026-09-29T09:07:24.039 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T09:08:21.352 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T09:08:21.352 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T09:08:21.352 [Cloud] Queued cloud request. 2026-09-29T09:08:21.352 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T09:08:21.352 [Cloud] Dequeued cloud request. 2026-09-29T09:08:21.352 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T09:08:31.384 [Cloud] End of cloud request. 2026-09-29T09:08:31.899 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T09:13:22.478 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T09:15:18.463 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T09:15:18.463 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T09:15:18.463 [Cloud] Queued cloud request. 2026-09-29T09:15:18.463 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T09:15:18.463 [Cloud] Dequeued cloud request. 2026-09-29T09:15:18.463 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T09:15:28.557 [Cloud] End of cloud request. 2026-09-29T09:15:29.073 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T09:18:01.685 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T09:18:01.685 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T09:18:01.685 [Cloud] Queued cloud request. 2026-09-29T09:18:01.685 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T09:18:01.685 [Cloud] Dequeued cloud request. 2026-09-29T09:18:01.685 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T09:18:01.842 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BF890C18-ED25-E13A-E42F-B0C54DA5D003} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 09:18:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T09:18:02.342 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T09:18:13.107 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T09:18:13.107 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T09:18:13.107 [Cloud] Queued cloud request. 2026-09-29T09:18:13.107 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T09:18:13.107 [Cloud] Dequeued cloud request. 2026-09-29T09:18:13.107 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T09:18:13.232 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5846832E-8C5D-FE53-6870-321B3AFCAB8D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 09:18:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T09:18:13.732 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T09:22:05.357 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T09:22:05.357 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T09:22:05.357 [Cloud] Queued cloud request. 2026-09-29T09:22:05.357 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T09:22:05.357 [Cloud] Dequeued cloud request. 2026-09-29T09:22:05.357 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T09:22:05.498 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DBA74015-D2BE-C835-1FD1-D019C80DDFB2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 09:22:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T09:22:05.998 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T09:28:27.487 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T09:31:23.035 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T09:31:23.035 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T09:31:23.035 [Cloud] Queued cloud request. 2026-09-29T09:31:23.035 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T09:31:23.035 [Cloud] Dequeued cloud request. 2026-09-29T09:31:23.035 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T09:31:23.192 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8954130E-AB6F-00F8-D9FC-C86BC22C668D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 09:31:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T09:31:23.692 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T09:39:44.805 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 39034, Count: 2556, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T09:39:44.805 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 12515, Count: 1081, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-29T09:39:44.805 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2800, Count: 233, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T09:39:44.805 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-29T09:39:44.805 ProcessImageName: AgentShellService.exe, Pid: 7992, TotalTime: 681, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53% 2026-09-29T09:39:44.805 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 542, Count: 45, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T09:39:44.805 ProcessImageName: WmiPrvSE.exe, Pid: 1060, TotalTime: 524, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\afd.sys, EstimatedImpact: 10% 2026-09-29T09:39:44.805 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-29T09:39:44.805 ProcessImageName: powershell.exe, Pid: 6580, TotalTime: 356, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 32% 2026-09-29T09:39:44.805 ProcessImageName: WmiPrvSE.exe, Pid: 7508, TotalTime: 256, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 28% 2026-09-29T09:39:44.805 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T09:39:44.805 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-29T09:39:44.805 ProcessImageName: python.exe, Pid: 7464, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-29T09:39:44.805 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-29T09:39:44.805 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 75, Count: 68, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 0% 2026-09-29T09:39:44.805 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-29T09:39:44.805 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-29T09:39:44.805 ProcessImageName: DeviceCensus.exe, Pid: 3140, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 5% 2026-09-29T09:39:44.805 ProcessImageName: mysqldump.exe, Pid: 1840, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-29T09:39:44.805 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T09:39:44.805 ProcessImageName: cmd.exe, Pid: 2768, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-29T09:39:44.805 ProcessImageName: python.exe, Pid: 1536, TotalTime: 15, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 0% 2026-09-29T09:39:44.805 ProcessImageName: taskhostw.exe, Pid: 664, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-29T09:39:44.805 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-29T09:40:58.571 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T09:40:58.571 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T09:40:58.571 [Cloud] Queued cloud request. 2026-09-29T09:40:58.571 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T09:40:58.571 [Cloud] Dequeued cloud request. 2026-09-29T09:40:58.571 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T09:40:58.711 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5FEB7AB8-6032-537F-2B50-EB5F5A2A9E06} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 09:40:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T09:40:59.211 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T09:43:32.492 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T09:51:49.231 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T09:51:49.231 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T09:51:49.231 [Cloud] Queued cloud request. 2026-09-29T09:51:49.231 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T09:51:49.231 [Cloud] Dequeued cloud request. 2026-09-29T09:51:49.231 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T09:51:49.419 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AFA71378-9AF1-012D-46D9-CCCE00F00BC2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 09:51:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T09:51:49.919 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T09:58:37.502 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T10:08:07.991 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T10:08:07.991 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T10:08:07.991 [Cloud] Queued cloud request. 2026-09-29T10:08:07.991 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T10:08:07.991 [Cloud] Dequeued cloud request. 2026-09-29T10:08:07.991 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T10:08:08.163 [Cloud] End of cloud request. 2026-09-29T10:08:08.663 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T10:10:43.601 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T10:10:43.601 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T10:10:43.601 [Cloud] Queued cloud request. 2026-09-29T10:10:43.601 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T10:10:43.601 [Cloud] Dequeued cloud request. 2026-09-29T10:10:43.601 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T10:10:43.757 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{94090D01-1FEF-6DF6-D3D8-E125CB921DB4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 10:10:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T10:10:44.257 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T10:13:42.507 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T10:18:16.402 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T10:18:16.402 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T10:18:16.402 [Cloud] Queued cloud request. 2026-09-29T10:18:16.402 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T10:18:16.402 [Cloud] Dequeued cloud request. 2026-09-29T10:18:16.402 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T10:18:16.559 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CA967FF6-DA97-CBBE-91FA-19DD5D2F6D35} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 10:18:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T10:18:17.059 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T10:28:47.517 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T10:32:17.876 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T10:32:17.876 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T10:32:17.876 [Cloud] Queued cloud request. 2026-09-29T10:32:17.876 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T10:32:17.876 [Cloud] Dequeued cloud request. 2026-09-29T10:32:17.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T10:32:18.110 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8F97C51E-9AF0-4DC2-7656-E3F0FD8776E3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 10:32:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T10:32:18.610 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T10:35:45.878 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T10:35:45.878 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T10:35:45.878 [Cloud] Queued cloud request. 2026-09-29T10:35:45.878 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T10:35:45.878 [Cloud] Dequeued cloud request. 2026-09-29T10:35:45.878 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T10:35:46.065 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{51A61E22-2422-3842-6C08-CE573BB7C3AF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 10:35:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T10:35:46.581 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T10:38:23.834 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T10:38:23.834 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T10:38:23.834 [Cloud] Queued cloud request. 2026-09-29T10:38:23.834 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T10:38:23.834 [Cloud] Dequeued cloud request. 2026-09-29T10:38:23.834 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T10:38:24.084 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F7F05597-F063-58B4-E133-D9BCE76D520D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 10:38:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T10:38:24.584 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T10:43:52.522 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T10:46:10.103 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T10:46:10.103 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T10:46:10.103 [Cloud] Queued cloud request. 2026-09-29T10:46:10.103 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T10:46:10.103 [Cloud] Dequeued cloud request. 2026-09-29T10:46:10.103 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T10:46:10.291 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{22593335-61FA-F73C-DE94-30E97BD0A1B6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 10:46:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T10:46:10.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T10:58:57.531 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T11:02:15.219 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T11:02:15.219 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T11:02:15.219 [Cloud] Queued cloud request. 2026-09-29T11:02:15.219 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T11:02:15.219 [Cloud] Dequeued cloud request. 2026-09-29T11:02:15.219 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T11:02:16.844 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E50D9B5D-FEAF-7622-3875-149CD4995023} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 11:02:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T11:02:17.344 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T11:14:02.538 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T11:16:27.492 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T11:16:27.492 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T11:16:27.492 [Cloud] Queued cloud request. 2026-09-29T11:16:27.492 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T11:16:27.492 [Cloud] Dequeued cloud request. 2026-09-29T11:16:27.492 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T11:16:27.820 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6C87D7A4-AF51-2BC0-C472-DB944CDA6F2A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 11:16:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T11:16:28.320 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T11:18:29.744 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T11:18:29.744 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T11:18:29.744 [Cloud] Queued cloud request. 2026-09-29T11:18:29.744 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T11:18:29.744 [Cloud] Dequeued cloud request. 2026-09-29T11:18:29.744 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T11:18:33.463 [Cloud] End of cloud request. 2026-09-29T11:18:33.963 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T11:23:33.729 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T11:23:33.729 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T11:23:33.729 [Cloud] Queued cloud request. 2026-09-29T11:23:33.729 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T11:23:33.979 [Cloud] Dequeued cloud request. 2026-09-29T11:23:33.979 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T11:23:34.276 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B6FC0D07-E88F-1508-5C19-16D53DE8F09A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 11:23:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T11:23:34.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T11:25:05.888 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T11:25:05.888 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T11:25:05.888 [Cloud] Queued cloud request. 2026-09-29T11:25:05.888 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T11:25:05.888 [Cloud] Dequeued cloud request. 2026-09-29T11:25:05.888 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T11:25:06.169 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{62FE5AA3-8CF6-DBD6-4CB8-E702ACE5A89F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 11:25:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T11:25:06.685 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T11:26:33.795 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T11:26:33.795 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T11:26:33.795 [Cloud] Queued cloud request. 2026-09-29T11:26:33.795 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T11:26:33.795 [Cloud] Dequeued cloud request. 2026-09-29T11:26:33.795 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T11:26:33.951 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F612CDC6-0AF5-42B5-68BD-CD8D08A5A1BC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 11:26:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T11:26:34.467 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T11:27:40.515 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T11:27:40.515 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T11:27:40.515 [Cloud] Queued cloud request. 2026-09-29T11:27:40.515 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T11:27:40.515 [Cloud] Dequeued cloud request. 2026-09-29T11:27:40.515 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T11:27:40.937 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{30A889E2-48D7-AD1F-2B74-F96CB50EAEC9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 11:27:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T11:27:41.452 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T11:29:07.547 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T11:32:37.765 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T11:32:37.765 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T11:32:37.765 [Cloud] Queued cloud request. 2026-09-29T11:32:37.765 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T11:32:37.765 [Cloud] Dequeued cloud request. 2026-09-29T11:32:37.765 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T11:32:37.953 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{57D70338-353C-A3C5-8899-7997E2D0900E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 11:32:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T11:32:38.469 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T11:39:44.863 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 41167, Count: 2586, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T11:39:44.863 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 14493, Count: 1256, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-29T11:39:44.863 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2800, Count: 233, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T11:39:44.863 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-29T11:39:44.863 ProcessImageName: AgentShellService.exe, Pid: 7992, TotalTime: 681, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53% 2026-09-29T11:39:44.863 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 618, Count: 49, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T11:39:44.863 ProcessImageName: WmiPrvSE.exe, Pid: 1060, TotalTime: 524, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\afd.sys, EstimatedImpact: 10% 2026-09-29T11:39:44.863 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-29T11:39:44.863 ProcessImageName: powershell.exe, Pid: 6580, TotalTime: 356, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 32% 2026-09-29T11:39:44.863 ProcessImageName: WmiPrvSE.exe, Pid: 7508, TotalTime: 256, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 28% 2026-09-29T11:39:44.863 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T11:39:44.863 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-29T11:39:44.863 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 90, Count: 70, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 0% 2026-09-29T11:39:44.863 ProcessImageName: python.exe, Pid: 7464, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-29T11:39:44.863 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-29T11:39:44.863 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 61, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-29T11:39:44.863 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-29T11:39:44.863 ProcessImageName: DeviceCensus.exe, Pid: 3140, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 5% 2026-09-29T11:39:44.863 ProcessImageName: mysqldump.exe, Pid: 1840, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-29T11:39:44.863 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T11:39:44.863 ProcessImageName: cmd.exe, Pid: 2768, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-29T11:39:44.863 ProcessImageName: python.exe, Pid: 1536, TotalTime: 15, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 0% 2026-09-29T11:39:44.863 ProcessImageName: taskhostw.exe, Pid: 664, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-29T11:39:44.863 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-29T11:44:12.553 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T11:45:16.209 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T11:45:16.209 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T11:45:16.209 [Cloud] Queued cloud request. 2026-09-29T11:45:16.209 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T11:45:16.209 [Cloud] Dequeued cloud request. 2026-09-29T11:45:16.209 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T11:45:16.366 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F1D8306D-E528-6480-EA48-47804AED6E85} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 11:45:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T11:45:16.866 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T11:52:07.541 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T11:52:07.541 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T11:52:07.541 [Cloud] Queued cloud request. 2026-09-29T11:52:07.541 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T11:52:07.541 [Cloud] Dequeued cloud request. 2026-09-29T11:52:07.541 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T11:52:07.697 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3E00FAEE-DE4C-79A0-12E6-BB0277D01C66} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 11:52:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T11:52:08.197 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T11:53:36.041 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T11:53:36.041 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T11:53:36.041 [Cloud] Queued cloud request. 2026-09-29T11:53:36.041 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T11:53:36.041 [Cloud] Dequeued cloud request. 2026-09-29T11:53:36.041 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T11:53:36.197 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{63431665-B959-9570-C28E-32984B926696} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 11:53:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T11:53:36.697 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T11:59:17.562 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T12:07:06.609 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T12:07:06.609 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T12:07:06.609 [Cloud] Queued cloud request. 2026-09-29T12:07:06.609 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T12:07:06.609 [Cloud] Dequeued cloud request. 2026-09-29T12:07:06.609 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T12:07:06.766 [Cloud] End of cloud request. 2026-09-29T12:07:07.281 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T12:14:22.566 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T12:26:33.106 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T12:26:33.106 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T12:26:33.106 [Cloud] Queued cloud request. 2026-09-29T12:26:33.106 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T12:26:33.106 [Cloud] Dequeued cloud request. 2026-09-29T12:26:33.106 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T12:26:33.372 [Cloud] End of cloud request. 2026-09-29T12:26:33.887 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T12:29:27.576 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T12:44:32.581 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T12:48:13.695 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T12:48:13.695 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T12:48:13.695 [Cloud] Queued cloud request. 2026-09-29T12:48:13.695 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T12:48:13.695 [Cloud] Dequeued cloud request. 2026-09-29T12:48:13.695 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T12:48:13.836 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{098ACE7A-F724-37C3-141B-3882CBEEAEF4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 12:48:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T12:48:14.352 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T12:52:19.789 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T12:52:19.789 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T12:52:19.789 [Cloud] Queued cloud request. 2026-09-29T12:52:19.789 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T12:52:19.789 [Cloud] Dequeued cloud request. 2026-09-29T12:52:19.789 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T12:52:19.961 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8E8072F7-BE9F-A43F-5EF0-E980E87C73E4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 12:52:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T12:52:20.477 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T12:57:31.153 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T12:57:31.153 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T12:57:31.153 [Cloud] Queued cloud request. 2026-09-29T12:57:31.153 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T12:57:31.153 [Cloud] Dequeued cloud request. 2026-09-29T12:57:31.153 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T12:57:31.309 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{270A5CB7-4467-C28F-CC67-FD839E404E62} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 12:57:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T12:57:31.809 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T12:59:37.591 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T13:03:30.591 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T13:03:30.591 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T13:03:30.591 [Cloud] Queued cloud request. 2026-09-29T13:03:30.591 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T13:03:30.591 [Cloud] Dequeued cloud request. 2026-09-29T13:03:30.591 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T13:03:42.450 [Cloud] End of cloud request. 2026-09-29T13:03:42.966 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T13:12:32.424 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T13:12:32.424 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T13:12:32.424 [Cloud] Queued cloud request. 2026-09-29T13:12:32.424 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T13:12:32.424 [Cloud] Dequeued cloud request. 2026-09-29T13:12:32.424 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T13:12:32.830 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D082C609-CC44-9111-136C-69E0DA8EFD68} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 13:12:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T13:12:33.346 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T13:14:17.580 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T13:14:17.580 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T13:14:17.580 [Cloud] Queued cloud request. 2026-09-29T13:14:17.580 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T13:14:17.580 [Cloud] Dequeued cloud request. 2026-09-29T13:14:17.580 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T13:14:17.737 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9758DC11-4623-9866-7278-8D1DB41483A0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 13:14:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T13:14:18.237 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T13:14:42.596 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T13:15:52.534 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T13:15:52.534 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T13:15:52.534 [Cloud] Queued cloud request. 2026-09-29T13:15:52.534 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T13:15:52.534 [Cloud] Dequeued cloud request. 2026-09-29T13:15:52.534 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{07B36028-CB4D-9600-4993-28391D4EEB59} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 13:15:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T13:15:52.691 [Cloud] End of cloud request. 2026-09-29T13:15:53.191 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T13:24:52.101 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T13:24:52.101 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T13:24:52.101 [Cloud] Queued cloud request. 2026-09-29T13:24:52.101 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T13:24:52.101 [Cloud] Dequeued cloud request. 2026-09-29T13:24:52.101 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T13:24:52.460 [Cloud] End of cloud request. 2026-09-29T13:24:52.961 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T13:27:55.402 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T13:27:55.402 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T13:27:55.402 [Cloud] Queued cloud request. 2026-09-29T13:27:55.402 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T13:27:55.402 [Cloud] Dequeued cloud request. 2026-09-29T13:27:55.402 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T13:27:55.590 [Cloud] End of cloud request. 2026-09-29T13:27:56.106 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T13:29:47.606 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T13:36:54.499 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T13:36:54.499 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T13:36:54.499 [Cloud] Queued cloud request. 2026-09-29T13:36:54.499 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T13:36:54.499 [Cloud] Dequeued cloud request. 2026-09-29T13:36:54.499 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T13:36:54.655 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{108B1E4A-1346-0A7B-3148-7D6E07E610EE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 13:36:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T13:36:55.155 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T13:39:44.924 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 41198, Count: 2588, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T13:39:44.924 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 16662, Count: 1424, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-29T13:39:44.924 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2800, Count: 233, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T13:39:44.924 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-29T13:39:44.924 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 724, Count: 56, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T13:39:44.924 ProcessImageName: AgentShellService.exe, Pid: 7992, TotalTime: 681, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53% 2026-09-29T13:39:44.924 ProcessImageName: WmiPrvSE.exe, Pid: 1060, TotalTime: 524, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\afd.sys, EstimatedImpact: 10% 2026-09-29T13:39:44.924 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-29T13:39:44.924 ProcessImageName: powershell.exe, Pid: 6580, TotalTime: 356, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 32% 2026-09-29T13:39:44.924 ProcessImageName: WmiPrvSE.exe, Pid: 7508, TotalTime: 256, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 28% 2026-09-29T13:39:44.924 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T13:39:44.924 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 105, Count: 72, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 0% 2026-09-29T13:39:44.924 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-29T13:39:44.924 ProcessImageName: python.exe, Pid: 7464, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-29T13:39:44.924 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-29T13:39:44.924 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 76, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-29T13:39:44.924 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-29T13:39:44.924 ProcessImageName: DeviceCensus.exe, Pid: 3140, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 5% 2026-09-29T13:39:44.924 ProcessImageName: mysqldump.exe, Pid: 1840, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-29T13:39:44.924 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T13:39:44.924 ProcessImageName: cmd.exe, Pid: 2768, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-29T13:39:44.924 ProcessImageName: python.exe, Pid: 1536, TotalTime: 15, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 0% 2026-09-29T13:39:44.924 ProcessImageName: taskhostw.exe, Pid: 664, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-29T13:39:44.924 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-29T13:43:07.533 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T13:43:07.533 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T13:43:07.533 [Cloud] Queued cloud request. 2026-09-29T13:43:07.533 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T13:43:07.533 [Cloud] Dequeued cloud request. 2026-09-29T13:43:07.533 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T13:43:07.986 [Cloud] End of cloud request. 2026-09-29T13:43:08.486 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T13:44:52.611 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T13:51:33.819 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T13:51:33.819 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T13:51:33.819 [Cloud] Queued cloud request. 2026-09-29T13:51:33.819 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T13:51:33.819 [Cloud] Dequeued cloud request. 2026-09-29T13:51:33.819 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T13:51:34.022 [Cloud] End of cloud request. 2026-09-29T13:51:34.538 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T13:59:57.621 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T14:01:34.325 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T14:01:34.325 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T14:01:34.325 [Cloud] Queued cloud request. 2026-09-29T14:01:34.325 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T14:01:34.325 [Cloud] Dequeued cloud request. 2026-09-29T14:01:34.325 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T14:01:38.012 [Cloud] End of cloud request. 2026-09-29T14:01:38.512 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T14:15:02.626 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T14:16:43.458 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T14:16:43.458 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T14:16:43.458 [Cloud] Queued cloud request. 2026-09-29T14:16:43.458 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T14:16:43.661 [Cloud] Dequeued cloud request. 2026-09-29T14:16:43.864 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T14:16:53.973 [Cloud] End of cloud request. 2026-09-29T14:16:54.473 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T14:19:56.271 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T14:19:56.271 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T14:19:56.271 [Cloud] Queued cloud request. 2026-09-29T14:19:56.271 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T14:19:56.271 [Cloud] Dequeued cloud request. 2026-09-29T14:19:56.271 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T14:19:56.428 [Cloud] End of cloud request. 2026-09-29T14:19:56.943 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T14:26:37.431 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T14:26:37.431 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T14:26:37.431 [Cloud] Queued cloud request. 2026-09-29T14:26:37.431 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T14:26:37.619 [Cloud] Dequeued cloud request. 2026-09-29T14:26:37.619 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T14:26:37.806 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1D7A9D53-66F1-540D-DC7B-ECA43077FABD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 14:26:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T14:26:38.322 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T14:30:07.636 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T14:34:57.341 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T14:34:57.341 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T14:34:57.341 [Cloud] Queued cloud request. 2026-09-29T14:34:57.341 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T14:34:57.341 [Cloud] Dequeued cloud request. 2026-09-29T14:34:57.341 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T14:34:57.544 [Cloud] End of cloud request. 2026-09-29T14:34:58.044 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T14:36:57.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T14:36:57.904 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T14:36:57.904 [Cloud] Queued cloud request. 2026-09-29T14:36:57.904 [Cloud] Dequeued cloud request. 2026-09-29T14:36:57.904 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T14:36:57.904 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T14:36:58.107 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9674C720-3B9D-8ABE-947D-70B7002CDB9C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 14:36:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T14:36:58.622 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T14:43:10.735 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T14:43:10.735 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T14:43:10.735 [Cloud] Queued cloud request. 2026-09-29T14:43:10.735 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T14:43:10.735 [Cloud] Dequeued cloud request. 2026-09-29T14:43:10.735 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T14:43:10.923 [Cloud] End of cloud request. 2026-09-29T14:43:11.423 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T14:45:12.642 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T14:59:24.901 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T14:59:24.901 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T14:59:24.901 [Cloud] Queued cloud request. 2026-09-29T14:59:24.901 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T14:59:24.901 [Cloud] Dequeued cloud request. 2026-09-29T14:59:24.901 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T14:59:25.151 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{06DCBBAA-87B1-9429-C2A4-4C77B1440F42} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 14:59:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T14:59:25.651 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T15:00:17.651 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T15:15:18.408 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T15:15:18.408 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T15:15:18.408 [Cloud] Queued cloud request. 2026-09-29T15:15:18.408 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T15:15:18.408 [Cloud] Dequeued cloud request. 2026-09-29T15:15:18.408 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T15:15:18.595 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2520B771-678B-DB8E-C099-F514A3F70A80} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 15:15:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T15:15:19.095 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T15:15:22.658 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T15:21:50.849 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T15:21:50.849 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T15:21:50.849 [Cloud] Queued cloud request. 2026-09-29T15:21:50.849 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T15:21:50.849 [Cloud] Dequeued cloud request. 2026-09-29T15:21:50.849 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T15:21:51.036 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C2F637E9-8B56-ADC4-6A5C-EAA964EE86F7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 15:21:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T15:21:51.536 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T15:22:23.974 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T15:22:23.974 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T15:22:23.974 [Cloud] Queued cloud request. 2026-09-29T15:22:23.974 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T15:22:23.974 [Cloud] Dequeued cloud request. 2026-09-29T15:22:23.974 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T15:22:24.052 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D6E84AAD-B490-04B1-084E-AAE4E6E21EDF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 15:22:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T15:22:24.552 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T15:23:42.208 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T15:23:42.208 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T15:23:42.208 [Cloud] Queued cloud request. 2026-09-29T15:23:42.208 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T15:23:42.208 [Cloud] Dequeued cloud request. 2026-09-29T15:23:42.208 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T15:23:42.380 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C0D8AFE5-7C5C-B7AF-0A4C-BCF290500EEF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 15:23:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T15:23:42.880 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T15:25:31.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T15:25:31.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T15:25:31.304 [Cloud] Queued cloud request. 2026-09-29T15:25:31.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T15:25:31.304 [Cloud] Dequeued cloud request. 2026-09-29T15:25:31.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T15:25:31.491 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FDD917F7-E7C6-C317-9CC5-B023E207E2DF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 15:25:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T15:25:31.991 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T15:27:09.414 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T15:27:09.414 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T15:27:09.414 [Cloud] Queued cloud request. 2026-09-29T15:27:09.414 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T15:27:09.414 [Cloud] Dequeued cloud request. 2026-09-29T15:27:09.414 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T15:27:09.617 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{97B86A78-173E-2184-2B64-4A8E31B83DB1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 15:27:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T15:27:10.133 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T15:30:27.666 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T15:39:44.998 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 41702, Count: 2616, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T15:39:44.998 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 18814, Count: 1591, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-29T15:39:44.998 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2800, Count: 233, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T15:39:44.998 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-29T15:39:44.998 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 860, Count: 66, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T15:39:44.998 ProcessImageName: AgentShellService.exe, Pid: 7992, TotalTime: 681, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53% 2026-09-29T15:39:44.998 ProcessImageName: WmiPrvSE.exe, Pid: 1060, TotalTime: 524, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\afd.sys, EstimatedImpact: 10% 2026-09-29T15:39:44.998 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-29T15:39:44.998 ProcessImageName: powershell.exe, Pid: 6580, TotalTime: 356, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 32% 2026-09-29T15:39:44.998 ProcessImageName: WmiPrvSE.exe, Pid: 7508, TotalTime: 256, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 28% 2026-09-29T15:39:44.998 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T15:39:44.998 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 76, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 0% 2026-09-29T15:39:44.998 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-29T15:39:44.998 ProcessImageName: python.exe, Pid: 7464, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-29T15:39:44.998 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-29T15:39:44.998 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 76, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-29T15:39:44.998 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 6604, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log->(UTF-16LE), EstimatedImpact: 39% 2026-09-29T15:39:44.998 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-29T15:39:44.998 ProcessImageName: DeviceCensus.exe, Pid: 3140, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 5% 2026-09-29T15:39:44.998 ProcessImageName: mysqldump.exe, Pid: 1840, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-29T15:39:44.998 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T15:39:44.998 ProcessImageName: cmd.exe, Pid: 2768, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-29T15:39:44.998 ProcessImageName: python.exe, Pid: 1536, TotalTime: 15, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 0% 2026-09-29T15:39:44.998 ProcessImageName: taskhostw.exe, Pid: 664, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-29T15:39:44.998 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-29T15:42:22.842 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T15:42:22.842 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T15:42:22.842 [Cloud] Queued cloud request. 2026-09-29T15:42:22.842 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T15:42:22.842 [Cloud] Dequeued cloud request. 2026-09-29T15:42:22.842 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T15:42:22.998 [Cloud] End of cloud request. 2026-09-29T15:42:23.514 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T15:45:32.671 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T15:45:46.734 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T15:45:46.734 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T15:45:46.734 [Cloud] Queued cloud request. 2026-09-29T15:45:46.734 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T15:45:46.734 [Cloud] Dequeued cloud request. 2026-09-29T15:45:46.734 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T15:45:46.875 [Cloud] End of cloud request. 2026-09-29T15:45:47.375 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T15:53:23.317 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T15:53:23.317 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T15:53:23.317 [Cloud] Queued cloud request. 2026-09-29T15:53:23.317 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T15:53:23.317 [Cloud] Dequeued cloud request. 2026-09-29T15:53:23.317 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T15:53:23.505 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AD04304C-59CD-ECDB-9DC7-F75F29F55BB3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 15:53:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T15:53:24.020 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T16:00:37.681 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T16:00:52.025 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T16:00:52.025 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T16:00:52.025 [Cloud] Queued cloud request. 2026-09-29T16:00:52.025 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T16:00:52.025 [Cloud] Dequeued cloud request. 2026-09-29T16:00:52.025 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T16:00:52.212 [Cloud] End of cloud request. 2026-09-29T16:00:52.712 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T16:11:27.529 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T16:11:27.529 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T16:11:27.529 [Cloud] Queued cloud request. 2026-09-29T16:11:27.529 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T16:11:27.529 [Cloud] Dequeued cloud request. 2026-09-29T16:11:27.529 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T16:11:27.686 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F437519-BDF1-D68F-AB8E-2DC0DA2BA574} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 16:11:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T16:11:28.201 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T16:13:15.967 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T16:13:15.967 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T16:13:15.967 [Cloud] Queued cloud request. 2026-09-29T16:13:15.967 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T16:13:15.967 [Cloud] Dequeued cloud request. 2026-09-29T16:13:15.967 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T16:13:16.108 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A82F3984-92AD-0D2E-5539-4173A70026E0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 16:13:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T16:13:16.608 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T16:14:24.733 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T16:14:24.733 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T16:14:24.733 [Cloud] Queued cloud request. 2026-09-29T16:14:24.733 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T16:14:24.733 [Cloud] Dequeued cloud request. 2026-09-29T16:14:24.733 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T16:14:24.889 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B7183453-43C0-D9A7-6CF4-EDECA01FAB66} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 16:14:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T16:14:25.389 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T16:15:42.687 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T16:26:01.927 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T16:26:01.927 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T16:26:01.927 [Cloud] Queued cloud request. 2026-09-29T16:26:01.927 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T16:26:01.927 [Cloud] Dequeued cloud request. 2026-09-29T16:26:01.927 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T16:26:02.114 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FE162008-4609-FD2B-ABC9-B9146EF82666} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 16:26:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T16:26:02.630 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T16:28:37.977 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T16:28:37.977 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T16:28:37.977 [Cloud] Queued cloud request. 2026-09-29T16:28:37.977 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T16:28:37.977 [Cloud] Dequeued cloud request. 2026-09-29T16:28:37.977 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T16:28:38.164 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BDC83D2E-8725-C0AB-E9DC-E4F0987307A8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 16:28:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T16:28:38.664 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T16:29:16.274 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T16:29:16.274 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T16:29:16.274 [Cloud] Queued cloud request. 2026-09-29T16:29:16.274 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T16:29:16.274 [Cloud] Dequeued cloud request. 2026-09-29T16:29:16.274 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T16:29:26.305 [Cloud] End of cloud request. 2026-09-29T16:29:26.805 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T16:30:47.696 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T16:39:14.310 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T16:39:14.310 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T16:39:14.310 [Cloud] Queued cloud request. 2026-09-29T16:39:14.310 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T16:39:14.310 [Cloud] Dequeued cloud request. 2026-09-29T16:39:14.310 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T16:39:14.466 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7F408390-9CF7-6070-B9E9-148048D4FF88} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 16:39:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T16:39:14.982 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T16:44:38.357 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T16:44:38.357 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T16:44:38.357 [Cloud] Queued cloud request. 2026-09-29T16:44:38.357 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T16:44:38.357 [Cloud] Dequeued cloud request. 2026-09-29T16:44:38.357 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T16:44:38.514 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BBE32960-30CE-C66B-9EBA-6E27923720DC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 16:44:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T16:44:39.014 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T16:45:52.701 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T17:00:57.710 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T17:02:00.649 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T17:02:00.649 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T17:02:00.649 [Cloud] Queued cloud request. 2026-09-29T17:02:00.649 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T17:02:00.836 [Cloud] Dequeued cloud request. 2026-09-29T17:02:00.836 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T17:02:06.149 [Cloud] End of cloud request. 2026-09-29T17:02:06.649 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T17:15:25.982 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T17:15:25.982 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T17:15:25.982 [Cloud] Queued cloud request. 2026-09-29T17:15:25.982 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T17:15:25.982 [Cloud] Dequeued cloud request. 2026-09-29T17:15:25.982 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T17:15:26.169 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A3968071-9101-707F-8FC6-DBD3723D213B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 17:15:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T17:15:26.685 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T17:16:02.717 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T17:18:52.111 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T17:18:52.111 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T17:18:52.111 [Cloud] Queued cloud request. 2026-09-29T17:18:52.111 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T17:18:52.111 [Cloud] Dequeued cloud request. 2026-09-29T17:18:52.111 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T17:19:02.205 [Cloud] End of cloud request. 2026-09-29T17:19:02.720 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T17:19:06.986 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T17:19:06.986 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T17:19:06.986 [Cloud] Queued cloud request. 2026-09-29T17:19:06.986 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T17:19:06.986 [Cloud] Dequeued cloud request. 2026-09-29T17:19:06.986 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T17:19:07.314 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D545A6E3-8237-15CD-E76C-A177F86A058F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 17:19:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T17:19:07.814 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T17:27:30.693 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T17:27:30.693 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T17:27:30.693 [Cloud] Queued cloud request. 2026-09-29T17:27:30.693 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T17:27:30.693 [Cloud] Dequeued cloud request. 2026-09-29T17:27:30.693 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T17:27:30.849 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{31BD76A3-76E0-D9C6-B450-BA0AD40CA644} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 17:27:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T17:27:31.349 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T17:28:40.803 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T17:28:40.803 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T17:28:40.803 [Cloud] Queued cloud request. 2026-09-29T17:28:40.803 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T17:28:40.803 [Cloud] Dequeued cloud request. 2026-09-29T17:28:40.803 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T17:28:40.944 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2FC18B08-054B-0A28-C28E-CAF44CE1279D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 17:28:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T17:28:41.444 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T17:31:07.725 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T17:33:21.631 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T17:33:21.631 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T17:33:21.631 [Cloud] Queued cloud request. 2026-09-29T17:33:21.631 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T17:33:21.631 [Cloud] Dequeued cloud request. 2026-09-29T17:33:21.631 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T17:33:31.709 [Cloud] End of cloud request. 2026-09-29T17:33:32.225 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T17:39:45.058 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 42308, Count: 2653, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T17:39:45.058 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 20901, Count: 1758, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-29T17:39:45.058 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2800, Count: 233, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T17:39:45.058 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-29T17:39:45.058 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 936, Count: 70, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T17:39:45.058 ProcessImageName: AgentShellService.exe, Pid: 7992, TotalTime: 681, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53% 2026-09-29T17:39:45.058 ProcessImageName: WmiPrvSE.exe, Pid: 1060, TotalTime: 524, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\afd.sys, EstimatedImpact: 10% 2026-09-29T17:39:45.058 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-29T17:39:45.058 ProcessImageName: powershell.exe, Pid: 6580, TotalTime: 356, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 32% 2026-09-29T17:39:45.058 ProcessImageName: WmiPrvSE.exe, Pid: 7508, TotalTime: 256, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 28% 2026-09-29T17:39:45.058 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T17:39:45.058 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 76, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 0% 2026-09-29T17:39:45.058 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-29T17:39:45.058 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-29T17:39:45.058 ProcessImageName: python.exe, Pid: 7464, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-29T17:39:45.058 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-29T17:39:45.058 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 6604, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log->(UTF-16LE), EstimatedImpact: 39% 2026-09-29T17:39:45.058 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-29T17:39:45.058 ProcessImageName: DeviceCensus.exe, Pid: 3140, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 5% 2026-09-29T17:39:45.058 ProcessImageName: mysqldump.exe, Pid: 1840, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-29T17:39:45.058 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T17:39:45.058 ProcessImageName: cmd.exe, Pid: 2768, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-29T17:39:45.058 ProcessImageName: python.exe, Pid: 1536, TotalTime: 15, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 0% 2026-09-29T17:39:45.058 ProcessImageName: taskhostw.exe, Pid: 664, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-29T17:39:45.058 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-29T17:46:12.732 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T17:51:03.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T17:51:03.672 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T17:51:03.672 [Cloud] Queued cloud request. 2026-09-29T17:51:03.672 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T17:51:03.672 [Cloud] Dequeued cloud request. 2026-09-29T17:51:03.672 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T17:51:03.828 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6181474F-89FA-011F-BB83-AF924A3DAC1A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 17:51:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T17:51:04.328 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T17:55:12.502 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T17:55:12.502 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T17:55:12.502 [Cloud] Queued cloud request. 2026-09-29T17:55:12.502 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T17:55:12.502 [Cloud] Dequeued cloud request. 2026-09-29T17:55:12.502 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T17:55:12.658 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B2EAF845-B4E3-98D5-CFA7-070412F59EAF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 17:55:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T17:55:13.158 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T18:01:17.740 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T18:05:21.194 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T18:05:21.194 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T18:05:21.194 [Cloud] Queued cloud request. 2026-09-29T18:05:21.194 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T18:05:21.194 [Cloud] Dequeued cloud request. 2026-09-29T18:05:21.194 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T18:05:21.365 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DF70A1BA-A1DC-3F1B-6F2A-A289E75C8D1D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 18:05:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T18:05:21.865 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T18:16:22.748 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T18:21:51.344 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T18:21:51.344 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T18:21:51.344 [Cloud] Queued cloud request. 2026-09-29T18:21:51.344 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T18:21:51.344 [Cloud] Dequeued cloud request. 2026-09-29T18:21:51.344 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T18:21:51.594 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6DB7A965-C953-E898-6916-E362A7DADC5E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 18:21:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T18:21:52.094 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T18:22:57.610 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T18:22:57.610 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T18:22:57.610 [Cloud] Queued cloud request. 2026-09-29T18:22:57.610 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T18:22:57.610 [Cloud] Dequeued cloud request. 2026-09-29T18:22:57.610 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T18:22:57.782 [Cloud] End of cloud request. 2026-09-29T18:22:58.282 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T18:31:27.755 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T18:43:00.260 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T18:43:00.260 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T18:43:00.260 [Cloud] Queued cloud request. 2026-09-29T18:43:00.260 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T18:43:00.260 [Cloud] Dequeued cloud request. 2026-09-29T18:43:00.260 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T18:43:00.447 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0A8CCF11-D4BF-4EC5-FB49-B01A606D1A89} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 18:43:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T18:43:00.963 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T18:46:32.761 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T19:01:37.770 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T19:01:48.723 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T19:01:48.723 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T19:01:48.723 [Cloud] Queued cloud request. 2026-09-29T19:01:48.723 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T19:01:48.723 [Cloud] Dequeued cloud request. 2026-09-29T19:01:48.723 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T19:01:48.973 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3935ED67-375D-E5F7-2FE9-8FAD1E378484} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 19:01:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T19:01:49.473 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T19:03:45.895 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T19:03:45.895 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T19:03:45.895 [Cloud] Queued cloud request. 2026-09-29T19:03:45.895 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T19:03:45.895 [Cloud] Dequeued cloud request. 2026-09-29T19:03:45.895 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T19:03:46.067 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1789EC29-7F58-FACC-E1F1-F2DAD225CCDD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 19:03:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T19:03:46.582 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T19:04:48.707 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T19:04:48.707 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T19:04:48.707 [Cloud] Queued cloud request. 2026-09-29T19:04:48.707 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T19:04:48.707 [Cloud] Dequeued cloud request. 2026-09-29T19:04:48.707 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T19:04:48.879 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{55FA8934-5A37-E78D-4920-A99BD6468098} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 19:04:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T19:04:49.395 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T19:06:20.380 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T19:06:20.380 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T19:06:20.380 [Cloud] Queued cloud request. 2026-09-29T19:06:20.380 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T19:06:20.380 [Cloud] Dequeued cloud request. 2026-09-29T19:06:20.380 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T19:06:20.552 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5000C202-6925-9FAA-52BF-010C7626A6F2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 19:06:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T19:06:21.068 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T19:16:42.778 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T19:31:47.785 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T19:35:39.037 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T19:35:39.037 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T19:35:39.037 [Cloud] Queued cloud request. 2026-09-29T19:35:39.037 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T19:35:39.037 [Cloud] Dequeued cloud request. 2026-09-29T19:35:39.037 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T19:35:39.209 [Cloud] End of cloud request. 2026-09-29T19:35:39.709 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T19:39:17.789 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-29T19:39:17.820 Job Notification: New process added to job (6948) 2026-09-29T19:39:17.836 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-29T19:39:17.836 Aggressive catchup quick scan threshold: 660099757633 / 25920000000000 2026-09-29T19:39:17.836 Job Notification: New process added to job (8160) 2026-09-29T19:39:17.852 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:6948] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:8160]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-29T19:39:17.992 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-29T19:39:17.992 Job Notification: New process added to job (2952) 2026-09-29T19:39:17.992 Job Notification: New process added to job (8056) 2026-09-29T19:39:18.070 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:2952] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:8056]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-29T19:39:18.195 Job Notification: New process added to job (2088) 2026-09-29T19:39:18.289 Task(GetDeviceTicket -AccessKey FEF60E70-7D44-73B5-FEC0-CB5963A23A8D ) launched as network service 2026-09-29T19:39:18.352 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-29T19:39:18.352 [RTP] Duplicating the current plugin configuration object... 2026-09-29T19:39:18.352 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-29T19:39:18.352 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-29T19:39:18.352 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-29T19:39:18.352 [RTP] No config change detected. Not updating plugin configuration. 2026-09-29T19:39:18.352 [RTP] No config changes found. No configuration switch. 2026-09-29T19:39:18.352 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-29T19:39:18.820 Job Notification: Process exited from job (2088) 2026-09-29T19:39:18.977 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-29T19:39:18.977 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T19:39:18.977 [Cloud] Queued cloud request. 2026-09-29T19:39:18.977 [Cloud] Dequeued cloud request. 2026-09-29T19:39:18.977 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T19:39:19.102 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-29T19:39:19.102 [Cloud] End of cloud request. 2026-09-29T19:39:19.492 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T19:39:30.977 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\EAD3B5C1-C0D8-42F3-99ED-D66EF11C62E318cc.1dd504a3d2f7dce 2026-09-29T19:39:31.055 Verifying engine and signature files (source: 0) ... 2026-09-29T19:39:31.055 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378}\mpengine.dll] due to PPL. 2026-09-29T19:39:31.055 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378}\mpasbase.vdm]. File not in cache (0x1) 2026-09-29T19:39:31.992 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378}\mpasbase.vdm] 2026-09-29T19:39:31.992 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-29T19:39:32.039 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378}\mpasdlta.vdm] 2026-09-29T19:39:32.039 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378}\mpavbase.vdm]. File not in cache (0x1) 2026-09-29T19:39:32.461 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378}\mpavbase.vdm] 2026-09-29T19:39:32.461 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-29T19:39:32.492 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378}\mpavdlta.vdm] 2026-09-29T19:39:32.696 [Engine] IsHybridMode: 0 2026-09-29T19:39:32.696 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-29T19:39:32.711 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-DD678CCD1F05E1121C58038939FF4091D05098E1.bin): 0x00000002 2026-09-29T19:39:32.711 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-DD678CCD1F05E1121C58038939FF4091D05098E1.bin) 2026-09-29T19:39:32.711 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-29T19:39:32.711 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-29T19:39:32.711 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-29T19:39:32.711 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-29T19:39:44.571 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-29T19:39:44.571 [AutoExclusion] Applied roles from cache. 2026-09-29T19:39:44.571 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-29T19:39:44.711 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF4ABB020, lRefCount: 6, hr=0 2026-09-29T19:39:44.711 [Engine] New active engine 00007FFCF68AB020 replacing engine 00007FFCF4ABB020. Number of active engines: 2 2026-09-29T19:39:44.727 EngineInit:Global ASOC is enabled 2026-09-29T19:39:44.727 EngineInit:ASOO is enabled for developer volumes 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.821 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-29T19:39:44.852 MpWriteUupSignatureVersion 1.459.466.0, hr = 0 2026-09-29T19:39:44.852 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-29T19:39:44.883 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-29T19:39:44.883 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-29T19:39:44.883 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-29T19:39:44.883 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-29T19:39:44.915 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-29T19:39:44.915 [Plugin] Initializing RTP plugin state... 2026-09-29T19:39:44.915 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-29T19:39:44.915 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎28‎-‎2026 21:39:44 Last Perf:‎09‎-‎28‎-‎2026 21:39:44 First RTP Scan:‎09‎-‎28‎-‎2026 21:39:45 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1696 Misses:8346 BM Queue:0,217,0 Proc:0,26,0 File:0,217,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:1,3,0 SetEngine:1,1,0 SetState:0,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:5348436 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:1149393020 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:4014 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:263183 TotalHits:2869919 InstanceCacheInserts:33827 InstanceCacheUpdates:0 InstanceCacheDeletes:19584 InstanceCacheHits:1262 InstanceCacheMisses:145947 InstanceCacheOverflows:12907 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:4ms (7376/1508) Success: 1508, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-29T19:39:44.915 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378} 2026-09-29T19:39:44.915 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094}\mpasbase.vdm in use, hr=0x80070020 2026-09-29T19:39:44.915 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DE51A2E8-A050-46C5-9365-F5F1A6304364} removed 2026-09-29T19:39:44.915 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-29T19:39:44.915 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-29T19:39:44.915 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-29T19:39:44.915 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-29T19:39:44.915 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-29T19:39:44.915 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-29-2026 19:39:44 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-29-2026 19:39:44 2026-09-29T19:39:44.915 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-29T19:39:44.915 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-29T19:39:44.915 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-29T19:39:44.915 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-29T19:39:44.915 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-29T19:39:44.930 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-29T19:39:44.930 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-29T19:39:44.930 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-29T19:39:44.930 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-29T19:39:44.930 MdCoreSvc is supported in this platform and OS Signature updated on 09-29-2026 19:39:44 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.466.0 AV Signature Version: 1.459.466.0 ************************************************************ 2026-09-29T19:39:44.930 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-29T19:39:44.930 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\EAD3B5C1-C0D8-42F3-99ED-D66EF11C62E318cc.1dd504a3d2f7dce 2026-09-29T19:39:44.961 Process scan (postsignatureupdatescan) started. 2026-09-29T19:39:44.993 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-29T19:39:44.993 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 2026-09-29T19:39:45.125 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 42460, Count: 2662, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T19:39:45.125 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 23022, Count: 1928, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-29T19:39:45.125 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2800, Count: 233, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T19:39:45.125 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-29T19:39:45.125 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1027, Count: 77, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T19:39:45.125 ProcessImageName: AgentShellService.exe, Pid: 7992, TotalTime: 681, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53% 2026-09-29T19:39:45.125 ProcessImageName: WmiPrvSE.exe, Pid: 1060, TotalTime: 524, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\afd.sys, EstimatedImpact: 10% 2026-09-29T19:39:45.125 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-29T19:39:45.125 ProcessImageName: powershell.exe, Pid: 6580, TotalTime: 356, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 32% 2026-09-29T19:39:45.125 ProcessImageName: WmiPrvSE.exe, Pid: 7508, TotalTime: 256, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 28% 2026-09-29T19:39:45.125 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T19:39:45.125 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 80, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 0% 2026-09-29T19:39:45.125 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-29T19:39:45.125 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-29T19:39:45.125 ProcessImageName: python.exe, Pid: 7464, TotalTime: 90, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 3% 2026-09-29T19:39:45.125 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 77, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-29T19:39:45.125 ProcessImageName: MicrosoftEdgeUpdateComRegisterShell64.exe, Pid: 6604, TotalTime: 61, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log->(UTF-16LE), EstimatedImpact: 39% 2026-09-29T19:39:45.125 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 60, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-29T19:39:45.125 ProcessImageName: DeviceCensus.exe, Pid: 3140, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 5% 2026-09-29T19:39:45.125 ProcessImageName: mysqldump.exe, Pid: 1840, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 16% 2026-09-29T19:39:45.125 ProcessImageName: powershell.exe, Pid: 1048, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T19:39:45.125 ProcessImageName: cmd.exe, Pid: 2768, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-09-29T19:39:45.125 ProcessImageName: python.exe, Pid: 1536, TotalTime: 15, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39.zip, EstimatedImpact: 0% 2026-09-29T19:39:45.125 ProcessImageName: taskhostw.exe, Pid: 664, TotalTime: 15, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-29T19:39:45.125 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% Signature updated via MicrosoftUpdateServer on 09-29-2026 19:39:45 ************************************************************ 2026-09-29T19:39:45.165 Job Notification: Process exited from job (6948) 2026-09-29T19:39:45.165 Job Notification: Process exited from job (2952) 2026-09-29T19:39:45.180 Job Notification: Process exited from job (8056) 2026-09-29T19:39:45.180 Job Notification: Process exited from job (8160) 2026-09-29T19:39:45.227 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-29T19:39:45.227 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-29T19:39:45.227 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-29T19:39:45.227 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-29T19:39:45.227 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-29T19:39:45.243 [Engine] Engine 00007FFCF4ABB020 no longer in use. Number of active engines: 1 2026-09-29T19:39:45.243 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-29T19:39:45.243 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-29T19:39:45.368 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-29T19:39:45.368 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-29T19:39:45.368 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-29T19:39:45.915 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 42460, Count: 2662, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T19:39:45.915 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 23022, Count: 1928, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-29T19:39:45.915 ProcessImageName: AgentShell.exe, Pid: 6996, TotalTime: 2800, Count: 233, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T19:39:45.915 ProcessImageName: powershell.exe, Pid: 7556, TotalTime: 1535, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 36% 2026-09-29T19:39:45.915 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 1027, Count: 77, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache->(UTF-16LE), EstimatedImpact: 0% 2026-09-29T19:39:45.915 ProcessImageName: AgentShellService.exe, Pid: 7992, TotalTime: 681, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 53% 2026-09-29T19:39:45.915 ProcessImageName: WmiPrvSE.exe, Pid: 1060, TotalTime: 524, Count: 20, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\afd.sys, EstimatedImpact: 10% 2026-09-29T19:39:45.915 ProcessImageName: WmiPrvSE.exe, Pid: 7340, TotalTime: 422, Count: 38, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 36% 2026-09-29T19:39:45.915 ProcessImageName: powershell.exe, Pid: 6580, TotalTime: 356, Count: 23, MaxTime: 125, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 32% 2026-09-29T19:39:45.915 ProcessImageName: WmiPrvSE.exe, Pid: 7508, TotalTime: 256, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 28% 2026-09-29T19:39:45.915 ProcessImageName: WmiPrvSE.exe, Pid: 3500, TotalTime: 170, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T19:39:45.915 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 120, Count: 80, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-28f88-0.MAI, EstimatedImpact: 0% 2026-09-29T19:39:45.915 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 91, Count: 8, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-29T19:39:45.915 ProcessImageName: taskhostw.exe, Pid: 732, TotalTime: 91, Count: 4, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 11% 2026-09-29T19:39:45.977 [Engine] RSIG_UNLOADENGINE, 00007FFCF4ABB020, err=0x0 2026-09-29T19:39:46.008 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{859E69EE-8383-46F8-8EA2-634F5004C094} removed 2026-09-29T19:39:59.478 Process scan (postsignatureupdatescan) completed. 2026-09-29T19:44:44.759 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-29T19:46:52.791 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T19:53:37.951 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T19:53:37.951 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T19:53:37.951 [Cloud] Queued cloud request. 2026-09-29T19:53:37.951 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T19:53:37.951 [Cloud] Dequeued cloud request. 2026-09-29T19:53:37.951 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T19:53:38.092 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{62B9A203-400E-A2D9-5B80-BC5B53F959FD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 19:53:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T19:53:38.607 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T20:01:57.799 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T20:03:11.815 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T20:03:11.815 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T20:03:11.815 [Cloud] Queued cloud request. 2026-09-29T20:03:11.815 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T20:03:11.815 [Cloud] Dequeued cloud request. 2026-09-29T20:03:11.815 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T20:03:12.127 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F2A4B4E3-31EA-7834-09EF-272DAC41D583} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 20:03:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T20:03:12.627 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T20:03:31.424 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T20:03:31.424 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T20:03:31.424 [Cloud] Queued cloud request. 2026-09-29T20:03:31.424 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T20:03:31.424 [Cloud] Dequeued cloud request. 2026-09-29T20:03:31.424 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{7FCBB97B-10CA-3D2C-EF6E-44E910F1DB90} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 20:03:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T20:03:41.440 [Cloud] End of cloud request. 2026-09-29T20:03:41.940 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T20:04:20.143 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T20:04:20.143 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T20:04:20.143 [Cloud] Queued cloud request. 2026-09-29T20:04:20.143 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T20:04:20.143 [Cloud] Dequeued cloud request. 2026-09-29T20:04:20.143 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T20:04:20.237 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{11FC01C7-496A-7478-4F8C-FA149E34005E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 20:04:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T20:04:20.737 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T20:14:22.258 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T20:14:22.258 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T20:14:22.258 [Cloud] Queued cloud request. 2026-09-29T20:14:22.258 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T20:14:22.258 [Cloud] Dequeued cloud request. 2026-09-29T20:14:22.258 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T20:14:22.445 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F645C955-8333-8794-0365-ED93DA7511BD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 20:14:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T20:14:22.961 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T20:17:02.808 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T20:22:01.403 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T20:22:01.403 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T20:22:01.403 [Cloud] Queued cloud request. 2026-09-29T20:22:01.403 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T20:22:01.403 [Cloud] Dequeued cloud request. 2026-09-29T20:22:01.403 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T20:22:01.591 [Cloud] End of cloud request. 2026-09-29T20:22:02.106 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T20:25:02.497 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T20:25:02.497 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T20:25:02.497 [Cloud] Queued cloud request. 2026-09-29T20:25:02.497 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T20:25:02.497 [Cloud] Dequeued cloud request. 2026-09-29T20:25:02.497 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T20:25:02.653 [Cloud] End of cloud request. 2026-09-29T20:25:03.169 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T20:29:11.361 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T20:29:11.361 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T20:29:11.361 [Cloud] Queued cloud request. 2026-09-29T20:29:11.361 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T20:29:11.361 [Cloud] Dequeued cloud request. 2026-09-29T20:29:11.361 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T20:29:11.501 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{64D539A9-E7D3-4D43-0EC6-A1785ED403B1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 20:29:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T20:29:12.017 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T20:31:01.626 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T20:31:01.626 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T20:31:01.626 [Cloud] Queued cloud request. 2026-09-29T20:31:01.626 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T20:31:01.626 [Cloud] Dequeued cloud request. 2026-09-29T20:31:01.626 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T20:31:11.704 [Cloud] End of cloud request. 2026-09-29T20:31:12.220 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T20:32:07.814 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T20:33:43.314 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T20:33:43.314 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T20:33:43.314 [Cloud] Queued cloud request. 2026-09-29T20:33:43.314 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T20:33:43.314 [Cloud] Dequeued cloud request. 2026-09-29T20:33:43.314 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T20:33:50.861 [Cloud] End of cloud request. 2026-09-29T20:33:51.377 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T20:47:12.823 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T20:48:47.543 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T20:48:47.543 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T20:48:47.543 [Cloud] Queued cloud request. 2026-09-29T20:48:47.543 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T20:48:47.543 [Cloud] Dequeued cloud request. 2026-09-29T20:48:47.543 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T20:48:47.699 [Cloud] End of cloud request. 2026-09-29T20:48:48.199 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T20:53:08.121 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T20:53:08.121 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T20:53:08.121 [Cloud] Queued cloud request. 2026-09-29T20:53:08.121 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T20:53:08.121 [Cloud] Dequeued cloud request. 2026-09-29T20:53:08.121 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T20:53:08.262 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B824C225-6614-D4AC-FCBF-2421827BAAB7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 20:53:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T20:53:08.777 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T21:01:22.391 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T21:01:22.391 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T21:01:22.391 [Cloud] Queued cloud request. 2026-09-29T21:01:22.391 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T21:01:22.391 [Cloud] Dequeued cloud request. 2026-09-29T21:01:22.391 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T21:01:22.532 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FDEB7FFF-906E-D692-E132-B5E659D523EE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 21:01:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T21:01:23.048 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T21:02:17.829 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T21:07:42.659 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T21:07:42.659 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T21:07:42.659 [Cloud] Queued cloud request. 2026-09-29T21:07:42.659 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T21:07:42.659 [Cloud] Dequeued cloud request. 2026-09-29T21:07:42.659 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T21:07:42.815 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5C1FB636-7119-7D75-5195-1FB3449DAD4A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 21:07:42 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T21:07:43.315 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T21:09:41.784 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T21:09:41.784 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T21:09:41.784 [Cloud] Queued cloud request. 2026-09-29T21:09:41.784 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T21:09:41.784 [Cloud] Dequeued cloud request. 2026-09-29T21:09:41.784 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T21:09:42.159 [Cloud] End of cloud request. 2026-09-29T21:09:42.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T21:17:22.833 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{6537EB39-43FE-7A4C-D219-2C0B833AB343} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-29-2026 21:23:42 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T21:23:43.886 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T21:23:43.886 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T21:23:43.886 [Cloud] Queued cloud request. 2026-09-29T21:23:43.886 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T21:23:43.886 [Cloud] Dequeued cloud request. 2026-09-29T21:23:43.886 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T21:23:44.229 [Cloud] End of cloud request. 2026-09-29T21:23:44.729 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T21:30:46.656 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T21:30:46.656 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T21:30:46.656 [Cloud] Queued cloud request. 2026-09-29T21:30:46.656 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T21:30:46.656 [Cloud] Dequeued cloud request. 2026-09-29T21:30:46.656 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T21:30:46.844 [Cloud] End of cloud request. 2026-09-29T21:30:47.359 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T21:32:27.844 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T21:39:24.786 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T21:39:24.786 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T21:39:24.786 [Cloud] Queued cloud request. 2026-09-29T21:39:24.786 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T21:39:24.786 [Cloud] Dequeued cloud request. 2026-09-29T21:39:24.786 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T21:39:24.927 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{19FA6874-E2E1-4D2F-6624-35A524A9AD9E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 21:39:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T21:39:25.427 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T21:39:44.770 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 17899, Count: 1139, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T21:39:44.770 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 2040, Count: 175, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T21:39:44.770 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-29T21:39:44.770 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T21:39:44.770 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-29T21:39:44.770 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 90, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-29T21:39:44.770 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-29T21:39:44.770 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 46, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 2% 2026-09-29T21:39:44.770 ProcessImageName: ngentask.exe, Pid: 1436, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-29T21:39:44.770 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 0, Count: 3, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-29T21:40:55.505 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T21:40:55.505 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T21:40:55.505 [Cloud] Queued cloud request. 2026-09-29T21:40:55.505 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T21:40:55.505 [Cloud] Dequeued cloud request. 2026-09-29T21:40:55.505 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T21:40:55.661 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DFD4179A-6C1A-6C01-DC55-2BEF3FE2551B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 21:40:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T21:40:56.161 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T21:42:46.989 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T21:42:46.989 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T21:42:46.989 [Cloud] Queued cloud request. 2026-09-29T21:42:46.989 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T21:42:46.989 [Cloud] Dequeued cloud request. 2026-09-29T21:42:46.989 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T21:42:47.145 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8411CA94-A29B-1852-BD8D-8A13CC22736E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 21:42:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T21:42:47.645 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T21:47:32.853 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T21:51:16.212 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T21:51:16.212 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T21:51:16.212 [Cloud] Queued cloud request. 2026-09-29T21:51:16.212 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T21:51:16.212 [Cloud] Dequeued cloud request. 2026-09-29T21:51:16.212 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T21:51:16.400 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1F42289C-7825-BA28-0E3F-0AD7653C8E24} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 21:51:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T21:51:16.900 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T21:55:26.059 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T21:55:26.059 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T21:55:26.059 [Cloud] Queued cloud request. 2026-09-29T21:55:26.059 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T21:55:26.059 [Cloud] Dequeued cloud request. 2026-09-29T21:55:26.059 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T21:55:26.246 [Cloud] End of cloud request. 2026-09-29T21:55:26.746 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T22:00:32.608 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T22:00:32.608 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T22:00:32.608 [Cloud] Queued cloud request. 2026-09-29T22:00:32.608 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T22:00:32.608 [Cloud] Dequeued cloud request. 2026-09-29T22:00:32.608 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T22:00:32.796 [Cloud] End of cloud request. 2026-09-29T22:00:33.296 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T22:02:37.858 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T22:09:29.300 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T22:09:29.300 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T22:09:29.300 [Cloud] Queued cloud request. 2026-09-29T22:09:29.300 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T22:09:29.300 [Cloud] Dequeued cloud request. 2026-09-29T22:09:29.300 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T22:09:29.457 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E87F4060-95A0-ACB8-6682-0A9894F2C9FD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 22:09:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T22:09:29.972 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T22:15:30.785 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T22:15:30.785 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T22:15:30.785 [Cloud] Queued cloud request. 2026-09-29T22:15:30.785 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T22:15:30.785 [Cloud] Dequeued cloud request. 2026-09-29T22:15:30.785 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T22:15:34.863 [Cloud] End of cloud request. 2026-09-29T22:15:35.379 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T22:15:37.441 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T22:15:37.441 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T22:15:37.441 [Cloud] Queued cloud request. 2026-09-29T22:15:37.441 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T22:15:37.441 [Cloud] Dequeued cloud request. 2026-09-29T22:15:37.441 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T22:15:37.519 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4DDE5FA1-C1A1-F30A-0C68-7F0B94557B4D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 22:15:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T22:15:38.035 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T22:16:01.957 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T22:16:01.957 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T22:16:01.957 [Cloud] Queued cloud request. 2026-09-29T22:16:01.957 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T22:16:01.957 [Cloud] Dequeued cloud request. 2026-09-29T22:16:01.957 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T22:16:02.035 [Cloud] End of cloud request. 2026-09-29T22:16:02.551 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T22:16:17.301 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T22:16:17.301 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T22:16:17.301 [Cloud] Queued cloud request. 2026-09-29T22:16:17.301 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T22:16:17.301 [Cloud] Dequeued cloud request. 2026-09-29T22:16:17.301 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T22:16:17.379 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2254143A-1A16-5685-624D-20BC46B34300} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 22:16:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T22:16:17.894 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T22:16:33.176 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T22:16:33.176 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T22:16:33.176 [Cloud] Queued cloud request. 2026-09-29T22:16:33.176 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T22:16:33.176 [Cloud] Dequeued cloud request. 2026-09-29T22:16:33.176 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T22:16:33.254 [Cloud] End of cloud request. 2026-09-29T22:16:33.754 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T22:17:20.660 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T22:17:20.660 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T22:17:20.660 [Cloud] Queued cloud request. 2026-09-29T22:17:20.660 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T22:17:20.660 [Cloud] Dequeued cloud request. 2026-09-29T22:17:20.660 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T22:17:20.738 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8EF205DF-0236-A4ED-F8DE-011625403F90} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 22:17:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T22:17:21.238 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T22:17:42.863 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T22:28:11.763 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T22:28:11.763 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T22:28:11.763 [Cloud] Queued cloud request. 2026-09-29T22:28:11.763 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T22:28:11.763 [Cloud] Dequeued cloud request. 2026-09-29T22:28:11.763 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T22:28:13.169 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{125C901D-B25B-71DC-7189-94960C369BAD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 22:28:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T22:28:13.684 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T22:32:47.873 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T22:45:47.254 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T22:45:47.254 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T22:45:47.254 [Cloud] Queued cloud request. 2026-09-29T22:45:47.254 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T22:45:47.254 [Cloud] Dequeued cloud request. 2026-09-29T22:45:47.254 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T22:45:47.504 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CE397C00-262D-D703-C19D-DB14D4E53B9C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 22:45:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T22:45:48.019 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T22:47:52.881 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T22:48:13.288 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T22:48:13.288 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T22:48:13.288 [Cloud] Queued cloud request. 2026-09-29T22:48:13.288 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T22:48:13.288 [Cloud] Dequeued cloud request. 2026-09-29T22:48:13.288 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T22:48:13.475 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E4AEEE81-74F5-B168-5333-430AEF0DC8C4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 22:48:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T22:48:13.991 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T22:53:36.430 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T22:53:36.430 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T22:53:36.430 [Cloud] Queued cloud request. 2026-09-29T22:53:36.430 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T22:53:36.430 [Cloud] Dequeued cloud request. 2026-09-29T22:53:36.430 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T22:53:36.633 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DD109666-A7FD-6448-582D-BA86481438B2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 22:53:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T22:53:37.133 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T23:02:31.512 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T23:02:31.512 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T23:02:31.512 [Cloud] Queued cloud request. 2026-09-29T23:02:31.512 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T23:02:31.512 [Cloud] Dequeued cloud request. 2026-09-29T23:02:31.512 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T23:02:31.668 [Cloud] End of cloud request. 2026-09-29T23:02:32.168 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T23:02:57.887 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T23:18:02.895 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T23:18:41.411 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T23:18:41.411 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T23:18:41.411 [Cloud] Queued cloud request. 2026-09-29T23:18:41.411 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T23:18:41.411 [Cloud] Dequeued cloud request. 2026-09-29T23:18:41.411 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T23:18:41.567 [Cloud] End of cloud request. 2026-09-29T23:18:42.067 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T23:22:07.194 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T23:22:07.194 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T23:22:07.194 [Cloud] Queued cloud request. 2026-09-29T23:22:07.194 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T23:22:07.194 [Cloud] Dequeued cloud request. 2026-09-29T23:22:07.194 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T23:22:07.334 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F54FFC2E-28EB-C549-0826-220018FF64A6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 23:22:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T23:22:07.850 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T23:26:38.959 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T23:26:38.959 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T23:26:38.959 [Cloud] Queued cloud request. 2026-09-29T23:26:38.959 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T23:26:38.959 [Cloud] Dequeued cloud request. 2026-09-29T23:26:38.959 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T23:26:39.100 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3973B089-2D49-96FF-62A2-263A3E483FB3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 23:26:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T23:26:39.616 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T23:30:38.526 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T23:30:38.526 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T23:30:38.526 [Cloud] Queued cloud request. 2026-09-29T23:30:38.526 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T23:30:38.526 [Cloud] Dequeued cloud request. 2026-09-29T23:30:38.526 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T23:30:44.932 [Cloud] End of cloud request. 2026-09-29T23:30:45.432 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T23:33:07.901 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-29T23:36:17.558 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T23:36:17.558 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T23:36:17.558 [Cloud] Queued cloud request. 2026-09-29T23:36:17.558 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T23:36:17.558 [Cloud] Dequeued cloud request. 2026-09-29T23:36:17.558 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T23:36:17.745 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2ACDE4A6-4026-D76A-B9C9-5A18F736FD3C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 23:36:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T23:36:18.245 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T23:39:44.827 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 18764, Count: 1204, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-29T23:39:44.827 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 3432, Count: 291, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-29T23:39:44.827 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 1698, Count: 114, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-29T23:39:44.827 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-29T23:39:44.827 ProcessImageName: WmiPrvSE.exe, Pid: 6732, TotalTime: 692, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-29T23:39:44.827 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 666, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-09-29T23:39:44.827 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-29T23:39:44.827 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 135, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-29T23:39:44.827 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-29T23:39:44.827 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-29T23:39:44.827 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 76, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 0% 2026-09-29T23:39:44.827 ProcessImageName: powershell.exe, Pid: 964, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-29T23:39:44.827 ProcessImageName: powershell.exe, Pid: 7944, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp85B8.tmp, EstimatedImpact: 0% 2026-09-29T23:39:44.827 ProcessImageName: ngentask.exe, Pid: 1436, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-29T23:39:44.827 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 0, Count: 3, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-29T23:40:29.702 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-29T23:40:29.702 [Cloud] Start of cloud request. Passive mode: 0 2026-09-29T23:40:29.702 [Cloud] Queued cloud request. 2026-09-29T23:40:29.702 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-29T23:40:29.702 [Cloud] Dequeued cloud request. 2026-09-29T23:40:29.702 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-29T23:40:29.889 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{237A92AC-BACC-EE1D-0AA4-2BFB8C9DBD4E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-29-2026 23:40:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-29T23:40:30.389 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-29T23:45:47.327 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\$Extend\$Deleted\0023000000035F881A6C0486. Process: \Device\HarddiskVolume2\Windows\System32\svchost.exe, Status: 0xc0000001, State: 0, ScanRequest #5432527, FileId: 0x23000000035f88, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x2000, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-29T23:48:12.909 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T00:03:17.914 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T00:04:34.024 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T00:04:34.024 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T00:04:34.024 [Cloud] Queued cloud request. 2026-09-30T00:04:34.024 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T00:04:34.024 [Cloud] Dequeued cloud request. 2026-09-30T00:04:34.024 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T00:04:34.211 [Cloud] End of cloud request. 2026-09-30T00:04:34.727 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T00:07:37.246 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T00:07:37.246 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T00:07:37.246 [Cloud] Queued cloud request. 2026-09-30T00:07:37.246 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T00:07:37.246 [Cloud] Dequeued cloud request. 2026-09-30T00:07:37.246 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T00:07:37.418 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2C86BA52-D763-66F6-9BE6-E0BFCEDE3CE0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 00:07:37 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T00:07:37.918 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T00:18:22.923 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T00:22:30.080 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T00:22:30.080 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T00:22:30.080 [Cloud] Queued cloud request. 2026-09-30T00:22:30.080 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T00:22:30.080 [Cloud] Dequeued cloud request. 2026-09-30T00:22:30.080 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T00:22:30.267 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C225E8FD-FAF4-CA04-817E-A8C93378FAB6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 00:22:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T00:22:30.767 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T00:23:03.846 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T00:23:03.846 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T00:23:03.846 [Cloud] Queued cloud request. 2026-09-30T00:23:03.846 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T00:23:03.846 [Cloud] Dequeued cloud request. 2026-09-30T00:23:03.846 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T00:23:03.924 [Cloud] End of cloud request. 2026-09-30T00:23:04.440 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T00:33:27.928 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T00:42:30.090 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T00:42:30.090 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T00:42:30.090 [Cloud] Queued cloud request. 2026-09-30T00:42:30.090 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T00:42:30.090 [Cloud] Dequeued cloud request. 2026-09-30T00:42:30.090 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T00:42:30.277 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3FB4FBF5-2F9F-94C4-9676-51D4F81A773E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 00:42:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T00:42:30.793 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T00:48:32.937 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T01:00:02.161 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456955, FileId: 0xe000000018e0b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.161 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456956, FileId: 0x57a00000000c35c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.192 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456961, FileId: 0x10000000018e0b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.192 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456962, FileId: 0x57c00000000c35c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-12.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456967, FileId: 0x12000000018e0b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.208 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456968, FileId: 0x57e00000000c35c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.223 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456974, FileId: 0x58000000000c35c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.223 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-15.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456973, FileId: 0x14000000018e0b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.223 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-18.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456979, FileId: 0x16000000018e0b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.223 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456980, FileId: 0x58200000000c35c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.239 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-1b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456986, FileId: 0x18000000018e0b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.239 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-1b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456985, FileId: 0x58400000000c35c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.254 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456991, FileId: 0x1a000000018e0b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.254 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456992, FileId: 0x58600000000c35c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.270 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-21.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456997, FileId: 0x58800000000c35c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.270 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-21.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5456998, FileId: 0x1c000000018e0b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.286 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-24.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5457003, FileId: 0x1e000000018e0b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.286 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-24.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5457004, FileId: 0x58a00000000c35c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.286 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-27.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5457009, FileId: 0x58c00000000c35c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.286 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-27.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5457010, FileId: 0x20000000018e0b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.301 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-2a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5457015, FileId: 0x22000000018e0b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.301 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-2a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5457016, FileId: 0x58e00000000c35c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.333 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5457021, FileId: 0x24000000018e0b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:00:02.333 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a1c7-2d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5457022, FileId: 0x59000000000c35c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-09-30T01:02:27.051 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T01:02:27.051 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T01:02:27.051 [Cloud] Queued cloud request. 2026-09-30T01:02:27.051 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T01:02:27.051 [Cloud] Dequeued cloud request. 2026-09-30T01:02:27.051 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T01:02:27.208 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8B51488E-BEF4-A6B7-FC2C-4D458481141A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 01:02:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T01:02:27.708 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T01:03:37.943 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T01:06:42.600 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T01:06:42.600 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T01:06:42.600 [Cloud] Queued cloud request. 2026-09-30T01:06:42.600 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T01:06:42.600 [Cloud] Dequeued cloud request. 2026-09-30T01:06:42.600 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T01:06:42.990 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0BF17FC4-B4CE-9A9A-292A-6155E425CDFC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 01:06:43 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T01:06:43.490 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T01:07:53.789 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T01:07:53.789 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T01:07:53.789 [Cloud] Queued cloud request. 2026-09-30T01:07:53.789 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T01:07:53.789 [Cloud] Dequeued cloud request. 2026-09-30T01:07:53.789 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T01:07:53.930 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1CFAAA25-BB80-F115-A688-AF50E7905B38} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 01:07:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T01:07:54.446 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T01:18:42.950 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T01:19:07.873 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:2FE12EDB-800D-473F-99F1-ABA436067CF6, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-09-30T01:19:07.873 Scheduled scan with Id 2FE12EDB-800D-473F-99F1-ABA436067CF6 configured CPU priority: normal (LowCpuPriority: 0) 2026-09-30T01:19:07.888 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-09-30T01:19:07.888 [SFC] System file cache build is not needed (already completed) 2026-09-30T01:19:29.904 Engine:Triggered AR EMS scan 2026-09-30T01:19:29.919 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:29.935 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:29.935 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:29.951 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:29.951 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:29.966 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:29.966 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:29.982 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:29.982 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:29.998 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:29.998 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:29.998 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.013 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.013 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.013 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.029 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.029 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.029 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.044 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.044 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.044 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.060 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.060 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.060 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.060 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.076 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.091 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.091 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.107 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.107 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.107 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.123 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.123 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.123 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.138 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.138 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.138 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.154 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.154 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.154 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.169 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.169 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.169 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.169 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.185 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.201 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.201 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.201 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.216 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.216 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.232 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.232 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.232 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.248 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.248 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.248 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.248 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.263 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.279 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.279 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:19:30.294 Engine:EMS scan for process: svchost pid: 5000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-09-30T01:20:08.701 QuickScan:ScanID:2FE12EDB-800D-473F-99F1-ABA436067CF6: Quick scan finished with error 0 2026-09-30T01:20:09.217 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-30T01:20:09.217 [RTP] Duplicating the current plugin configuration object... 2026-09-30T01:20:09.217 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-30T01:20:09.217 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-30T01:20:09.217 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-30T01:20:09.217 [RTP] No config change detected. Not updating plugin configuration. 2026-09-30T01:20:09.217 [RTP] No config changes found. No configuration switch. 2026-09-30T01:20:09.217 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-30T01:22:38.936 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T01:22:38.936 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T01:22:38.936 [Cloud] Queued cloud request. 2026-09-30T01:22:38.936 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T01:22:38.936 [Cloud] Dequeued cloud request. 2026-09-30T01:22:38.936 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T01:22:39.092 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25AC7DE1-CDB7-5AF1-B0B5-FB8A24D55429} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 01:22:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T01:22:39.592 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T01:33:47.955 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T01:35:13.456 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T01:35:13.456 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T01:35:13.456 [Cloud] Queued cloud request. 2026-09-30T01:35:13.456 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T01:35:13.456 [Cloud] Dequeued cloud request. 2026-09-30T01:35:13.456 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T01:35:13.613 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1A750B36-EB2B-5B12-6C90-C46EE92A90B2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 01:35:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T01:35:14.113 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T01:39:07.382 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T01:39:07.382 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T01:39:07.382 [Cloud] Queued cloud request. 2026-09-30T01:39:07.382 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T01:39:07.382 [Cloud] Dequeued cloud request. 2026-09-30T01:39:07.382 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T01:39:07.538 [Cloud] End of cloud request. 2026-09-30T01:39:07.538 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T01:39:07.538 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T01:39:07.538 [Cloud] Queued cloud request. 2026-09-30T01:39:07.538 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T01:39:07.538 [Cloud] Dequeued cloud request. 2026-09-30T01:39:07.538 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T01:39:07.632 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C84D22D0-3209-0324-F175-9FC073625447} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 01:39:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry BEGIN BM telemetry GUID:{4F0A9ACB-7DFD-FE03-67A7-059740C6CD7E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 01:39:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T01:39:08.038 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T01:39:44.897 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 19916, Count: 1247, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-30T01:39:44.897 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 3788, Count: 300, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-30T01:39:44.897 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 3432, Count: 291, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T01:39:44.897 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-30T01:39:44.897 ProcessImageName: WmiPrvSE.exe, Pid: 6732, TotalTime: 692, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-30T01:39:44.897 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 666, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-09-30T01:39:44.897 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 270, Count: 23, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T01:39:44.897 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T01:39:44.897 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 121, Count: 60, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 0% 2026-09-30T01:39:44.897 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-30T01:39:44.897 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-30T01:39:44.897 ProcessImageName: mysqldump.exe, Pid: 7220, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 15% 2026-09-30T01:39:44.897 ProcessImageName: powershell.exe, Pid: 964, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-30T01:39:44.897 ProcessImageName: powershell.exe, Pid: 7944, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp85B8.tmp, EstimatedImpact: 0% 2026-09-30T01:39:44.897 ProcessImageName: ngentask.exe, Pid: 1436, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-30T01:39:44.897 ProcessImageName: cmd.exe, Pid: 2248, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-30T01:39:44.897 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 0, Count: 3, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-30T01:48:52.964 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T02:03:57.969 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T02:16:31.914 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T02:16:31.914 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T02:16:31.914 [Cloud] Queued cloud request. 2026-09-30T02:16:31.914 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T02:16:31.914 [Cloud] Dequeued cloud request. 2026-09-30T02:16:31.914 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T02:16:32.304 [Cloud] End of cloud request. 2026-09-30T02:16:32.820 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T02:19:02.978 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T02:24:12.323 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T02:24:12.323 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T02:24:12.323 [Cloud] Queued cloud request. 2026-09-30T02:24:12.323 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T02:24:12.323 [Cloud] Dequeued cloud request. 2026-09-30T02:24:12.323 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T02:24:12.511 [Cloud] End of cloud request. 2026-09-30T02:24:13.011 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T02:25:40.355 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T02:25:40.355 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T02:25:40.355 [Cloud] Queued cloud request. 2026-09-30T02:25:40.355 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T02:25:40.355 [Cloud] Dequeued cloud request. 2026-09-30T02:25:40.355 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T02:25:40.543 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2DBF6724-7219-31FD-7F6C-024CEEE0D4DB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 02:25:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T02:25:41.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T02:34:07.982 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T02:45:28.739 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T02:45:28.739 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T02:45:28.739 [Cloud] Queued cloud request. 2026-09-30T02:45:28.739 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T02:45:28.739 [Cloud] Dequeued cloud request. 2026-09-30T02:45:28.739 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T02:45:28.926 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{83F0531D-325A-4B25-729C-A16BA42C4004} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 02:45:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T02:45:29.426 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T02:49:12.991 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T03:02:05.278 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T03:02:05.278 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T03:02:05.278 [Cloud] Queued cloud request. 2026-09-30T03:02:05.278 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T03:02:05.278 [Cloud] Dequeued cloud request. 2026-09-30T03:02:05.278 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T03:02:05.450 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2498A77D-B17F-A578-387E-B4F74DB6EA69} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 03:02:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T03:02:05.965 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T03:04:17.997 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T03:07:07.044 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-30T03:07:07.075 [AutoPurge] Routine task for Cache Maintenance has started. 2026-09-30T03:07:07.075 [AutoPurge] Routine task for Cache Maintenance ... 2026-09-30T03:07:07.075 [AutoPurge] Routine task for MpSFCBuild ... 2026-09-30T03:07:07.075 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-09-30T03:07:07.075 [AutoPurge] MpSignalMaintenanceMode ... 2026-09-30T03:07:07.184 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5020_qps..ocm_c4f37fcd48db4ac0\bootmgr.exe.mui", hr=0x0 2026-09-30T03:07:07.247 EnsureProtectedFolderAcls(), hr = 0x0 2026-09-30T03:07:07.262 [AutoPurge] MpReinforceServiceAcls: 0 2026-09-30T03:07:07.278 [AutoPurge] Cleanup Routine tasks have started. 2026-09-30T03:07:07.325 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-09-30T03:07:07.325 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-09-30T03:07:07.325 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:09-30-2026 03:07:07 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-30-2026 03:07:07 2026-09-30T03:07:07.325 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-09-30T03:07:07.325 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-09-30T03:07:07.325 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-09-30T03:07:07.325 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-09-30T03:07:07.325 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-09-30T03:07:07.325 [AutoPurge] Cleanup Routine tasks have ended. 2026-09-30T03:07:07.325 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-09-30T03:07:07.341 [AutoPurge] Removing expired default signature package ... 2026-09-30T03:07:07.591 Engine:Setting original file name "vssadmin.exe" for "c:\windows\winsxs\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.20348.1_none_4dec52f3faaa3ed2\vssadmin.exe", hr=0x0 2026-09-30T03:07:07.747 Job Notification: New process added to job (5992) 2026-09-30T03:07:07.825 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_10.0.20348.5499_none_2ff30a53ce993eff\bootmgfw_ex.efi", hr=0x0 2026-09-30T03:07:08.450 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:07:08.981 Job Notification: Process exited from job (5992) 2026-09-30T03:07:09.075 [AutoPurge] Verification Routine tasks have ended. 2026-09-30T03:07:09.325 Engine:Setting original file name "Placeholder.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\penimc_v0400.dll", hr=0x0 2026-09-30T03:07:09.450 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-0.dll", hr=0x0 2026-09-30T03:07:10.075 Engine:Setting original file name "ISOLMIG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-m..tion-isolationlayer_31bf3856ad364e35_10.0.20348.1_none_e75eff92d16385b9\migisol.dll", hr=0x0 2026-09-30T03:07:10.169 Engine:Setting original file name "msfltr32.acm" for "c:\windows\system32\msacm32.dll", hr=0x0 2026-09-30T03:07:10.356 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_28997260b8bfa50b\bootmgr.exe.mui", hr=0x0 2026-09-30T03:07:12.387 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:12.841 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_de-de_dbd68c92b17830aa\wextract.exe.mui", hr=0x0 2026-09-30T03:07:13.153 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\syswow64\fr-fr\mscpxl32.dll.mui", hr=0x0 2026-09-30T03:07:13.169 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:13.403 Engine:Setting original file name "timedate.cpl" for "c:\windows\systemresources\timedate.cpl.mun", hr=0x0 2026-09-30T03:07:14.059 Engine:Setting original file name "WIADEFUI.DLL" for "c:\windows\systemresources\wiadefui.dll.mun", hr=0x0 2026-09-30T03:07:14.669 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorsec.dll", hr=0x0 2026-09-30T03:07:14.794 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhpast.dll", hr=0x0 2026-09-30T03:07:14.934 Engine:Setting original file name "rasgcw.dll" for "c:\windows\systemresources\rasgcw.dll.mun", hr=0x0 2026-09-30T03:07:15.169 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:07:15.325 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\fr-fr\ndisimplatcim.dll.mui", hr=0x0 2026-09-30T03:07:15.716 Engine:Setting original file name "mf.dll" for "c:\windows\system32\mfpmp.exe", hr=0x0 2026-09-30T03:07:15.856 Engine:Setting original file name "AccessibilityCpl.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.20348.5256_none_01e1c55786080a41\accessibilitycpl.dll.mun", hr=0x0 2026-09-30T03:07:16.044 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:16.169 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\de-de\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:16.231 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\cs-cz\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:16.247 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\system32\textinputframework.dll", hr=0x0 2026-09-30T03:07:16.434 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:07:16.512 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_10.0.20348.1_de-de_19556b59cbcc1b14\msjint40.dll.mui", hr=0x0 2026-09-30T03:07:16.544 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-conio-l1-1-0.dll", hr=0x0 2026-09-30T03:07:16.622 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.20348.4294_none_b77099ea9f51e06f\mp4sdecd.dll", hr=0x0 2026-09-30T03:07:16.778 Engine:Setting original file name "DxpTaskSync.dll" for "c:\windows\systemresources\dxptasksync.dll.mun", hr=0x0 2026-09-30T03:07:17.169 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:17.200 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_de-de_b5a71597a8de018c\nltest.exe.mui", hr=0x0 2026-09-30T03:07:17.606 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:07:17.747 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\system32\de-de\bwcontexthandler.dll.mui", hr=0x0 2026-09-30T03:07:18.356 Engine:Setting original file name "IEAPFLTR.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_11.0.20348.2849_none_e78c04f2c79181a5\ieapfltr.dll.mun", hr=0x0 2026-09-30T03:07:18.825 Engine:Setting original file name "Video_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_bc3537f6a23ca933\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:18.981 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sk-sk_0fa0a0c26132544a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:07:19.278 Engine:Setting original file name "authfwgp.dll" for "c:\windows\systemresources\authfwgp.dll.mun", hr=0x0 2026-09-30T03:07:19.731 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-1.dll", hr=0x0 2026-09-30T03:07:19.841 Engine:Setting original file name "INETCPL.CPL" for "c:\windows\systemresources\inetcpl.cpl.mun", hr=0x0 2026-09-30T03:07:20.278 Engine:Setting original file name "keymgr.dll" for "c:\windows\systemresources\keymgr.dll.mun", hr=0x0 2026-09-30T03:07:20.388 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:20.825 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:07:20.950 Engine:Setting original file name "WlanMM.dll" for "c:\windows\systemresources\wlanmm.dll.mun", hr=0x0 2026-09-30T03:07:20.950 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-wow64-l1-1-0.dll", hr=0x0 2026-09-30T03:07:21.013 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.20348.1_en-gb_28ee82bde3889b2c\ndisimplatcim.dll.mui", hr=0x0 2026-09-30T03:07:21.169 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-p..ting-core.resources_31bf3856ad364e35_10.0.20348.1_es-es_073d905c9f54a239\usbmon.dll.mui", hr=0x0 2026-09-30T03:07:21.232 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_de-de_0e470157279bd0c7\imapi.dll.mui", hr=0x0 2026-09-30T03:07:21.278 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:21.357 Engine:Setting original file name "MSCTF.DLL" for "c:\windows\systemresources\msctf.dll.mun", hr=0x0 2026-09-30T03:07:21.591 Engine:Setting original file name "Windows SDK" for "c:\windows\system32\winmetadata\windows.ui.winmd", hr=0x0 2026-09-30T03:07:21.982 Engine:Setting original file name "dnsapi" for "c:\windows\syswow64\dnsapi.dll", hr=0x0 2026-09-30T03:07:22.216 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-l1-2-0.dll", hr=0x0 2026-09-30T03:07:22.732 Engine:Setting original file name "devinv" for "c:\windows\system32\devinv.dll", hr=0x0 2026-09-30T03:07:24.044 Engine:Setting original file name "rundll32.exe" for "c:\windows\system32\rundll32.exe", hr=0x0 2026-09-30T03:07:24.544 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ai.winmd", hr=0x0 2026-09-30T03:07:24.576 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-private-l1-1-0.dll", hr=0x0 2026-09-30T03:07:24.607 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-es_6bbb1aa09fe0f30e\bootmgr.exe.mui", hr=0x0 2026-09-30T03:07:24.607 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-1.dll", hr=0x0 2026-09-30T03:07:24.623 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_es-es_c7385231f44ac22b\user32.dll.mui", hr=0x0 2026-09-30T03:07:24.763 Engine:Setting original file name "USERCPL.DLL" for "c:\windows\systemresources\usercpl.dll.mun", hr=0x0 2026-09-30T03:07:24.966 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-0.dll", hr=0x0 2026-09-30T03:07:24.998 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1169f5ee50a4346a\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:25.060 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_en-gb_7d3ea76da52d88aa\wextract.exe.mui", hr=0x0 2026-09-30T03:07:25.451 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_es-es_765d3c9551e294a0\nlslexicons000a.dll", hr=0x0 2026-09-30T03:07:25.513 Engine:Setting original file name "wuapi.dll" for "c:\windows\systemresources\wuapi.dll.mun", hr=0x0 2026-09-30T03:07:25.513 Engine:Setting original file name "DynaMon.dll.mui" for "c:\windows\syswow64\de-de\usbmon.dll.mui", hr=0x0 2026-09-30T03:07:25.576 Engine:Setting original file name "DismProvPS.DLL" for "c:\users\administrator\appdata\local\temp\4596db8f-d1e8-454a-aa9a-05bf93a944ae\dismcoreps.dll", hr=0x0 2026-09-30T03:07:26.091 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:26.263 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\bits\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:26.295 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_2dc6baefbfe77681\penimc.dll", hr=0x0 2026-09-30T03:07:26.342 Engine:Setting original file name "secureusbvideo.exe" for "c:\windows\system32\driverstore\filerepository\usbvideo.inf_amd64_19a8008cd8d0c71d\secureusbvideo.dll", hr=0x0 2026-09-30T03:07:26.357 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:26.779 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-obsolete-l1-1-0.dll", hr=0x0 2026-09-30T03:07:27.092 Engine:Setting original file name "ServicingBase.dll" for "c:\windows\winsxs\wow64_microsoft-windows-servicingcommon_31bf3856ad364e35_10.0.20348.5139_none_ee3e5cd68265db40\servicingcommon.dll", hr=0x0 2026-09-30T03:07:27.107 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_96206e4dcf1e67ec\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:27.795 Engine:Setting original file name "gdi32" for "c:\windows\syswow64\gdi32.dll", hr=0x0 2026-09-30T03:07:27.810 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnhupnp.dll", hr=0x0 2026-09-30T03:07:28.435 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:07:28.795 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f233a919d56aff30\mfc40u.dll.mui", hr=0x0 2026-09-30T03:07:29.201 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\iccvid.dll.mui", hr=0x0 2026-09-30T03:07:29.357 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:29.514 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iebrowseweb\de-de\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:29.686 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnlobby.dll", hr=0x0 2026-09-30T03:07:29.889 Engine:Setting original file name ""MTF.DYNLINK"" for "c:\windows\winsxs\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.20348.4294_none_510b49808d86308a\mtf.dll", hr=0x0 2026-09-30T03:07:29.951 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_847ffb21e954cb83\ir32_32original.dll.mui", hr=0x0 2026-09-30T03:07:29.998 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:30.498 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlslexicons0009_b03f5f7f11d50a3a_4.0.15806.0_none_a3af34e7439ffb47\nlslexicons0009.dll", hr=0x0 2026-09-30T03:07:30.795 Engine:Setting original file name "ZIPFLDR.DLL" for "c:\windows\systemresources\zipfldr.dll.mun", hr=0x0 2026-09-30T03:07:30.842 Engine:Setting original file name "DevicePairing.dll" for "c:\windows\systemresources\devicepairing.dll.mun", hr=0x0 2026-09-30T03:07:30.889 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pl-pl\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:07:31.201 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_2966ceeb19ce3bc9\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:07:31.404 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\winsxs\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_de-de_846b1ab936c2354c\aeevts.dll.mui", hr=0x0 2026-09-30T03:07:31.514 Engine:Setting original file name "powershell.exe" for "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe", hr=0x0 2026-09-30T03:07:31.670 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\syswow64\devobj.dll", hr=0x0 2026-09-30T03:07:31.701 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.xaml.winmd", hr=0x0 2026-09-30T03:07:31.779 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-heap-l1-1-0.dll", hr=0x0 2026-09-30T03:07:32.326 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\syswow64\f12\de-de\iechooser.exe.mui", hr=0x0 2026-09-30T03:07:32.795 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-eventing-classicprovider-l1-1-0.dll", hr=0x0 2026-09-30T03:07:32.936 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_es-es_8b8d595aafb1e1c7\servdeps.dll.mui", hr=0x0 2026-09-30T03:07:33.029 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sk-sk\bootmgr.exe.mui", hr=0x0 2026-09-30T03:07:33.608 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_en-us_5e97eb9097bc0d51\nltest.exe.mui", hr=0x0 2026-09-30T03:07:33.655 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\de-de\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:34.030 Engine:Setting original file name "ir32_32.dll" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\ir32_32original.dll.mui", hr=0x0 2026-09-30T03:07:34.123 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-private-l1-1-1.dll", hr=0x0 2026-09-30T03:07:34.139 Engine:Setting original file name "winrnr" for "c:\windows\system32\winrnr.dll", hr=0x0 2026-09-30T03:07:34.170 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbscmp10.dll", hr=0x0 2026-09-30T03:07:34.280 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_de-de_d665646f1496268f\adsnt.dll.mui", hr=0x0 2026-09-30T03:07:34.311 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\de-de\aerolite.msstyles.mui", hr=0x0 2026-09-30T03:07:34.358 Engine:Setting original file name "mapi32.dll" for "c:\windows\syswow64\mapistub.dll", hr=0x0 2026-09-30T03:07:34.686 Engine:Setting original file name "LicensingWinRuntime.dll" for "c:\windows\syswow64\licensingwinrt.dll", hr=0x0 2026-09-30T03:07:34.701 Engine:Setting original file name "PSAPI" for "c:\windows\syswow64\psapi.dll", hr=0x0 2026-09-30T03:07:35.061 Engine:Setting original file name "Register-CimProvider2.exe.mui" for "c:\windows\system32\de-de\register-cimprovider.exe.mui", hr=0x0 2026-09-30T03:07:35.233 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:35.358 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-provider-l1-1-0.dll", hr=0x0 2026-09-30T03:07:35.358 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_274a356e934f4476\wextract.exe.mui", hr=0x0 2026-09-30T03:07:35.592 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:07:35.811 Engine:Setting original file name "CRYPTUIWIZARD.DLL" for "c:\windows\systemresources\cryptuiwizard.dll.mun", hr=0x0 2026-09-30T03:07:36.233 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_zh-tw_8ae72c24ffa61cfb\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:07:36.561 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-file-l2-1-0.dll", hr=0x0 2026-09-30T03:07:36.702 Engine:Setting original file name "printui.dll" for "c:\windows\systemresources\printui.dll.mun", hr=0x0 2026-09-30T03:07:37.030 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_241a190d52a070ec\apphelp.dll.mui", hr=0x0 2026-09-30T03:07:37.045 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\ro-ro\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:37.248 Engine:Setting original file name "mp4sdmod.dll" for "c:\windows\syswow64\mp4sdecd.dll", hr=0x0 2026-09-30T03:07:37.373 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplayx.dll", hr=0x0 2026-09-30T03:07:37.873 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\servdeps.dll.mui", hr=0x0 2026-09-30T03:07:37.952 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.20348.1_es-es_be0a24ebe7c67457\mapistub.dll.mui", hr=0x0 2026-09-30T03:07:38.155 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:38.155 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_21b03b110d8e0f83\wiadss.dll.mui", hr=0x0 2026-09-30T03:07:38.358 Engine:Setting original file name "devinfoset.DLL" for "c:\windows\system32\devobj.dll", hr=0x0 2026-09-30T03:07:38.420 Engine:Setting original file name "rastls.dll" for "c:\windows\systemresources\rastls.dll.mun", hr=0x0 2026-09-30T03:07:38.655 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_de-de_7e73ae682c355ab4\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:07:39.233 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:07:39.374 Engine:Setting original file name "scrnsave" for "c:\windows\system32\de-de\scrnsave.scr.mui", hr=0x0 2026-09-30T03:07:39.420 Engine:Setting original file name "prnfldr.dll" for "c:\windows\systemresources\prnfldr.dll.mun", hr=0x0 2026-09-30T03:07:40.124 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_27d9b1fd18a655a9\tapisrv.dll.mui", hr=0x0 2026-09-30T03:07:40.139 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp20_perfcounter.dll", hr=0x0 2026-09-30T03:07:40.389 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-0.dll", hr=0x0 2026-09-30T03:07:40.592 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_de-de_c2fee7c3b0dbf5a4\bootmgr.exe.mui", hr=0x0 2026-09-30T03:07:40.936 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_825ead1e786efcb4\ir41_32original.dll.mui", hr=0x0 2026-09-30T03:07:41.655 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:07:41.827 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lv-lv\bootmgr.exe.mui", hr=0x0 2026-09-30T03:07:42.311 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-eventing-consumer-l1-1-0.dll", hr=0x0 2026-09-30T03:07:42.639 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_en-gb_375b57f39753b14f\ieadvpack.dll.mui", hr=0x0 2026-09-30T03:07:42.796 Engine:Setting original file name "Windows.Data.Pdf.dll" for "c:\windows\winsxs\amd64_microsoft-windows-data-pdf_31bf3856ad364e35_10.0.20348.5386_none_9ed0f85dc5e0c5c5\windows.data.pdf.dll.mun", hr=0x0 2026-09-30T03:07:42.827 Engine:Setting original file name "IESecurity_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\iesecurity\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:42.827 Engine:Setting original file name "mfplat.dll" for "c:\windows\systemresources\mfplat.dll.mun", hr=0x0 2026-09-30T03:07:42.921 Engine:Setting original file name "msedgeupdate.dll" for "c:\program files (x86)\microsoft\edgeupdate\1.3.273.21\psmachine_64.dll", hr=0x0 2026-09-30T03:07:42.952 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.ui.winmd", hr=0x0 2026-09-30T03:07:43.171 Engine:Setting original file name "System.Reflection.Emit" for "c:\windows\microsoft.net\framework\v4.0.30319\system.reflection.emit.dll", hr=0x0 2026-09-30T03:07:43.546 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dplaysvr.exe", hr=0x0 2026-09-30T03:07:43.624 Engine:Setting original file name "chakra.dll" for "c:\windows\systemresources\chakra.dll.mun", hr=0x0 2026-09-30T03:07:43.842 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_10.0.20348.1_de-de_c243901a30ca009d\bootres.dll.mui", hr=0x0 2026-09-30T03:07:44.092 Engine:Setting original file name "winnt" for "c:\windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_10.0.20348.1_es-es_7f21974c039b23f9\adsnt.dll.mui", hr=0x0 2026-09-30T03:07:44.139 Engine:Setting original file name "MSUTB.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-t..icesframework-msutb_31bf3856ad364e35_10.0.20348.5256_none_1c939d1a22054961\msutb.dll.mun", hr=0x0 2026-09-30T03:07:44.467 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:07:44.671 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1fe05af4a4e6f869\msacm32.drv.mui", hr=0x0 2026-09-30T03:07:44.858 Engine:Setting original file name "SyncCenter.dll" for "c:\windows\systemresources\synccenter.dll.mun", hr=0x0 2026-09-30T03:07:45.655 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:07:45.717 Engine:Setting original file name "WINDOWS.UI.IMMERSIVE.dll" for "c:\windows\systemresources\windows.ui.immersive.dll.mun", hr=0x0 2026-09-30T03:07:45.796 Engine:Setting original file name "raschapext.dll" for "c:\windows\systemresources\raschapext.dll.mun", hr=0x0 2026-09-30T03:07:45.858 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a1cc0f087dbe34b2\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-30T03:07:46.780 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-naturallanguage6_b03f5f7f11d50a3a_4.0.15806.0_none_0a45a4a5e467861d\naturallanguage6.dll", hr=0x0 2026-09-30T03:07:46.858 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_wminet_utils.dll", hr=0x0 2026-09-30T03:07:46.952 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-c..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_054a0bbca28d0476\api-ms-win-core-com-l1-1-0.dll", hr=0x0 2026-09-30T03:07:47.093 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.applicationmodel.winmd", hr=0x0 2026-09-30T03:07:47.327 Engine:Setting original file name "ExplorerFrame.dll" for "c:\windows\systemresources\explorerframe.dll.mun", hr=0x0 2026-09-30T03:07:47.499 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_es-es_71df28389b1ecc4a\rdpsign.exe.mui", hr=0x0 2026-09-30T03:07:48.233 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-interlocked-l1-1-0.dll", hr=0x0 2026-09-30T03:07:48.280 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-namedpipe-l1-1-0.dll", hr=0x0 2026-09-30T03:07:48.296 Engine:Setting original file name "EDPUTIL.DLL" for "c:\windows\systemresources\edputil.dll.mun", hr=0x0 2026-09-30T03:07:48.374 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpmodemx.dll", hr=0x0 2026-09-30T03:07:48.483 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\system32\ddores.dll", hr=0x0 2026-09-30T03:07:49.061 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_fr-fr_bf75f26492604cfc\iechooser.exe.mui", hr=0x0 2026-09-30T03:07:49.202 Engine:Setting original file name "ECApp.exe" for "c:\windows\systemapps\microsoft.ecapp_8wekyb3d8bbwe\microsoft.ecapp.exe", hr=0x0 2026-09-30T03:07:49.233 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-realtime-l1-1-0.dll", hr=0x0 2026-09-30T03:07:49.264 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-privateprofile-l1-1-1.dll", hr=0x0 2026-09-30T03:07:49.343 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-k..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f47badb873b7543d\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:49.389 Engine:Setting original file name "imm32" for "c:\windows\syswow64\imm32.dll", hr=0x0 2026-09-30T03:07:49.421 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-us_6befbdbc9fba0169\bootmgr.exe.mui", hr=0x0 2026-09-30T03:07:49.764 Engine:Setting original file name "MicrosoftRawCodec" for "c:\windows\system32\windowscodecsraw.dll", hr=0x0 2026-09-30T03:07:49.889 Engine:Setting original file name "ContextH.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.20348.1_es-es_6b0eb21562d761e1\bwcontexthandler.dll.mui", hr=0x0 2026-09-30T03:07:50.171 Engine:Setting original file name "iscsicli.exe" for "c:\windows\systemresources\iscsicli.exe.mun", hr=0x0 2026-09-30T03:07:50.311 Engine:Setting original file name "WindowsMediaPlayerPlayDVD_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerplaydvd\de-de\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:50.577 Engine:Setting original file name "gpprefcl" for "c:\windows\winsxs\amd64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.20348.4893_de-de_58c3ab2a0a9910f8\gpprefcl.dll.mui", hr=0x0 2026-09-30T03:07:50.936 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\18df1323c4f8565462198186a69df92f\mscorlib.ni.dll", hr=0x0 2026-09-30T03:07:51.014 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_de-de_e2fb1a83a52a1f1b\apphelp.dll.mui", hr=0x0 2026-09-30T03:07:51.202 Engine:Setting original file name "reg.exe" for "c:\windows\syswow64\reg.exe", hr=0x0 2026-09-30T03:07:51.452 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_de-de_52d9fbd3cbb49a79\dcgpofix.exe.mui", hr=0x0 2026-09-30T03:07:51.514 Engine:Setting original file name "user32" for "c:\windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_69efc830e71cd88d\user32.dll.mui", hr=0x0 2026-09-30T03:07:51.593 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_3904c26a46912df0\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:07:51.749 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pl-pl_26acd041893dd034\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:07:51.936 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_es-es_fb962eb0bab997e3\dcgpofix.exe.mui", hr=0x0 2026-09-30T03:07:51.999 Engine:Setting original file name "mydocs.dll" for "c:\windows\systemresources\mydocs.dll.mun", hr=0x0 2026-09-30T03:07:52.186 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ko-kr_f99ea94ccaca2cef\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:07:52.343 Engine:Setting original file name "NPSMDesktopProvider.dll" for "c:\windows\winsxs\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.20348.5386_none_db1126149f75462a\npsmdesktopprovider.dll.mun", hr=0x0 2026-09-30T03:07:52.421 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:07:52.686 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fi-fi_c64ae5f210544a48\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:07:52.733 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_es-mx_6df208469e74d6b9\bootmgr.exe.mui", hr=0x0 2026-09-30T03:07:52.780 Engine:Setting original file name "wiashext.dll" for "c:\windows\systemresources\wiashext.dll.mun", hr=0x0 2026-09-30T03:07:52.952 Engine:Setting original file name "bfsvc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.20348.1_none_2cf702736f0ad5f2\ucsvc.exe", hr=0x0 2026-09-30T03:07:52.999 Engine:Setting original file name "Placeholder.dll" for "c:\windows\winsxs\amd64_netfx4-penimc_v0400_b03f5f7f11d50a3a_4.0.15806.696_none_daf341310caa4b8c\penimc_v0400.dll", hr=0x0 2026-09-30T03:07:52.999 Engine:Setting original file name "DevicePairingFolder.dll" for "c:\windows\winsxs\amd64_microsoft-windows-devicepairingfolder_31bf3856ad364e35_10.0.20348.2849_none_f47415dd5a05a691\devicepairingfolder.dll.mun", hr=0x0 2026-09-30T03:07:53.452 Engine:Setting original file name "user32" for "c:\windows\syswow64\user32.dll", hr=0x0 2026-09-30T03:07:53.530 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:53.561 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-file-l1-2-1.dll", hr=0x0 2026-09-30T03:07:53.655 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:07:53.858 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:07:53.983 Engine:Setting original file name "imm32" for "c:\windows\system32\imm32.dll", hr=0x0 2026-09-30T03:07:54.546 Engine:Setting original file name "WLRMNDR.EXE" for "c:\windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.20348.1_none_1de2775956026dd2\wlrmdr.exe", hr=0x0 2026-09-30T03:07:54.686 Engine:Setting original file name "WerMgr" for "c:\windows\syswow64\wermgr.exe", hr=0x0 2026-09-30T03:07:54.749 Engine:Setting original file name "MMSys.cpl" for "c:\windows\systemresources\mmsys.cpl.mun", hr=0x0 2026-09-30T03:07:55.046 Engine:Setting original file name "WLANGPUI.DLL" for "c:\windows\systemresources\wlangpui.dll.mun", hr=0x0 2026-09-30T03:07:55.077 Engine:Setting original file name "Vault.DLL" for "c:\windows\systemresources\vault.dll.mun", hr=0x0 2026-09-30T03:07:55.140 Engine:Setting original file name "THEMECPL.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-themecpl_31bf3856ad364e35_10.0.20348.3451_none_9f3c285d38b0f159\themecpl.dll.mun", hr=0x0 2026-09-30T03:07:55.499 Engine:Setting original file name "rastlsext.dll" for "c:\windows\winsxs\amd64_microsoft-windows-rastls_31bf3856ad364e35_10.0.20348.4767_none_14b4087282781b99\rastlsext.dll.mun", hr=0x0 2026-09-30T03:07:55.546 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnathlp.dll", hr=0x0 2026-09-30T03:07:55.890 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-threadpool-legacy-l1-1-0.dll", hr=0x0 2026-09-30T03:07:55.968 Engine:Setting original file name "spwizres.dll" for "c:\windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_10.0.20348.1_none_3fc1e2ba1a7fcff8\spwizimg.dll", hr=0x0 2026-09-30T03:07:56.015 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_es-es_44d4c477a71b0a61\setup16.exe.mui", hr=0x0 2026-09-30T03:07:56.030 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\pcw\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:56.046 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:56.077 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:07:56.093 Engine:Setting original file name "filterLib.dll" for "c:\windows\system32\fltlib.dll", hr=0x0 2026-09-30T03:07:56.108 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_a166bd54ad6ada09\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:56.733 Engine:Setting original file name "main.cpl" for "c:\windows\systemresources\main.cpl.mun", hr=0x0 2026-09-30T03:07:57.061 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_55e310e77712d88c\bootmgr.exe.mui", hr=0x0 2026-09-30T03:07:57.343 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nb-no\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:07:57.390 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgr.efi.mui", hr=0x0 2026-09-30T03:07:57.624 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\diagnostics\scheduled\maintenance\de-de\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:57.640 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:07:57.765 Engine:Setting original file name "WEXTRACT.EXE .MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.20348.1_es-es_8492bf6fa07d2e14\wextract.exe.mui", hr=0x0 2026-09-30T03:07:58.108 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:58.124 Engine:Setting original file name "SearchIndexer.exe" for "c:\windows\systemresources\searchindexer.exe.mun", hr=0x0 2026-09-30T03:07:58.311 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-libraryloader-l1-1-1.dll", hr=0x0 2026-09-30T03:07:58.327 Engine:Setting original file name ""ApplyTrustOffline.PROGRAM"" for "c:\windows\winsxs\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.20348.5386_none_09cb83a3e8d9de45\applytrustoffline.exe", hr=0x0 2026-09-30T03:07:58.452 Engine:Setting original file name "propsys.dll" for "c:\windows\systemresources\propsys.dll.mun", hr=0x0 2026-09-30T03:07:58.530 Engine:Setting original file name "RRASUPG.DLL" for "c:\windows\winsxs\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.20348.5386_none_54256ecd99fec2cb\rasmigplugin.dll", hr=0x0 2026-09-30T03:07:58.530 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_6b9515569ff15e32\bootmgr.exe.mui", hr=0x0 2026-09-30T03:07:58.780 Engine:Setting original file name "RdmaPing.sys" for "c:\windows\system32\ndkping.exe", hr=0x0 2026-09-30T03:07:58.811 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4-nlsdata0009_b03f5f7f11d50a3a_4.0.15806.0_none_39b3f38787e11d68\nlsdata0009.dll", hr=0x0 2026-09-30T03:07:58.811 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-1.dll", hr=0x0 2026-09-30T03:07:58.968 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlslexicons0007.dll", hr=0x0 2026-09-30T03:07:59.155 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_57cdf2a48fce10dd\diagpackage.dll.mui", hr=0x0 2026-09-30T03:07:59.327 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000a.dll", hr=0x0 2026-09-30T03:07:59.655 Engine:Setting original file name "OOBECaptivePortalFlow.exe" for "c:\windows\winsxs\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.20348.3692_none_ea9c313aecda491b\oobenetworkcaptiveportal.exe", hr=0x0 2026-09-30T03:07:59.765 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-memory-l1-1-2.dll", hr=0x0 2026-09-30T03:07:59.890 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_it-it_f89a86e669e4eeee\bootmgr.exe.mui", hr=0x0 2026-09-30T03:08:00.108 Engine:Setting original file name "COMCT232.OCX" for "c:\windows\syswow64\mscomct2.ocx", hr=0x0 2026-09-30T03:08:00.265 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\tr-tr\bootmgr.exe.mui", hr=0x0 2026-09-30T03:08:00.280 Engine:Setting original file name "winrnr" for "c:\windows\syswow64\winrnr.dll", hr=0x0 2026-09-30T03:08:00.280 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sv-se\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:08:00.515 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_en-us_dd01daf68708d7cb\eappgnui.dll.mui", hr=0x0 2026-09-30T03:08:00.530 Engine:Setting original file name "RdmaPerf.sys" for "c:\windows\system32\ndkperfcmd.exe", hr=0x0 2026-09-30T03:08:00.749 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_7bb6917290b6d224\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:00.890 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_en-gb_48281b18e7494364\mfc40u.dll.mui", hr=0x0 2026-09-30T03:08:00.890 Engine:Setting original file name "Van.dll" for "c:\windows\winsxs\amd64_microsoft-windows-van_31bf3856ad364e35_10.0.20348.2849_none_545bdfb48b6a00a8\van.dll.mun", hr=0x0 2026-09-30T03:08:01.733 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\zh-tw\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:08:01.749 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-security-base-l1-1-0.dll", hr=0x0 2026-09-30T03:08:01.858 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-2-0.dll", hr=0x0 2026-09-30T03:08:02.015 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:08:02.030 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\tr-tr\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:08:02.874 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ru-ru_70859c156c186220\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:08:03.312 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.20348.5386_none_bab2aaa7a9e4293b\rasplap.dll.mun", hr=0x0 2026-09-30T03:08:03.499 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\audio\de-de\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:03.515 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_c5d35287af05a10a\bootmgr.exe.mui", hr=0x0 2026-09-30T03:08:03.733 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f0ebf434130b9cde\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:03.749 Engine:Setting original file name "audioadg.exe" for "c:\windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.20348.5386_none_1f1bf99d16d1a196\audiodg.exe", hr=0x0 2026-09-30T03:08:03.905 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_en-us_39b7176d482fcb69\tapisrv.dll.mui", hr=0x0 2026-09-30T03:08:04.015 Engine:Setting original file name "sbscmp10.dll" for "c:\windows\winsxs\amd64_netfx4-fw_sbsnclperf_dll_b03f5f7f11d50a3a_4.0.15806.0_none_67a12b0bb6570993\sbsnclperf.dll", hr=0x0 2026-09-30T03:08:04.062 Engine:Setting original file name "lhdfrgui.exe" for "c:\windows\systemresources\dfrgui.exe.mun", hr=0x0 2026-09-30T03:08:04.405 Engine:Setting original file name "DataExchange.dll" for "c:\windows\systemresources\dataexchange.dll.mun", hr=0x0 2026-09-30T03:08:04.437 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\nl-nl\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:08:04.702 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sl-si_0eb2c27a61cc672d\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:08:04.718 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_bd1291edd1ab5058\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:04.796 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\syswow64\wbem\de-de\mmfutil.dll.mui", hr=0x0 2026-09-30T03:08:05.390 Engine:Setting original file name "setup" for "c:\download\ms visual c++ redistributable\vc_redist.x64.exe", hr=0x0 2026-09-30T03:08:05.921 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\system32\de-de\msacm32.drv.mui", hr=0x0 2026-09-30T03:08:05.968 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_e06d931f7e20520b\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:06.015 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_3d1c533c1bdfcb34\schtasks.exe", hr=0x0 2026-09-30T03:08:06.140 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5256_zh-cn_86e263cf023b4247\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:08:06.343 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\search\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:06.421 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_c922f55bac19cee0\rdpsign.exe.mui", hr=0x0 2026-09-30T03:08:06.718 Engine:Setting original file name "DefaultGPOFix" for "c:\windows\winsxs\x86_microsoft-windows-g..o-restore.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_9e4da4afad8bae45\dcgpofix.exe.mui", hr=0x0 2026-09-30T03:08:07.187 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5fca07ecc47d66ba\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:07.218 Engine:Setting original file name "Sistema operativo Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.20348.1_es-es_22d2a343f16670bb\aeevts.dll.mui", hr=0x0 2026-09-30T03:08:07.468 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:08:07.608 Engine:Setting original file name "wcp.dll" for "c:\windows\system32\ssshim.dll", hr=0x0 2026-09-30T03:08:07.812 Engine:Setting original file name "WSecEdit.dll" for "c:\windows\systemresources\wsecedit.dll.mun", hr=0x0 2026-09-30T03:08:07.827 Engine:Setting original file name "Système d’exploitation Microsoft® Windows®" for "c:\windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_c81b50855b8ea95a\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:08.108 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-fibers-l1-1-1.dll", hr=0x0 2026-09-30T03:08:08.483 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-private-l1-1-1.dll", hr=0x0 2026-09-30T03:08:08.530 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\speech\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:08.624 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b8144057f09f0bfa\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:08.765 Engine:Setting original file name "winsqlite3" for "c:\windows\system32\winsqlite3.dll", hr=0x0 2026-09-30T03:08:08.780 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shutdown-l1-1-0.dll", hr=0x0 2026-09-30T03:08:09.140 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_de-de_b4d954fc53cb9048\vsswmi.dll.mui", hr=0x0 2026-09-30T03:08:09.249 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsupdate\fr-fr\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:09.452 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_es-es_dca6b939e50b53c1\scrnsave.scr.mui", hr=0x0 2026-09-30T03:08:09.468 Engine:Setting original file name "ADVPACK.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.20348.1_es-es_3eaf6ff592a356b9\ieadvpack.dll.mui", hr=0x0 2026-09-30T03:08:09.483 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\bluetooth\de-de\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:09.515 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:08:09.671 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processthreads-l1-1-2.dll", hr=0x0 2026-09-30T03:08:09.733 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi_ex\lv-lv\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:08:10.124 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_es-es_2b1adffb6773fa1e\ir41_32original.dll.mui", hr=0x0 2026-09-30T03:08:10.218 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-datetime-l1-1-1.dll", hr=0x0 2026-09-30T03:08:10.718 Engine:Setting original file name "MrmCore.dll" for "c:\windows\system32\mrmcorer.dll", hr=0x0 2026-09-30T03:08:10.765 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-comm-l1-1-0.dll", hr=0x0 2026-09-30T03:08:10.827 Engine:Setting original file name "BCP47Lang.dll" for "c:\windows\syswow64\bcp47langs.dll", hr=0x0 2026-09-30T03:08:10.921 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.graphics.winmd", hr=0x0 2026-09-30T03:08:10.968 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:08:10.999 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_de-de_0a6b80265c3a47f9\certadm.dll.mui", hr=0x0 2026-09-30T03:08:11.046 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_de-de_8671972224f0fda9\tapisrv.dll.mui", hr=0x0 2026-09-30T03:08:11.515 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnsvr.exe", hr=0x0 2026-09-30T03:08:11.671 Engine:Setting original file name "d2d1" for "c:\windows\winsxs\wow64_microsoft-windows-d2d_31bf3856ad364e35_10.0.20348.5499_none_5a63b292c28b1f14\d2d1.dll", hr=0x0 2026-09-30T03:08:11.921 Engine:Setting original file name "remotepg.dll" for "c:\windows\winsxs\amd64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.20348.2849_none_ad386c5bdfd7e3b9\remotepg.dll.mun", hr=0x0 2026-09-30T03:08:11.937 Engine:Setting original file name "eapgnui.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_10.0.20348.5139_es-es_d2788d8852cf0775\eappgnui.dll.mui", hr=0x0 2026-09-30T03:08:12.249 Engine:Setting original file name "mstscax.dll" for "c:\windows\systemresources\mstscax.dll.mun", hr=0x0 2026-09-30T03:08:12.265 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_de-de_d958da92de8abeb5\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:12.562 Engine:Setting original file name "DismProvPS.DLL" for "c:\windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.20348.2849_none_77576529a4c00781\dismcoreps.dll", hr=0x0 2026-09-30T03:08:12.905 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_20efacd51f4034ad\bootmgr.efi.mui", hr=0x0 2026-09-30T03:08:13.171 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_fa4f6e79f285c00c\srm.dll.mui", hr=0x0 2026-09-30T03:08:13.233 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-sddl-l1-1-0.dll", hr=0x0 2026-09-30T03:08:13.296 Engine:Setting original file name "MFC40.DLL.MUI" for "c:\windows\winsxs\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.20348.1_es-es_4f7c331ae298e8ce\mfc40u.dll.mui", hr=0x0 2026-09-30T03:08:13.343 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:08:13.468 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.security.winmd", hr=0x0 2026-09-30T03:08:13.515 Engine:Setting original file name ""AcGenral.dll"" for "c:\windows\system32\acgenral.dll", hr=0x0 2026-09-30T03:08:13.562 Engine:Setting original file name "VCAMP140.DLL" for "c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27810.0_x64__8wekyb3d8bbwe\vcamp140_app.dll", hr=0x0 2026-09-30T03:08:13.624 Engine:Setting original file name "PSAPI" for "c:\windows\system32\psapi.dll", hr=0x0 2026-09-30T03:08:13.968 Engine:Setting original file name "ucrtbase.dll" for "c:\windows\winsxs\amd64_microsoft-onecore-i..atedusermode-common_31bf3856ad364e35_10.0.20348.5386_none_a6eb2a03728e1f4b\ucrtbase_enclave.dll", hr=0x0 2026-09-30T03:08:14.030 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_el-gr_2709dbfb1b4ac342\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:08:14.077 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hu-hu_1157d78bf26c3d9c\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:08:14.437 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_de-de_1dedbad036ac9ab3\mscpxl32.dll.mui", hr=0x0 2026-09-30T03:08:14.530 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_es-es_272fe1451b3a581e\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:08:14.718 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-errorhandling-l1-1-0.dll", hr=0x0 2026-09-30T03:08:14.952 Engine:Setting original file name "wdc.dll" for "c:\windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.20348.2849_none_444b98d3d3524d93\wdc.dll.mun", hr=0x0 2026-09-30T03:08:15.218 Engine:Setting original file name "user32" for "c:\windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.20348.1_de-de_28d0c9a739a686bc\user32.dll.mui", hr=0x0 2026-09-30T03:08:15.233 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\device\de-de\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:15.608 Engine:Setting original file name "UNKNOWN_FILE" for "c:\windows\microsoft.net\assembly\gac_msil\accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\accessibility.dll", hr=0x0 2026-09-30T03:08:15.608 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\qps-ploc\bootmgr.exe.mui", hr=0x0 2026-09-30T03:08:15.640 Engine:Setting original file name "bootstr.exe" for "c:\windows\system32\bootstr.dll", hr=0x0 2026-09-30T03:08:15.874 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\mmfutil.dll.mui", hr=0x0 2026-09-30T03:08:16.124 Engine:Setting original file name "imageres.DLL" for "c:\windows\systemresources\imageres.dll.mun", hr=0x0 2026-09-30T03:08:16.140 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-io-l1-1-0.dll", hr=0x0 2026-09-30T03:08:16.499 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_27377120dc26e1e5\iccvid.dll.mui", hr=0x0 2026-09-30T03:08:16.593 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-delayload-l1-1-0.dll", hr=0x0 2026-09-30T03:08:16.718 Engine:Setting original file name "AppVEntSubsystems.dll" for "c:\windows\winsxs\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.20348.5139_none_5bc65bcc248d3d2d\appventsubsystems64.dll", hr=0x0 2026-09-30T03:08:16.796 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:08:16.827 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-br\bootmgr.efi.mui", hr=0x0 2026-09-30T03:08:16.999 Engine:Setting original file name "TQUERY.dll" for "c:\windows\systemresources\tquery.dll.mun", hr=0x0 2026-09-30T03:08:17.202 Engine:Setting original file name "System.Core.dll" for "c:\windows\microsoft.net\framework64\v4.0.30319\nativeimages\system.core.ni.dll", hr=0x0 2026-09-30T03:08:17.358 Engine:Setting original file name "kernel32" for "c:\windows\syswow64\kernel32.dll", hr=0x0 2026-09-30T03:08:17.452 Engine:Setting original file name "iccvid.drv.mui" for "c:\windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_dbc3c844fa4fce19\iccvid.dll.mui", hr=0x0 2026-09-30T03:08:17.624 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-core-l1-1-0.dll", hr=0x0 2026-09-30T03:08:19.015 Engine:Setting original file name "SUD.DLL" for "c:\windows\systemresources\sud.dll.mun", hr=0x0 2026-09-30T03:08:19.437 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-service-management-l1-1-0.dll", hr=0x0 2026-09-30T03:08:19.624 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.20348.1_none_3d6df9eef07f18cb\dpwsockx.dll", hr=0x0 2026-09-30T03:08:19.905 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-us_276484611b136679\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:08:20.140 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-runtime-l1-1-0.dll", hr=0x0 2026-09-30T03:08:20.312 Engine:Setting original file name "ir50_32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_10.0.20348.1_de-de_83b2e63544095f0b\ir50_32original.dll.mui", hr=0x0 2026-09-30T03:08:20.562 Engine:Setting original file name "nltestrk.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-s..ls-nltest.resources_31bf3856ad364e35_10.0.20348.4050_fr-fr_011abe738ab51558\nltest.exe.mui", hr=0x0 2026-09-30T03:08:20.843 Engine:Setting original file name "HeidiSQL" for "c:\program files (x86)\common files\mariadbshared\heidisql\heidisql.exe", hr=0x0 2026-09-30T03:08:20.937 Engine:Setting original file name "EapTeapExt.dll" for "c:\windows\systemresources\eapteapext.dll.mun", hr=0x0 2026-09-30T03:08:20.968 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-2-0.dll", hr=0x0 2026-09-30T03:08:20.983 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscordbi.dll", hr=0x0 2026-09-30T03:08:21.093 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_es-es_b327b3034b3f4563\certadm.dll.mui", hr=0x0 2026-09-30T03:08:21.390 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_es-es_1cbe7c659f8e369a\iechooser.exe.mui", hr=0x0 2026-09-30T03:08:21.405 Engine:Setting original file name "PCW_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_en-us_895e69186cfe5dd0\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:21.405 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nl-nl\bootmgr.efi.mui", hr=0x0 2026-09-30T03:08:21.483 Engine:Setting original file name "TSSignTool.exe.mui" for "c:\windows\syswow64\fr-fr\rdpsign.exe.mui", hr=0x0 2026-09-30T03:08:21.499 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_diasymreader.dll", hr=0x0 2026-09-30T03:08:21.593 Engine:Setting original file name "wmploc.dll" for "c:\windows\systemresources\wmploc.dll.mun", hr=0x0 2026-09-30T03:08:21.952 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-o..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_6e6d84c892d534e4\api-ms-win-shcore-stream-l1-1-0.dll", hr=0x0 2026-09-30T03:08:22.046 Engine:Setting original file name "imapi.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_10.0.20348.1_en-gb_a55a71dfe6f066cc\imapi.dll.mui", hr=0x0 2026-09-30T03:08:22.234 Engine:Setting original file name "hiberrsm.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.20348.5499_none_0398dbae9ee0442f\winresume.exe", hr=0x0 2026-09-30T03:08:22.249 Engine:Setting original file name "Audio_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_426c415b886b4fbe\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:22.359 Engine:Setting original file name "MAPI32.DLL.MUI" for "c:\windows\system32\de-de\mapistub.dll.mui", hr=0x0 2026-09-30T03:08:22.374 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\es-es\ndisimplatcim.dll.mui", hr=0x0 2026-09-30T03:08:22.577 Engine:Setting original file name "EaseOfAccessDialog.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\easeofaccessdialog.exe.mun", hr=0x0 2026-09-30T03:08:22.640 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-pt_29e28a518736d3f4\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:08:22.874 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-obsolete-l1-2-0.dll", hr=0x0 2026-09-30T03:08:23.187 Engine:Setting original file name "Apphelp" for "c:\windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.20348.1_es-es_8162a30e5fce5a8a\apphelp.dll.mui", hr=0x0 2026-09-30T03:08:23.640 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:08:24.093 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\nb-no\bootmgr.exe.mui", hr=0x0 2026-09-30T03:08:24.155 Engine:Setting original file name "schtasks.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.20348.4294_none_32c7a8e9e77f0939\schtasks.exe", hr=0x0 2026-09-30T03:08:24.609 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_fr-ca_c25da18e12e4d4a6\bootmgr.efi.mui", hr=0x0 2026-09-30T03:08:24.937 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_pt-br_2900bae587c76418\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:08:25.046 Engine:Setting original file name "WindowsUpdate_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0b3b821a1ed7e9e8\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:25.280 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-kernel32-legacy-l1-1-0.dll", hr=0x0 2026-09-30T03:08:25.577 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\sl-si\bootmgr.exe.mui", hr=0x0 2026-09-30T03:08:25.640 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-base-util-l1-1-0.dll", hr=0x0 2026-09-30T03:08:25.796 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_es-es_517dcbb79415ff24\activeds.dll.mui", hr=0x0 2026-09-30T03:08:25.952 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_es-es_199b3ba9ac52fbbc\rasplap.dll.mui", hr=0x0 2026-09-30T03:08:26.374 Engine:Setting original file name "SdfUsbXhci.exe" for "c:\windows\system32\driverstore\filerepository\usbxhci.inf_amd64_ca6f3fb5265b4a14\usbxhcicompanion.dll", hr=0x0 2026-09-30T03:08:27.124 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-processenvironment-l1-1-0.dll", hr=0x0 2026-09-30T03:08:27.202 Engine:Setting original file name "ADs" for "c:\windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_f43541b686e81586\activeds.dll.mui", hr=0x0 2026-09-30T03:08:27.281 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll", hr=0x0 2026-09-30T03:08:27.859 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_et-ee_657ae630a3e6cf9d\bootmgr.exe.mui", hr=0x0 2026-09-30T03:08:27.984 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-1-0.dll", hr=0x0 2026-09-30T03:08:28.265 Engine:Setting original file name "sethc.exe" for "c:\windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.20348.5499_none_0b326075a754b238\sethc.exe.mun", hr=0x0 2026-09-30T03:08:28.343 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_de-de_d63c92352bb6fbb7\wiadss.dll.mui", hr=0x0 2026-09-30T03:08:28.437 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15806.0_de-de_cda109b862dd9736\nlsdata0007.dll", hr=0x0 2026-09-30T03:08:28.437 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_it-it_b40f4d8ae53e53fe\bootmgr.efi.mui", hr=0x0 2026-09-30T03:08:28.906 Engine:Setting original file name "kernel32" for "c:\windows\system32\kernel32.dll", hr=0x0 2026-09-30T03:08:28.999 Engine:Setting original file name "MMFUtil.exe.mui" for "c:\windows\winsxs\wow64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_en-us_8bc1fc76af8af022\mmfutil.dll.mui", hr=0x0 2026-09-30T03:08:29.015 Engine:Setting original file name "Power_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_b5167ca59cfbfa7b\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:29.046 Engine:Setting original file name "secinit" for "c:\windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.20348.1_de-de_5d491c766fc5bc7e\secinit.exe.mui", hr=0x0 2026-09-30T03:08:29.312 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\lt-lt\bootmgr.exe.mui", hr=0x0 2026-09-30T03:08:29.327 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ro-ro_6e1d50896d9d9f50\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:08:29.531 Engine:Setting original file name "F12Chooser.exe.mui" for "c:\windows\winsxs\x86_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.20348.1_en-gb_156a6463a43e9130\iechooser.exe.mui", hr=0x0 2026-09-30T03:08:29.718 Engine:Setting original file name "MSJINT40.DLL" for "c:\windows\syswow64\fr-fr\msjint40.dll.mui", hr=0x0 2026-09-30T03:08:30.015 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.foundation.winmd", hr=0x0 2026-09-30T03:08:30.499 Engine:Setting original file name "ServDeps.exe.mui" for "c:\windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_23f025076e23362e\servdeps.dll.mui", hr=0x0 2026-09-30T03:08:30.609 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:08:30.796 Engine:Setting original file name "WindowsMediaPlayerConfiguration_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayerconfiguration\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:30.984 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_9e92d155ea7f4ed9\api-ms-win-security-cryptoapi-l1-1-0.dll", hr=0x0 2026-09-30T03:08:31.343 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_en-gb_07ed85f6d37e8881\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:31.421 Engine:Setting original file name "VpnSohDesktop.dll" for "c:\windows\winsxs\wow64_microsoft-windows-perceptionapi-stub_31bf3856ad364e35_10.0.20348.5020_none_2e3402afbb25f3b6\windows.perception.stub.dll", hr=0x0 2026-09-30T03:08:31.624 Engine:Setting original file name "gpprefcl" for "c:\windows\syswow64\en-us\gpprefcl.dll.mui", hr=0x0 2026-09-30T03:08:31.812 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-locale-l1-1-0.dll", hr=0x0 2026-09-30T03:08:31.937 Engine:Setting original file name "Maintenance_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-m..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_0f419df8cece2deb\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:32.062 Engine:Setting original file name "msinfo.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_10.0.20348.2849_de-de_f9ed2504ac9f44bd\msinfo32.exe.mui", hr=0x0 2026-09-30T03:08:32.328 Engine:Setting original file name "msacm32.acm.mui" for "c:\windows\winsxs\wow64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.20348.1_es-es_877d8f47e675a402\msacm32.drv.mui", hr=0x0 2026-09-30T03:08:32.687 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\en-gb\aerolite.msstyles.mui", hr=0x0 2026-09-30T03:08:32.734 Engine:Setting original file name "dpnsvr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_3c9f4669e4994e1d\dpnathlp.dll", hr=0x0 2026-09-30T03:08:32.781 Engine:Setting original file name "memdiag.exe" for "c:\windows\winsxs\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.20348.5386_none_8b062e326b2ffe75\memtest.exe", hr=0x0 2026-09-30T03:08:32.953 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\apps\es-es\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:32.984 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_de-de_9c18919ab8160cf7\setup16.exe.mui", hr=0x0 2026-09-30T03:08:33.343 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_en-gb_3d80ac75abcb64f7\setup16.exe.mui", hr=0x0 2026-09-30T03:08:33.468 Engine:Setting original file name "ir41_32.ax.mui" for "c:\windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_cdd255fa5a461080\ir41_32original.dll.mui", hr=0x0 2026-09-30T03:08:33.578 Engine:Setting original file name "BITS_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_5acbb656e371225c\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:34.499 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-process-l1-1-0.dll", hr=0x0 2026-09-30T03:08:35.093 Engine:Setting original file name "rasdlg.dll" for "c:\windows\systemresources\rasdlg.dll.mun", hr=0x0 2026-09-30T03:08:35.140 Engine:Setting original file name "dsquery.dll" for "c:\windows\systemresources\dsquery.dll.mun", hr=0x0 2026-09-30T03:08:35.187 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\uk-ua\bootmgr.exe.mui", hr=0x0 2026-09-30T03:08:35.234 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgr.efi.mui", hr=0x0 2026-09-30T03:08:35.531 Engine:Setting original file name "Apps_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.20348.5139_fr-fr_24cc836ec061d281\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:35.578 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.services.winmd", hr=0x0 2026-09-30T03:08:35.781 Engine:Setting original file name "mscxpl32.dll.mui" for "c:\windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_10.0.20348.1_es-es_c6a9edad25b1981d\mscpxl32.dll.mui", hr=0x0 2026-09-30T03:08:35.859 Engine:Setting original file name "WIADSS DLL" for "c:\windows\winsxs\x86_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_10.0.20348.1_en-gb_77a4ad101f6c53b7\wiadss.dll.mui", hr=0x0 2026-09-30T03:08:35.921 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhupnp.dll", hr=0x0 2026-09-30T03:08:35.984 Engine:Setting original file name "Search_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_ae52937f72c5ffce\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:36.062 Engine:Setting original file name "msdxm.ocx" for "c:\windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.20348.2849_none_b3ab9dc781781718\dxmasf.dll", hr=0x0 2026-09-30T03:08:36.281 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.media.winmd", hr=0x0 2026-09-30T03:08:36.343 Engine:Setting original file name "setup" for "c:\programdata\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe", hr=0x0 2026-09-30T03:08:36.703 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_system.enterpriseservices.dll", hr=0x0 2026-09-30T03:08:36.765 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-multibyte-l1-1-0.dll", hr=0x0 2026-09-30T03:08:36.843 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_uk-ua_516db378492e94b8\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:08:36.843 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\nb-no\bootmgr.efi.mui", hr=0x0 2026-09-30T03:08:36.859 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\pcat\zh-tw\bootmgr.exe.mui", hr=0x0 2026-09-30T03:08:36.874 Engine:Setting original file name "MSXML3.dll" for "c:\windows\systemresources\msxml3.dll.mun", hr=0x0 2026-09-30T03:08:36.999 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-1.dll", hr=0x0 2026-09-30T03:08:37.015 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sr-..-rs_b4e32abed6de0e5e\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:08:37.031 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.web.winmd", hr=0x0 2026-09-30T03:08:37.078 Engine:Setting original file name "scrnsave" for "c:\windows\winsxs\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.20348.1_en-gb_d552a137e9bbae57\scrnsave.scr.mui", hr=0x0 2026-09-30T03:08:37.453 Engine:Setting original file name "bootres" for "c:\windows\winsxs\amd64_microsoft-windows-bootres_31bf3856ad364e35_10.0.20348.1_none_c88bbea74af76b1d\bootres.dll", hr=0x0 2026-09-30T03:08:37.468 Engine:Setting original file name "AppVEntSubsystemContoller.dll" for "c:\windows\system32\appventsubsystemcontroller.dll", hr=0x0 2026-09-30T03:08:37.828 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\pt-pt\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:08:37.890 Engine:Setting original file name "RasCredProv" for "c:\windows\winsxs\amd64_microsoft-windows-rasplap-mui.resources_31bf3856ad364e35_10.0.20348.1_de-de_70df08ccbd4dfe52\rasplap.dll.mui", hr=0x0 2026-09-30T03:08:37.906 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnhpast.dll", hr=0x0 2026-09-30T03:08:37.921 Engine:Setting original file name "EDGEHTML.DLL" for "c:\windows\systemresources\edgehtml.dll.mun", hr=0x0 2026-09-30T03:08:38.718 Engine:Setting original file name "sbscmp20_mscorwks.dll" for "c:\windows\microsoft.net\framework64\sbscmp10.dll", hr=0x0 2026-09-30T03:08:38.843 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_hr-hr_1023b1c5f32edc34\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:08:38.999 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_tr-tr_b58dd0d151fd6e6c\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:08:38.999 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-crt-filesystem-l1-1-0.dll", hr=0x0 2026-09-30T03:08:39.171 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_6467029ea4914da4\bootmgr.exe.mui", hr=0x0 2026-09-30T03:08:39.359 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\winsxs\wow64_microsoft-windows-d..usmanager.resources_31bf3856ad364e35_10.0.20348.1_de-de_60ad107ed047e2e1\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-30T03:08:39.468 Engine:Setting original file name "connect.dll" for "c:\windows\winsxs\amd64_microsoft-windows-getconnectedwizards_31bf3856ad364e35_10.0.20348.2849_none_0d50688fc918d736\connect.dll.mun", hr=0x0 2026-09-30T03:08:39.546 Engine:Setting original file name "Betriebssystem Microsoft® Windows®" for "c:\windows\diagnostics\system\networking\de-de\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:40.218 Engine:Setting original file name "SETUP.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-wow64-legacy.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_e78c3a7699ed20c3\setup16.exe.mui", hr=0x0 2026-09-30T03:08:40.249 Engine:Setting original file name "extractr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.20348.5020_none_3192ce9846fce5cf\wimserv.exe", hr=0x0 2026-09-30T03:08:40.390 Engine:Setting original file name "Taskmgr.exe" for "c:\windows\systemresources\taskmgr.exe.mun", hr=0x0 2026-09-30T03:08:40.406 Engine:Setting original file name "DeviceDisplayStatus.dll.mui" for "c:\windows\system32\en-gb\devicedisplaystatusmanager.dll.mui", hr=0x0 2026-09-30T03:08:40.406 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_sv-se_0c80868a63416c7b\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:08:40.890 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_da-dk_8148192c2a5f061a\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:08:40.890 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-security-lsalookup-l2-1-0.dll", hr=0x0 2026-09-30T03:08:41.046 Engine:Setting original file name "sysdm.cpl" for "c:\windows\systemresources\sysdm.cpl.mun", hr=0x0 2026-09-30T03:08:41.062 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sr-latn-rs\bootmgr.efi.mui", hr=0x0 2026-09-30T03:08:41.218 Engine:Setting original file name "CertAdm" for "c:\windows\winsxs\x86_microsoft-windows-c..rtadm-dll.resources_31bf3856ad364e35_10.0.20348.5139_en-us_b35c561f4b1853be\certadm.dll.mui", hr=0x0 2026-09-30T03:08:41.671 Engine:Setting original file name "System.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\nativeimages\system.ni.dll", hr=0x0 2026-09-30T03:08:42.046 Engine:Setting original file name "dpnlobby.dll" for "c:\windows\winsxs\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.20348.1_none_e080aae62c3bdce7\dpnaddr.dll", hr=0x0 2026-09-30T03:08:42.296 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_350df721d72905c0\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:42.718 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-0.dll", hr=0x0 2026-09-30T03:08:42.953 Engine:Setting original file name "CertAdm" for "c:\windows\syswow64\fr-fr\certadm.dll.mui", hr=0x0 2026-09-30T03:08:43.000 Engine:Setting original file name "wow64lg2.dll" for "c:\windows\system32\wow64win.dll", hr=0x0 2026-09-30T03:08:43.140 Engine:Setting original file name "sbs_microsoft.jscript.dll" for "c:\windows\microsoft.net\framework\sbs_mscorrc.dll", hr=0x0 2026-09-30T03:08:43.171 Engine:Setting original file name "nlsbres.dll.mui" for "c:\windows\system32\en-us\winnlsres.dll.mui", hr=0x0 2026-09-30T03:08:43.265 Engine:Setting original file name "APPWIZ.CPL" for "c:\windows\winsxs\amd64_microsoft-windows-appwiz_31bf3856ad364e35_10.0.20348.5386_none_b4426df359180801\appwiz.cpl.mun", hr=0x0 2026-09-30T03:08:43.375 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata0007.dll", hr=0x0 2026-09-30T03:08:43.484 Engine:Setting original file name "DeviceCategories.dll" for "c:\windows\winsxs\wow64_microsoft-windows-ddores_31bf3856ad364e35_10.0.20348.1_none_b289844f3bf3db81\ddores.dll", hr=0x0 2026-09-30T03:08:43.484 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sl-si\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:08:43.750 Engine:Setting original file name "bootmgr.exe" for "c:\windows\boot\efi\sk-sk\bootmgr.efi.mui", hr=0x0 2026-09-30T03:08:43.828 Engine:Setting original file name "srm.lib.mui" for "c:\windows\winsxs\x86_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.20348.5139_en-us_57cc9b96ff8cb805\srm.dll.mui", hr=0x0 2026-09-30T03:08:44.125 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-string-l2-1-0.dll", hr=0x0 2026-09-30T03:08:44.250 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_lt-lt_9d69d54dbcf1f88c\bootmgfw.efi.mui", hr=0x0 2026-09-30T03:08:44.437 Engine:Setting original file name "TAPISRV.EXE.MUI" for "c:\windows\winsxs\wow64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.20348.5139_es-es_398274514856bd0e\tapisrv.dll.mui", hr=0x0 2026-09-30T03:08:44.453 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_en-gb_1fdbc9431feab2b4\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:08:44.593 Engine:Setting original file name "KeyboardDiagnostic_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\keyboard\de-de\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:44.734 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-console-l1-1-0.dll", hr=0x0 2026-09-30T03:08:44.890 Engine:Setting original file name "d2d1" for "c:\windows\system32\d2d1.dll", hr=0x0 2026-09-30T03:08:44.906 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.1_none_68e379b5a65b38ac\api-ms-win-core-registry-l2-1-0.dll", hr=0x0 2026-09-30T03:08:45.265 Engine:Setting original file name "MrmCore.dll" for "c:\windows\winsxs\wow64_microsoft-windows-c..t-resources-mrmcore_31bf3856ad364e35_10.0.20348.5020_none_9e6a80bbc86408d7\mrmcorer.dll", hr=0x0 2026-09-30T03:08:45.265 Engine:Setting original file name "WindowsMediaPlayerMediaLibrary_DiagPackage.dll.mui" for "c:\windows\diagnostics\system\windowsmediaplayermedialibrary\en-gb\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:45.390 Engine:Setting original file name "VSSPROV.DLL.MUI" for "c:\windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.20348.1_en-gb_56416fd74780e848\vsswmi.dll.mui", hr=0x0 2026-09-30T03:08:45.406 Engine:Setting original file name "aero.msstyles.mui" for "c:\windows\resources\themes\aero\es-es\aerolite.msstyles.mui", hr=0x0 2026-09-30T03:08:45.578 Engine:Setting original file name "VsVersion.dll" for "c:\windows\winsxs\x86_netfx4-penimc_b03f5f7f11d50a3a_4.0.15806.696_none_7573f1c6d4639f87\penimc.dll", hr=0x0 2026-09-30T03:08:45.593 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.data.winmd", hr=0x0 2026-09-30T03:08:45.765 Engine:Setting original file name "ndisimplatwmi.DLL.MUI" for "c:\windows\syswow64\wbem\de-de\ndisimplatcim.dll.mui", hr=0x0 2026-09-30T03:08:45.843 Engine:Setting original file name "Device_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_es-es_4e347e352039867c\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:45.968 Engine:Setting original file name "winsqlite3" for "c:\windows\winsxs\wow64_microsoft-windows-winsqlite3_31bf3856ad364e35_10.0.20348.4647_none_c9096b99901f19cd\winsqlite3.dll", hr=0x0 2026-09-30T03:08:46.000 Engine:Setting original file name "CMMIGR.DLL" for "c:\windows\syswow64\setup\pbkmigr.dll", hr=0x0 2026-09-30T03:08:46.015 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlslexicons000c.dll", hr=0x0 2026-09-30T03:08:46.562 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-synch-l1-1-0.dll", hr=0x0 2026-09-30T03:08:46.562 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\nlsdata000a.dll", hr=0x0 2026-09-30T03:08:46.890 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-sysinfo-l1-2-0.dll", hr=0x0 2026-09-30T03:08:47.015 Engine:Setting original file name "wmic.exe" for "c:\windows\winsxs\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.20348.2849_none_54405a5933961199\wmic.exe", hr=0x0 2026-09-30T03:08:47.218 Engine:Setting original file name "Windows SDK" for "c:\windows\winsxs\wow64_microsoft-windows-runtime-metadata_31bf3856ad364e35_10.0.20348.2849_none_e388c0486e990544\windows.storage.winmd", hr=0x0 2026-09-30T03:08:47.546 Engine:Setting original file name "CRYPT32.DLL" for "c:\windows\systemresources\crypt32.dll.mun", hr=0x0 2026-09-30T03:08:47.812 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.20348.5139_bg-bg_7d8ffbc5cb37c8e0\bootmgr.exe.mui", hr=0x0 2026-09-30T03:08:47.859 Engine:Setting original file name "mstsc.exe" for "c:\windows\systemresources\mstsc.exe.mun", hr=0x0 2026-09-30T03:08:48.093 Engine:Setting original file name "SYSTEMCPL.DLL" for "c:\windows\systemresources\systemcpl.dll.mun", hr=0x0 2026-09-30T03:08:48.140 Engine:Setting original file name "mmcbase.dll" for "c:\windows\winsxs\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.20348.4163_none_b803623ca7c56bdc\mmcbase.dll.mun", hr=0x0 2026-09-30T03:08:48.265 Engine:Setting original file name "IEBrowseWeb_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_1e6e07718388e886\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:48.312 Engine:Setting original file name ""TextInputFramework.DYNLINK"" for "c:\windows\syswow64\textinputframework.dll", hr=0x0 2026-09-30T03:08:48.921 Engine:Setting original file name "stobject.dll" for "c:\windows\systemresources\stobject.dll.mun", hr=0x0 2026-09-30T03:08:48.921 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\winsxs\amd64_microsoft-windows-mpg4decd_31bf3856ad364e35_10.0.20348.2849_none_08e768f194682e23\mpg4decd.dll", hr=0x0 2026-09-30T03:08:48.937 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mp43decd.dll", hr=0x0 2026-09-30T03:08:48.968 Engine:Setting original file name "msdt.exe" for "c:\windows\systemresources\msdt.exe.mun", hr=0x0 2026-09-30T03:08:49.171 Engine:Setting original file name "apisetstub" for "c:\windows\winsxs\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.20348.4647_none_139deb08fb0ac952\api-ms-win-core-localization-l1-2-1.dll", hr=0x0 2026-09-30T03:08:49.171 Engine:Setting original file name "VsVersion.dll" for "c:\windows\microsoft.net\framework\v4.0.30319\wpf\naturallanguage6.dll", hr=0x0 2026-09-30T03:08:49.640 Engine:Setting original file name "mscorlib.dll" for "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\747e1cba31508bb6bd65bf9a07892fb2\mscorlib.ni.dll", hr=0x0 2026-09-30T03:08:49.890 Engine:Setting original file name "MSPAINT.EXE" for "c:\windows\systemresources\mspaint.exe.mun", hr=0x0 2026-09-30T03:08:50.171 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_ja-jp_5634cc97d85965d9\bootmgr_ex.efi.mui", hr=0x0 2026-09-30T03:08:50.187 Engine:Setting original file name "mf.dll" for "c:\windows\syswow64\mfpmp.exe", hr=0x0 2026-09-30T03:08:50.421 Engine:Setting original file name "Speech_DiagPackage.dll.mui" for "c:\windows\winsxs\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.20348.1_fr-fr_d7c56d20c9fb1c22\diagpackage.dll.mui", hr=0x0 2026-09-30T03:08:50.734 Engine:Setting original file name "bootmgr.exe" for "c:\windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.20348.5139_cs-cz_e40e390534190a1b\bootmgfw_ex.efi.mui", hr=0x0 2026-09-30T03:08:50.843 Engine:Setting original file name "mpg4dmod.dll" for "c:\windows\syswow64\mpg4decd.dll", hr=0x0 2026-09-30T03:08:50.843 OriginalFileName Maintenance::28206 files in Moac, 0 skipped (cached), 538 filename set 2026-09-30T03:08:50.843 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-09-30T03:10:36.609 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T03:10:36.609 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T03:10:36.609 [Cloud] Queued cloud request. 2026-09-30T03:10:36.609 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T03:10:36.609 [Cloud] Dequeued cloud request. 2026-09-30T03:10:36.609 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T03:10:36.765 [Cloud] End of cloud request. 2026-09-30T03:10:37.281 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-09-30T03:10:37.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T03:10:37.312 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-30T03:10:37.312 [RTP] [RtpConfig] Config change detected, type: 2 2026-09-30T03:10:37.312 [RTP] [RtpConfig] Config change detected, type: 4096 2026-09-30T03:10:37.312 [RTP] [RtpConfig] Config change detected, type: 4 2026-09-30T03:10:37.312 [RTP] [RtpConfig] Config change detected, type: 8 2026-09-30T03:10:37.312 [RTP] [RtpConfig] Config change detected, type: 16 2026-09-30T03:10:37.312 [RTP] [RtpConfig] Config change detected, type: 1024 2026-09-30T03:10:37.312 [RTP] [RtpConfig] Config change detected, type: 2048 2026-09-30T03:10:37.312 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-09-30T03:10:37.312 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-09-30T03:10:37.312 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-09-30T03:10:37.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T03:10:37.312 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-09-30T03:10:37.312 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-30T03:10:37.312 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-30T03:10:37.312 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-30T03:10:37.312 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-30T03:10:37.312 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-30T03:10:37.312 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-30T03:10:37.312 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-09-30T03:10:37.312 [RTP] [RtpConfig] Config change detected, type: 64 2026-09-30T03:10:37.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T03:10:37.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T03:10:37.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T03:10:39.890 [RTP] Duplicating the current plugin configuration object... 2026-09-30T03:10:39.890 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-30T03:10:39.890 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-09-30T03:10:39.890 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-30T03:10:39.890 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-09-30T03:10:39.890 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-09-30T03:13:37.797 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T03:13:37.797 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T03:13:37.797 [Cloud] Queued cloud request. 2026-09-30T03:13:37.797 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T03:13:37.797 [Cloud] Dequeued cloud request. 2026-09-30T03:13:37.797 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T03:13:37.953 [Cloud] End of cloud request. 2026-09-30T03:13:38.453 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T03:14:13.843 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T03:14:13.843 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T03:14:13.843 [Cloud] Queued cloud request. 2026-09-30T03:14:13.843 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T03:14:13.843 [Cloud] Dequeued cloud request. 2026-09-30T03:14:13.843 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T03:14:23.859 [Cloud] End of cloud request. 2026-09-30T03:14:24.359 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T03:19:23.004 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T03:34:28.010 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T03:39:44.965 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 21927, Count: 1349, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-30T03:39:44.965 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 5942, Count: 487, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-30T03:39:44.965 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 3432, Count: 291, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T03:39:44.965 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-30T03:39:44.965 ProcessImageName: WmiPrvSE.exe, Pid: 6732, TotalTime: 692, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-30T03:39:44.965 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 666, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-09-30T03:39:44.965 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 315, Count: 27, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T03:39:44.965 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T03:39:44.965 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 136, Count: 62, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 0% 2026-09-30T03:39:44.965 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-30T03:39:44.965 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-30T03:39:44.965 ProcessImageName: taskhostw.exe, Pid: 6904, TotalTime: 46, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 15% 2026-09-30T03:39:44.965 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-30T03:39:44.965 ProcessImageName: DeviceCensus.exe, Pid: 7856, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-30T03:39:44.965 ProcessImageName: mysqldump.exe, Pid: 7220, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 15% 2026-09-30T03:39:44.965 ProcessImageName: powershell.exe, Pid: 964, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-30T03:39:44.965 ProcessImageName: powershell.exe, Pid: 7944, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp85B8.tmp, EstimatedImpact: 0% 2026-09-30T03:39:44.965 ProcessImageName: ngentask.exe, Pid: 1436, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-30T03:39:44.965 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-30T03:39:44.965 ProcessImageName: cmd.exe, Pid: 2248, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-30T03:39:44.965 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 0, Count: 6, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-30T03:39:44.965 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-30T03:42:27.950 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T03:42:27.950 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T03:42:27.950 [Cloud] Queued cloud request. 2026-09-30T03:42:27.950 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T03:42:27.950 [Cloud] Dequeued cloud request. 2026-09-30T03:42:27.950 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T03:42:28.137 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{01F51EF5-E1B0-AABB-DCE8-099438583148} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 03:42:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T03:42:28.653 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T03:49:33.017 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T04:04:38.021 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T04:08:40.369 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T04:08:40.369 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T04:08:40.369 [Cloud] Queued cloud request. 2026-09-30T04:08:40.369 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T04:08:40.369 [Cloud] Dequeued cloud request. 2026-09-30T04:08:40.369 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T04:08:48.682 [Cloud] End of cloud request. 2026-09-30T04:08:49.182 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T04:10:17.463 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T04:10:17.463 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T04:10:17.463 [Cloud] Queued cloud request. 2026-09-30T04:10:17.463 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T04:10:17.463 [Cloud] Dequeued cloud request. 2026-09-30T04:10:17.463 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T04:10:22.791 [Cloud] End of cloud request. 2026-09-30T04:10:23.291 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T04:14:25.496 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T04:14:25.496 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T04:14:25.496 [Cloud] Queued cloud request. 2026-09-30T04:14:25.496 [Cloud] Dequeued cloud request. 2026-09-30T04:14:25.496 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T04:14:25.496 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T04:14:25.668 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{909995DD-A1B8-09F0-F661-2A6A7317B037} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 04:14:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T04:14:26.184 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T04:14:29.527 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T04:14:29.527 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T04:14:29.527 [Cloud] Queued cloud request. 2026-09-30T04:14:29.527 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T04:14:29.527 [Cloud] Dequeued cloud request. 2026-09-30T04:14:29.527 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T04:14:29.621 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8217298B-2609-5ADC-7F31-1C6FA3A8CF3F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 04:14:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T04:14:30.121 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T04:19:43.030 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T04:26:28.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T04:26:28.657 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T04:26:28.657 [Cloud] Queued cloud request. 2026-09-30T04:26:28.657 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T04:26:28.657 [Cloud] Dequeued cloud request. 2026-09-30T04:26:28.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T04:26:28.845 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{02DE7614-5645-1D9E-8ABD-EED215F58C3A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 04:26:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T04:26:29.345 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T04:28:59.753 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T04:28:59.753 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T04:28:59.753 [Cloud] Queued cloud request. 2026-09-30T04:28:59.753 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T04:28:59.753 [Cloud] Dequeued cloud request. 2026-09-30T04:28:59.753 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T04:28:59.941 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{298C8DDB-8DB4-17C0-534C-BEB635395E0C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 04:28:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T04:29:00.441 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T04:34:48.035 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T04:41:48.414 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T04:41:48.414 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T04:41:48.414 [Cloud] Queued cloud request. 2026-09-30T04:41:48.414 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T04:41:48.414 [Cloud] Dequeued cloud request. 2026-09-30T04:41:48.414 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T04:41:48.601 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{30CC3536-0A71-86DD-C888-9FC7BFD53FBA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 04:41:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T04:41:49.117 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T04:49:53.043 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T04:51:26.528 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T04:51:26.528 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T04:51:26.528 [Cloud] Queued cloud request. 2026-09-30T04:51:26.528 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T04:51:26.528 [Cloud] Dequeued cloud request. 2026-09-30T04:51:26.528 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T04:51:26.715 [Cloud] End of cloud request. 2026-09-30T04:51:27.231 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T04:51:40.950 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T04:51:40.950 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T04:51:40.950 [Cloud] Queued cloud request. 2026-09-30T04:51:40.950 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T04:51:40.950 [Cloud] Dequeued cloud request. 2026-09-30T04:51:40.950 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T04:51:41.075 [Cloud] End of cloud request. 2026-09-30T04:51:41.590 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T04:54:42.184 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T04:54:42.184 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T04:54:42.184 [Cloud] Queued cloud request. 2026-09-30T04:54:42.184 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T04:54:42.184 [Cloud] Dequeued cloud request. 2026-09-30T04:54:42.184 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T04:54:42.371 [Cloud] End of cloud request. 2026-09-30T04:54:42.887 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T05:04:58.048 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T05:05:47.783 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T05:05:47.783 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T05:05:47.783 [Cloud] Queued cloud request. 2026-09-30T05:05:47.783 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T05:05:47.830 [Cloud] Dequeued cloud request. 2026-09-30T05:05:47.830 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T05:05:48.064 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3AE7A6BD-80C9-A544-0BBD-B8950454FDC8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 05:05:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T05:05:48.580 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T05:19:13.619 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T05:19:13.619 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T05:19:13.619 [Cloud] Queued cloud request. 2026-09-30T05:19:13.619 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T05:19:13.619 [Cloud] Dequeued cloud request. 2026-09-30T05:19:13.619 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T05:19:13.775 [Cloud] End of cloud request. 2026-09-30T05:19:14.291 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T05:20:03.056 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T05:26:06.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T05:26:06.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T05:26:06.387 [Cloud] Queued cloud request. 2026-09-30T05:26:06.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T05:26:06.387 [Cloud] Dequeued cloud request. 2026-09-30T05:26:06.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T05:26:06.559 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{24E797E1-1BFD-3366-54BD-C7917588B00C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 05:26:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T05:26:07.074 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T05:31:30.983 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T05:31:30.983 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T05:31:30.983 [Cloud] Queued cloud request. 2026-09-30T05:31:30.983 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T05:31:30.983 [Cloud] Dequeued cloud request. 2026-09-30T05:31:30.983 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T05:31:31.186 [Cloud] End of cloud request. 2026-09-30T05:31:31.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T05:35:08.061 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T05:37:53.268 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T05:37:53.268 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T05:37:53.268 [Cloud] Queued cloud request. 2026-09-30T05:37:53.268 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T05:37:53.268 [Cloud] Dequeued cloud request. 2026-09-30T05:37:53.268 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T05:37:53.533 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{41DEE431-3318-A657-8565-10FBD85F4BED} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 05:37:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T05:37:54.033 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T05:39:45.018 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 25365, Count: 1562, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-30T05:39:45.018 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 8110, Count: 671, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-30T05:39:45.018 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 3432, Count: 291, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T05:39:45.018 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-30T05:39:45.018 ProcessImageName: WmiPrvSE.exe, Pid: 6732, TotalTime: 692, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-30T05:39:45.018 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 666, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-09-30T05:39:45.018 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 345, Count: 29, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T05:39:45.018 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T05:39:45.018 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 136, Count: 62, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 0% 2026-09-30T05:39:45.018 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-30T05:39:45.018 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-30T05:39:45.018 ProcessImageName: taskhostw.exe, Pid: 6904, TotalTime: 46, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 15% 2026-09-30T05:39:45.018 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-30T05:39:45.018 ProcessImageName: DeviceCensus.exe, Pid: 7856, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-30T05:39:45.018 ProcessImageName: mysqldump.exe, Pid: 7220, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 15% 2026-09-30T05:39:45.018 ProcessImageName: powershell.exe, Pid: 964, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-30T05:39:45.018 ProcessImageName: powershell.exe, Pid: 7944, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp85B8.tmp, EstimatedImpact: 0% 2026-09-30T05:39:45.018 ProcessImageName: ngentask.exe, Pid: 1436, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-30T05:39:45.018 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-30T05:39:45.018 ProcessImageName: cmd.exe, Pid: 2248, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-30T05:39:45.018 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 0, Count: 6, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-09-30T05:39:45.018 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-30T05:41:28.597 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T05:41:28.597 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T05:41:28.597 [Cloud] Queued cloud request. 2026-09-30T05:41:28.597 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T05:41:28.597 [Cloud] Dequeued cloud request. 2026-09-30T05:41:28.597 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T05:41:28.800 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EAAC8FE0-7A2F-0DEA-FF75-86AEFB37725A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 05:41:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T05:41:29.300 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T05:50:13.069 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T05:58:01.776 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T05:58:01.776 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T05:58:01.776 [Cloud] Queued cloud request. 2026-09-30T05:58:01.776 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T05:58:01.776 [Cloud] Dequeued cloud request. 2026-09-30T05:58:01.776 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T05:58:01.995 [Cloud] End of cloud request. 2026-09-30T05:58:02.495 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T06:05:18.075 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T06:06:16.715 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T06:06:16.715 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T06:06:16.715 [Cloud] Queued cloud request. 2026-09-30T06:06:16.715 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T06:06:16.715 [Cloud] Dequeued cloud request. 2026-09-30T06:06:16.715 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T06:06:17.106 [Cloud] End of cloud request. 2026-09-30T06:06:17.606 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T06:08:08.453 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T06:08:08.453 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T06:08:08.453 [Cloud] Queued cloud request. 2026-09-30T06:08:08.453 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T06:08:08.453 [Cloud] Dequeued cloud request. 2026-09-30T06:08:08.453 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T06:08:08.609 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7B7D45C7-8485-CDA5-F3B1-272079CDD951} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 06:08:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T06:08:09.109 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T06:09:25.031 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T06:09:25.031 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T06:09:25.031 [Cloud] Queued cloud request. 2026-09-30T06:09:25.031 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T06:09:25.031 [Cloud] Dequeued cloud request. 2026-09-30T06:09:25.031 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T06:09:25.234 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4B198946-CF7D-DCF5-EFC4-35C4477566CD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 06:09:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T06:09:25.750 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T06:09:40.234 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T06:09:40.234 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T06:09:40.234 [Cloud] Queued cloud request. 2026-09-30T06:09:40.234 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T06:09:40.234 [Cloud] Dequeued cloud request. 2026-09-30T06:09:40.234 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T06:09:40.422 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AD5C6B0C-CE7B-F7EA-AAA9-8085D4553E6B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 06:09:40 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T06:09:40.937 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T06:11:33.437 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T06:11:33.437 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T06:11:33.437 [Cloud] Queued cloud request. 2026-09-30T06:11:33.437 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T06:11:33.437 [Cloud] Dequeued cloud request. 2026-09-30T06:11:33.437 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T06:11:33.687 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4903E6B9-E52C-92BB-5B03-DA8184F5C7B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 06:11:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T06:11:34.187 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T06:20:23.082 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T06:35:28.087 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T06:36:49.136 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T06:36:49.136 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T06:36:49.136 [Cloud] Queued cloud request. 2026-09-30T06:36:49.136 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T06:36:49.136 [Cloud] Dequeued cloud request. 2026-09-30T06:36:49.136 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T06:36:49.308 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BB3D6BA7-24F5-D08E-B00F-B99D3160E579} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 06:36:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T06:36:49.823 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T06:50:33.096 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T07:00:35.429 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T07:00:35.429 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T07:00:35.429 [Cloud] Queued cloud request. 2026-09-30T07:00:35.429 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T07:00:35.429 [Cloud] Dequeued cloud request. 2026-09-30T07:00:35.429 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T07:00:35.601 [Cloud] End of cloud request. 2026-09-30T07:00:36.116 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T07:05:38.101 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T07:10:08.057 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T07:10:08.057 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T07:10:08.057 [Cloud] Queued cloud request. 2026-09-30T07:10:08.057 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T07:10:08.057 [Cloud] Dequeued cloud request. 2026-09-30T07:10:08.057 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T07:10:08.229 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2B17D6B6-43EE-0CDD-DDD3-041BDACF4DB1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 07:10:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T07:10:08.745 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T07:14:08.245 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T07:14:08.245 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T07:14:08.245 [Cloud] Queued cloud request. 2026-09-30T07:14:08.245 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T07:14:08.245 [Cloud] Dequeued cloud request. 2026-09-30T07:14:08.245 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T07:14:08.495 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D5B412DA-3F7D-5EB8-66AE-C022AF03191C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 07:14:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T07:14:08.995 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T07:17:22.233 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T07:17:22.233 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T07:17:22.233 [Cloud] Queued cloud request. 2026-09-30T07:17:22.233 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T07:17:22.233 [Cloud] Dequeued cloud request. 2026-09-30T07:17:22.233 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T07:17:22.436 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1C79CD4C-52F5-FEFA-9546-49EF4AF72B02} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 07:17:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T07:17:22.952 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T07:18:50.672 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T07:18:50.672 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T07:18:50.672 [Cloud] Queued cloud request. 2026-09-30T07:18:50.672 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T07:18:50.672 [Cloud] Dequeued cloud request. 2026-09-30T07:18:50.672 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T07:18:50.937 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DEA83E4E-1FA3-45B9-C305-5461E2EBC839} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 07:18:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T07:18:51.437 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T07:20:43.109 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T07:29:11.832 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T07:29:11.832 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T07:29:11.832 [Cloud] Queued cloud request. 2026-09-30T07:29:11.832 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T07:29:11.832 [Cloud] Dequeued cloud request. 2026-09-30T07:29:11.832 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T07:29:11.989 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4B3C3FF9-2A9A-0385-348E-0E077CA8C749} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 07:29:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T07:29:12.504 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T07:35:48.114 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T07:39:45.071 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 31194, Count: 1956, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-30T07:39:45.071 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 10403, Count: 837, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-30T07:39:45.071 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 3432, Count: 291, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T07:39:45.071 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-30T07:39:45.071 ProcessImageName: WmiPrvSE.exe, Pid: 6732, TotalTime: 692, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-30T07:39:45.071 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 666, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-09-30T07:39:45.071 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 375, Count: 31, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T07:39:45.071 ProcessImageName: powershell.exe, Pid: 6820, TotalTime: 279, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 24% 2026-09-30T07:39:45.071 ProcessImageName: python.exe, Pid: 7144, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-30T07:39:45.071 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T07:39:45.071 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 136, Count: 62, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 0% 2026-09-30T07:39:45.071 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-30T07:39:45.071 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-30T07:39:45.071 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_49BCF7F68F5E4EDB9588A98C4F0569CB.MAI, EstimatedImpact: 55% 2026-09-30T07:39:45.071 ProcessImageName: taskhostw.exe, Pid: 6904, TotalTime: 46, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 15% 2026-09-30T07:39:45.071 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-30T07:39:45.071 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\ADDRESS-MAP.TAB, EstimatedImpact: 0% 2026-09-30T07:39:45.071 ProcessImageName: DeviceCensus.exe, Pid: 7856, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-30T07:39:45.071 ProcessImageName: mysqldump.exe, Pid: 7220, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 15% 2026-09-30T07:39:45.071 ProcessImageName: powershell.exe, Pid: 964, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-30T07:39:45.071 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-30T07:39:45.071 ProcessImageName: powershell.exe, Pid: 7944, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp85B8.tmp, EstimatedImpact: 0% 2026-09-30T07:39:45.071 ProcessImageName: ngentask.exe, Pid: 1436, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-30T07:39:45.071 ProcessImageName: cmd.exe, Pid: 2248, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-30T07:39:45.071 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-30T07:42:13.415 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T07:42:13.415 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T07:42:13.415 [Cloud] Queued cloud request. 2026-09-30T07:42:13.415 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T07:42:13.415 [Cloud] Dequeued cloud request. 2026-09-30T07:42:13.415 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T07:42:13.602 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{415AFA22-5742-EC34-2DDD-839D6E379D7E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 07:42:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T07:42:14.102 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T07:44:07.587 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T07:44:07.587 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T07:44:07.587 [Cloud] Queued cloud request. 2026-09-30T07:44:07.587 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T07:44:07.587 [Cloud] Dequeued cloud request. 2026-09-30T07:44:07.587 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T07:44:07.774 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{25AFA1F6-51A9-9E5A-84B5-866D83823D4C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 07:44:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T07:44:08.290 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T07:46:51.028 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T07:46:51.028 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T07:46:51.028 [Cloud] Queued cloud request. 2026-09-30T07:46:51.028 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T07:46:51.028 [Cloud] Dequeued cloud request. 2026-09-30T07:46:51.028 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T07:46:51.215 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C06C8C03-812C-01A9-7E83-4F639672E68C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 07:46:51 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T07:46:51.715 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T07:50:53.123 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T07:52:59.513 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T07:52:59.513 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T07:52:59.513 [Cloud] Queued cloud request. 2026-09-30T07:52:59.513 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T07:52:59.513 [Cloud] Dequeued cloud request. 2026-09-30T07:52:59.513 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T07:53:03.373 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3C39CB20-C281-8EFF-EC79-9AEE28209EE6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 07:53:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T07:53:03.888 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T08:05:58.129 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T08:06:33.271 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T08:06:33.271 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T08:06:33.271 [Cloud] Queued cloud request. 2026-09-30T08:06:33.271 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T08:06:33.271 [Cloud] Dequeued cloud request. 2026-09-30T08:06:33.271 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T08:06:33.443 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{42548654-E0F6-7FA7-BEF0-8EA82865F531} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 08:06:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T08:06:33.958 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T08:10:32.460 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T08:10:32.460 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T08:10:32.460 [Cloud] Queued cloud request. 2026-09-30T08:10:32.460 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T08:10:32.460 [Cloud] Dequeued cloud request. 2026-09-30T08:10:32.460 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T08:10:32.616 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{92C85951-5EF3-ABD9-A2B9-163AC5BDB640} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 08:10:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T08:10:33.132 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T08:19:49.840 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T08:19:49.840 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T08:19:49.840 [Cloud] Queued cloud request. 2026-09-30T08:19:49.840 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T08:19:49.840 [Cloud] Dequeued cloud request. 2026-09-30T08:19:49.840 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T08:19:50.152 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{03C697DC-5364-9B86-121F-3BC699C31B87} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 08:19:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T08:19:50.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T08:21:03.137 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T08:35:46.394 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T08:35:46.394 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T08:35:46.394 [Cloud] Queued cloud request. 2026-09-30T08:35:46.394 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T08:35:46.550 [Cloud] Dequeued cloud request. 2026-09-30T08:35:46.722 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T08:35:46.862 [Cloud] End of cloud request. 2026-09-30T08:35:47.378 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T08:36:01.690 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T08:36:01.690 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T08:36:01.690 [Cloud] Queued cloud request. 2026-09-30T08:36:01.690 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T08:36:01.690 [Cloud] Dequeued cloud request. 2026-09-30T08:36:01.690 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T08:36:08.144 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T08:36:11.706 [Cloud] End of cloud request. 2026-09-30T08:36:12.206 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T08:38:47.411 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T08:38:47.411 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T08:38:47.411 [Cloud] Queued cloud request. 2026-09-30T08:38:47.411 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T08:38:47.411 [Cloud] Dequeued cloud request. 2026-09-30T08:38:47.411 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T08:38:57.411 [Cloud] End of cloud request. 2026-09-30T08:38:57.927 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T08:51:13.151 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T08:53:51.666 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T08:53:51.666 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T08:53:51.666 [Cloud] Queued cloud request. 2026-09-30T08:53:51.666 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T08:53:51.666 [Cloud] Dequeued cloud request. 2026-09-30T08:53:51.666 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T08:53:51.854 [Cloud] End of cloud request. 2026-09-30T08:53:52.369 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T09:06:18.157 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T09:12:20.988 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T09:12:20.988 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T09:12:20.988 [Cloud] Queued cloud request. 2026-09-30T09:12:20.988 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T09:12:20.988 [Cloud] Dequeued cloud request. 2026-09-30T09:12:20.988 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T09:12:21.176 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{48EC5E2B-F188-2E70-DA4D-80E147E900DF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 09:12:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T09:12:21.676 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T09:21:23.166 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T09:36:28.174 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T09:39:45.144 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 33400, Count: 2142, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-30T09:39:45.144 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 12638, Count: 1008, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-30T09:39:45.144 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 3432, Count: 291, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T09:39:45.144 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-30T09:39:45.144 ProcessImageName: WmiPrvSE.exe, Pid: 6732, TotalTime: 692, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-30T09:39:45.144 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 666, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-09-30T09:39:45.144 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 405, Count: 33, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T09:39:45.144 ProcessImageName: powershell.exe, Pid: 6820, TotalTime: 279, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 24% 2026-09-30T09:39:45.144 ProcessImageName: python.exe, Pid: 7144, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-30T09:39:45.144 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T09:39:45.144 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 136, Count: 62, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 0% 2026-09-30T09:39:45.144 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-30T09:39:45.144 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-30T09:39:45.144 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_49BCF7F68F5E4EDB9588A98C4F0569CB.MAI, EstimatedImpact: 55% 2026-09-30T09:39:45.144 ProcessImageName: taskhostw.exe, Pid: 6904, TotalTime: 46, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 15% 2026-09-30T09:39:45.144 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-30T09:39:45.144 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\ADDRESS-MAP.TAB, EstimatedImpact: 0% 2026-09-30T09:39:45.144 ProcessImageName: DeviceCensus.exe, Pid: 7856, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-30T09:39:45.144 ProcessImageName: mysqldump.exe, Pid: 7220, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 15% 2026-09-30T09:39:45.144 ProcessImageName: powershell.exe, Pid: 964, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-30T09:39:45.144 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-30T09:39:45.144 ProcessImageName: powershell.exe, Pid: 7944, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp85B8.tmp, EstimatedImpact: 0% 2026-09-30T09:39:45.144 ProcessImageName: ngentask.exe, Pid: 1436, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-30T09:39:45.144 ProcessImageName: cmd.exe, Pid: 2248, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-30T09:39:45.144 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-30T09:51:33.181 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T10:06:38.187 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T10:09:53.738 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T10:09:53.738 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T10:09:53.738 [Cloud] Queued cloud request. 2026-09-30T10:09:53.738 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T10:09:53.738 [Cloud] Dequeued cloud request. 2026-09-30T10:09:53.738 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T10:09:54.004 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{38E87432-77E1-A3C9-D935-DD8F173FEF40} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 10:09:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T10:09:54.504 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T10:12:17.394 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T10:12:17.394 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T10:12:17.394 [Cloud] Queued cloud request. 2026-09-30T10:12:17.394 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T10:12:17.394 [Cloud] Dequeued cloud request. 2026-09-30T10:12:17.394 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T10:12:17.598 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{54850887-2B30-7922-FD74-40EBC4EA9815} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 10:12:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T10:12:18.113 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T10:21:43.196 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T10:35:48.077 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T10:35:48.077 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T10:35:48.077 [Cloud] Queued cloud request. 2026-09-30T10:35:48.077 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T10:35:48.077 [Cloud] Dequeued cloud request. 2026-09-30T10:35:48.077 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T10:35:48.327 [Cloud] End of cloud request. 2026-09-30T10:35:48.842 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T10:36:48.204 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T10:39:18.456 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T10:39:18.456 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T10:39:18.456 [Cloud] Queued cloud request. 2026-09-30T10:39:18.456 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T10:39:18.456 [Cloud] Dequeued cloud request. 2026-09-30T10:39:18.456 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T10:39:18.800 [Cloud] End of cloud request. 2026-09-30T10:39:19.300 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T10:51:53.212 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T10:54:21.072 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T10:54:21.072 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T10:54:21.072 [Cloud] Queued cloud request. 2026-09-30T10:54:21.072 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T10:54:21.072 [Cloud] Dequeued cloud request. 2026-09-30T10:54:21.072 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T10:54:21.275 [Cloud] End of cloud request. 2026-09-30T10:54:21.775 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T10:56:25.790 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T10:56:25.790 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T10:56:25.790 [Cloud] Queued cloud request. 2026-09-30T10:56:25.790 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T10:56:25.790 [Cloud] Dequeued cloud request. 2026-09-30T10:56:25.790 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T10:56:26.259 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{82EFC8DA-8FEE-7C12-CC44-7E211756CE9D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 10:56:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T10:56:26.775 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T11:01:40.342 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T11:01:40.342 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T11:01:40.342 [Cloud] Queued cloud request. 2026-09-30T11:01:40.342 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T11:01:40.342 [Cloud] Dequeued cloud request. 2026-09-30T11:01:40.342 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T11:01:41.123 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6A75CBED-0468-A29C-85BD-DCC79446D3D5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 11:01:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T11:01:41.639 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T11:03:22.373 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T11:03:22.373 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T11:03:22.373 [Cloud] Queued cloud request. 2026-09-30T11:03:22.373 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T11:03:22.373 [Cloud] Dequeued cloud request. 2026-09-30T11:03:22.373 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T11:03:24.810 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{08405DF9-8F63-3832-FFFF-139C4BFB24D4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 11:03:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T11:03:25.326 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T11:06:58.217 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T11:17:13.443 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T11:17:13.443 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T11:17:13.443 [Cloud] Queued cloud request. 2026-09-30T11:17:13.443 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T11:17:13.443 [Cloud] Dequeued cloud request. 2026-09-30T11:17:13.443 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T11:17:16.881 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{377EB2D6-D58A-33FE-6A68-F61E2437DEFA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 11:17:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T11:17:17.381 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T11:22:03.225 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T11:22:04.882 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T11:22:04.882 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T11:22:04.882 [Cloud] Queued cloud request. 2026-09-30T11:22:04.882 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T11:22:04.882 [Cloud] Dequeued cloud request. 2026-09-30T11:22:04.882 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T11:22:05.069 [Cloud] End of cloud request. 2026-09-30T11:22:05.569 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T11:23:35.788 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T11:23:35.788 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T11:23:35.788 [Cloud] Queued cloud request. 2026-09-30T11:23:35.788 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T11:23:35.788 [Cloud] Dequeued cloud request. 2026-09-30T11:23:35.788 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T11:23:36.007 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{97FA0A0A-E049-17DB-9AC2-ACD6C9D8BDA7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 11:23:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T11:23:36.507 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T11:25:05.867 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T11:25:05.867 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T11:25:05.867 [Cloud] Queued cloud request. 2026-09-30T11:25:05.867 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T11:25:05.867 [Cloud] Dequeued cloud request. 2026-09-30T11:25:05.867 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T11:25:06.054 [Cloud] End of cloud request. 2026-09-30T11:25:06.570 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T11:33:38.435 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T11:33:38.435 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T11:33:38.435 [Cloud] Queued cloud request. 2026-09-30T11:33:38.435 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T11:33:38.435 [Cloud] Dequeued cloud request. 2026-09-30T11:33:38.435 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T11:33:38.638 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F966866A-DE40-8AB2-1872-B13C6286C716} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 11:33:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T11:33:39.138 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T11:37:08.235 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T11:39:45.220 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 35499, Count: 2331, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-30T11:39:45.220 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 14902, Count: 1185, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-30T11:39:45.220 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 3432, Count: 291, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T11:39:45.220 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-30T11:39:45.220 ProcessImageName: WmiPrvSE.exe, Pid: 6732, TotalTime: 692, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-30T11:39:45.220 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 666, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-09-30T11:39:45.220 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 435, Count: 35, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T11:39:45.220 ProcessImageName: powershell.exe, Pid: 6820, TotalTime: 279, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 24% 2026-09-30T11:39:45.220 ProcessImageName: python.exe, Pid: 7144, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-30T11:39:45.220 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T11:39:45.220 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 136, Count: 62, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 0% 2026-09-30T11:39:45.220 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-30T11:39:45.220 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-30T11:39:45.220 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_49BCF7F68F5E4EDB9588A98C4F0569CB.MAI, EstimatedImpact: 55% 2026-09-30T11:39:45.220 ProcessImageName: taskhostw.exe, Pid: 6904, TotalTime: 46, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 15% 2026-09-30T11:39:45.220 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-30T11:39:45.220 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\ADDRESS-MAP.TAB, EstimatedImpact: 0% 2026-09-30T11:39:45.220 ProcessImageName: DeviceCensus.exe, Pid: 7856, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-30T11:39:45.220 ProcessImageName: mysqldump.exe, Pid: 7220, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 15% 2026-09-30T11:39:45.220 ProcessImageName: powershell.exe, Pid: 964, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-30T11:39:45.220 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-30T11:39:45.220 ProcessImageName: powershell.exe, Pid: 7944, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp85B8.tmp, EstimatedImpact: 0% 2026-09-30T11:39:45.220 ProcessImageName: ngentask.exe, Pid: 1436, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-30T11:39:45.220 ProcessImageName: cmd.exe, Pid: 2248, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-30T11:39:45.220 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-30T11:39:57.033 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T11:39:57.033 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T11:39:57.033 [Cloud] Queued cloud request. 2026-09-30T11:39:57.033 [Cloud] Dequeued cloud request. 2026-09-30T11:39:57.033 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T11:39:57.033 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T11:39:57.220 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A84367C1-F5D6-3543-E21A-15E7C935B228} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 11:39:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T11:39:57.720 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T11:52:13.241 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T11:54:49.475 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T11:54:49.475 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T11:54:49.475 [Cloud] Queued cloud request. 2026-09-30T11:54:49.475 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T11:54:49.475 [Cloud] Dequeued cloud request. 2026-09-30T11:54:49.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T11:54:49.632 [Cloud] End of cloud request. 2026-09-30T11:54:50.132 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T12:02:33.012 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T12:02:33.012 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T12:02:33.012 [Cloud] Queued cloud request. 2026-09-30T12:02:33.012 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T12:02:33.012 [Cloud] Dequeued cloud request. 2026-09-30T12:02:33.012 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T12:02:43.122 [Cloud] End of cloud request. 2026-09-30T12:02:43.637 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T12:07:18.248 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T12:14:00.391 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T12:14:00.391 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T12:14:00.391 [Cloud] Queued cloud request. 2026-09-30T12:14:00.391 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T12:14:00.391 [Cloud] Dequeued cloud request. 2026-09-30T12:14:00.391 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T12:14:03.360 [Cloud] End of cloud request. 2026-09-30T12:14:03.876 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T12:15:09.173 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T12:15:09.173 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T12:15:09.173 [Cloud] Queued cloud request. 2026-09-30T12:15:09.173 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T12:15:09.173 [Cloud] Dequeued cloud request. 2026-09-30T12:15:09.173 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T12:15:11.126 [Cloud] End of cloud request. 2026-09-30T12:15:11.626 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T12:15:53.627 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T12:15:53.627 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T12:15:53.627 [Cloud] Queued cloud request. 2026-09-30T12:15:53.627 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T12:15:53.627 [Cloud] Dequeued cloud request. 2026-09-30T12:15:53.627 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T12:15:53.830 [Cloud] End of cloud request. 2026-09-30T12:15:54.346 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T12:18:54.397 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T12:18:54.397 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T12:18:54.397 [Cloud] Queued cloud request. 2026-09-30T12:18:54.397 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T12:18:54.397 [Cloud] Dequeued cloud request. 2026-09-30T12:18:54.397 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T12:18:54.615 [Cloud] End of cloud request. 2026-09-30T12:18:55.115 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T12:22:23.256 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T12:26:15.352 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T12:26:15.352 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T12:26:15.352 [Cloud] Queued cloud request. 2026-09-30T12:26:15.352 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T12:26:15.352 [Cloud] Dequeued cloud request. 2026-09-30T12:26:15.352 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T12:26:15.555 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4CF15FE5-98A3-D99A-D532-AA02C0FFB96F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 12:26:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T12:26:16.071 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T12:33:56.090 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T12:33:56.090 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T12:33:56.090 [Cloud] Queued cloud request. 2026-09-30T12:33:56.090 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T12:33:56.090 [Cloud] Dequeued cloud request. 2026-09-30T12:33:56.090 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T12:33:56.278 [Cloud] End of cloud request. 2026-09-30T12:33:56.793 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T12:37:28.264 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T12:44:39.219 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T12:44:39.219 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T12:44:39.219 [Cloud] Queued cloud request. 2026-09-30T12:44:39.219 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T12:44:39.219 [Cloud] Dequeued cloud request. 2026-09-30T12:44:39.219 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T12:44:39.407 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F6B82898-7446-DD0E-DE9B-74DC8EEE04B6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 12:44:39 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T12:44:39.922 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T12:52:33.271 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T13:00:04.869 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T13:00:04.869 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T13:00:04.869 [Cloud] Queued cloud request. 2026-09-30T13:00:04.869 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T13:00:04.869 [Cloud] Dequeued cloud request. 2026-09-30T13:00:04.869 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T13:00:05.416 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EC9130F1-2BD7-2ADB-3C83-B2FD04D2B054} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 13:00:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T13:00:05.916 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T13:01:44.697 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T13:01:44.697 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T13:01:44.697 [Cloud] Queued cloud request. 2026-09-30T13:01:44.697 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T13:01:44.697 [Cloud] Dequeued cloud request. 2026-09-30T13:01:44.697 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T13:01:44.885 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{DAFC6974-F3E1-7159-24D4-0F8D04A0B4D9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 13:01:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T13:01:45.385 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T13:07:38.280 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T13:13:25.328 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T13:13:25.328 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T13:13:25.328 [Cloud] Queued cloud request. 2026-09-30T13:13:25.328 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T13:13:25.328 [Cloud] Dequeued cloud request. 2026-09-30T13:13:25.328 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T13:13:25.500 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EE5FCF5C-94EF-9A5A-EB2E-565F4B2E3ABE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 13:13:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T13:13:26.000 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T13:14:23.219 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T13:14:23.219 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T13:14:23.219 [Cloud] Queued cloud request. 2026-09-30T13:14:23.219 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T13:14:23.219 [Cloud] Dequeued cloud request. 2026-09-30T13:14:23.219 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T13:14:33.250 [Cloud] End of cloud request. 2026-09-30T13:14:33.750 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T13:16:50.738 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T13:16:50.738 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T13:16:50.738 [Cloud] Queued cloud request. 2026-09-30T13:16:50.738 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T13:16:50.738 [Cloud] Dequeued cloud request. 2026-09-30T13:16:50.738 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T13:16:50.894 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6664DFC0-AA42-CBB0-FAEE-FF0CCB851252} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 13:16:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T13:16:51.409 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T13:22:43.286 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T13:27:44.524 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T13:27:44.524 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T13:27:44.524 [Cloud] Queued cloud request. 2026-09-30T13:27:44.524 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T13:27:44.712 [Cloud] Dequeued cloud request. 2026-09-30T13:27:44.712 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T13:27:44.899 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{18C4DFCD-2EFF-2214-DC0D-B42D38CA06B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 13:27:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T13:27:45.415 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T13:33:58.260 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T13:33:58.260 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T13:33:58.260 [Cloud] Queued cloud request. 2026-09-30T13:33:58.260 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T13:33:58.260 [Cloud] Dequeued cloud request. 2026-09-30T13:33:58.260 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T13:33:58.448 [Cloud] End of cloud request. 2026-09-30T13:33:58.948 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T13:37:47.904 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T13:37:47.904 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T13:37:47.904 [Cloud] Queued cloud request. 2026-09-30T13:37:47.904 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T13:37:47.904 [Cloud] Dequeued cloud request. 2026-09-30T13:37:47.904 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T13:37:48.295 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T13:37:55.858 [Cloud] End of cloud request. 2026-09-30T13:37:56.373 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T13:39:45.280 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 37050, Count: 2476, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-30T13:39:45.280 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 17117, Count: 1353, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-30T13:39:45.280 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 3432, Count: 291, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T13:39:45.280 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-30T13:39:45.280 ProcessImageName: WmiPrvSE.exe, Pid: 6732, TotalTime: 692, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-30T13:39:45.280 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 666, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-09-30T13:39:45.280 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 511, Count: 39, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T13:39:45.280 ProcessImageName: powershell.exe, Pid: 6820, TotalTime: 279, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 24% 2026-09-30T13:39:45.280 ProcessImageName: python.exe, Pid: 7144, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-30T13:39:45.280 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T13:39:45.280 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 151, Count: 64, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 0% 2026-09-30T13:39:45.280 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-30T13:39:45.280 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-30T13:39:45.280 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_49BCF7F68F5E4EDB9588A98C4F0569CB.MAI, EstimatedImpact: 55% 2026-09-30T13:39:45.280 ProcessImageName: taskhostw.exe, Pid: 6904, TotalTime: 46, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 15% 2026-09-30T13:39:45.280 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-30T13:39:45.280 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\ADDRESS-MAP.TAB, EstimatedImpact: 0% 2026-09-30T13:39:45.280 ProcessImageName: DeviceCensus.exe, Pid: 7856, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-30T13:39:45.280 ProcessImageName: mysqldump.exe, Pid: 7220, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 15% 2026-09-30T13:39:45.280 ProcessImageName: powershell.exe, Pid: 964, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-30T13:39:45.280 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-30T13:39:45.280 ProcessImageName: powershell.exe, Pid: 7944, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp85B8.tmp, EstimatedImpact: 0% 2026-09-30T13:39:45.280 ProcessImageName: ngentask.exe, Pid: 1436, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-30T13:39:45.280 ProcessImageName: cmd.exe, Pid: 2248, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-30T13:39:45.280 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-30T13:47:41.331 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T13:47:41.331 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T13:47:41.331 [Cloud] Queued cloud request. 2026-09-30T13:47:41.331 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T13:47:41.331 [Cloud] Dequeued cloud request. 2026-09-30T13:47:41.331 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T13:47:41.519 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A2DED5C1-3135-616F-3E03-56E702DD5BB2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 13:47:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T13:47:42.034 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T13:51:01.676 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T13:51:01.676 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T13:51:01.676 [Cloud] Queued cloud request. 2026-09-30T13:51:01.676 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T13:51:01.676 [Cloud] Dequeued cloud request. 2026-09-30T13:51:01.676 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T13:51:02.129 [Cloud] End of cloud request. 2026-09-30T13:51:02.629 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T13:52:53.301 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T14:01:48.541 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T14:01:48.541 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T14:01:48.541 [Cloud] Queued cloud request. 2026-09-30T14:01:48.541 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T14:01:48.541 [Cloud] Dequeued cloud request. 2026-09-30T14:01:48.541 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T14:01:48.729 [Cloud] End of cloud request. 2026-09-30T14:01:49.244 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T14:03:50.197 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T14:03:50.197 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T14:03:50.197 [Cloud] Queued cloud request. 2026-09-30T14:03:50.197 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T14:03:50.197 [Cloud] Dequeued cloud request. 2026-09-30T14:03:50.197 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T14:03:50.916 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{84E053DF-BA89-FF31-B111-E4D7FB04C4E0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 14:03:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T14:03:51.416 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T14:05:59.823 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T14:05:59.823 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T14:05:59.823 [Cloud] Queued cloud request. 2026-09-30T14:05:59.823 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T14:05:59.823 [Cloud] Dequeued cloud request. 2026-09-30T14:05:59.823 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{42013901-0A75-75F0-03F1-B6A42876AD7D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 14:06:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T14:05:59.995 [Cloud] End of cloud request. 2026-09-30T14:06:00.526 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T14:07:58.311 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T14:10:45.390 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T14:10:45.390 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T14:10:45.390 [Cloud] Queued cloud request. 2026-09-30T14:10:45.390 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T14:10:45.390 [Cloud] Dequeued cloud request. 2026-09-30T14:10:45.390 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T14:10:45.530 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{08D21BA5-6D90-F251-EB44-69676B363819} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 14:10:45 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T14:10:46.046 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T14:23:03.316 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T14:25:09.192 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T14:25:09.192 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T14:25:09.192 [Cloud] Queued cloud request. 2026-09-30T14:25:09.192 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T14:25:09.192 [Cloud] Dequeued cloud request. 2026-09-30T14:25:09.192 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T14:25:09.535 [Cloud] End of cloud request. 2026-09-30T14:25:10.035 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T14:31:08.166 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T14:31:08.166 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T14:31:08.166 [Cloud] Queued cloud request. 2026-09-30T14:31:08.166 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T14:31:08.166 [Cloud] Dequeued cloud request. 2026-09-30T14:31:08.166 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T14:31:08.306 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E2883E26-A5FD-2203-C566-FDB9204CA8BF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 14:31:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T14:31:08.806 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T14:38:08.326 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T14:53:13.331 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T15:04:55.243 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T15:04:55.243 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T15:04:55.243 [Cloud] Queued cloud request. 2026-09-30T15:04:55.243 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T15:04:55.243 [Cloud] Dequeued cloud request. 2026-09-30T15:04:55.243 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T15:04:55.399 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{165CDFF9-C7FE-9FD7-3CD4-5BB20156375B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 15:04:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T15:04:55.899 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T15:08:18.341 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T15:23:05.300 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T15:23:05.300 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T15:23:05.300 [Cloud] Queued cloud request. 2026-09-30T15:23:05.300 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T15:23:05.300 [Cloud] Dequeued cloud request. 2026-09-30T15:23:05.300 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T15:23:05.566 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AD270EE1-0A2D-AB44-971A-9EF6A61014CD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 15:23:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T15:23:06.066 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T15:23:23.347 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T15:24:30.050 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T15:24:30.050 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T15:24:30.050 [Cloud] Queued cloud request. 2026-09-30T15:24:30.050 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T15:24:30.050 [Cloud] Dequeued cloud request. 2026-09-30T15:24:30.050 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T15:24:30.253 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{64126F0E-96F3-4D99-C891-EA890CA93095} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 15:24:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T15:24:30.753 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T15:25:24.222 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T15:25:24.222 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T15:25:24.222 [Cloud] Queued cloud request. 2026-09-30T15:25:24.222 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T15:25:24.222 [Cloud] Dequeued cloud request. 2026-09-30T15:25:24.222 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T15:25:24.316 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F300CBF2-C4BB-AC75-BE75-BD186FE71732} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 15:25:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T15:25:24.816 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T15:29:50.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T15:29:50.304 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T15:29:50.304 [Cloud] Queued cloud request. 2026-09-30T15:29:50.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T15:29:50.304 [Cloud] Dequeued cloud request. 2026-09-30T15:29:50.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T15:29:50.491 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{444614FA-2104-C103-6D76-B419B73F290E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 15:29:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T15:29:51.007 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T15:38:28.358 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T15:39:45.341 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 37187, Count: 2485, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-30T15:39:45.341 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 19413, Count: 1516, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-30T15:39:45.341 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 3432, Count: 291, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T15:39:45.341 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-30T15:39:45.341 ProcessImageName: WmiPrvSE.exe, Pid: 6732, TotalTime: 692, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-30T15:39:45.341 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 666, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-09-30T15:39:45.341 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 557, Count: 41, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T15:39:45.341 ProcessImageName: powershell.exe, Pid: 6820, TotalTime: 279, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 24% 2026-09-30T15:39:45.341 ProcessImageName: python.exe, Pid: 7144, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-30T15:39:45.341 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T15:39:45.341 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 151, Count: 64, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 0% 2026-09-30T15:39:45.341 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-30T15:39:45.341 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-30T15:39:45.341 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_49BCF7F68F5E4EDB9588A98C4F0569CB.MAI, EstimatedImpact: 55% 2026-09-30T15:39:45.341 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-30T15:39:45.341 ProcessImageName: taskhostw.exe, Pid: 6904, TotalTime: 46, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 15% 2026-09-30T15:39:45.341 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\ADDRESS-MAP.TAB, EstimatedImpact: 0% 2026-09-30T15:39:45.341 ProcessImageName: DeviceCensus.exe, Pid: 7856, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-30T15:39:45.341 ProcessImageName: mysqldump.exe, Pid: 7220, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 15% 2026-09-30T15:39:45.341 ProcessImageName: powershell.exe, Pid: 964, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-30T15:39:45.341 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-30T15:39:45.341 ProcessImageName: ngentask.exe, Pid: 1436, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-30T15:39:45.341 ProcessImageName: powershell.exe, Pid: 7944, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp85B8.tmp, EstimatedImpact: 0% 2026-09-30T15:39:45.341 ProcessImageName: cmd.exe, Pid: 2248, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-30T15:39:45.341 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-30T15:41:14.388 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T15:41:14.388 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T15:41:14.388 [Cloud] Queued cloud request. 2026-09-30T15:41:14.388 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T15:41:14.388 [Cloud] Dequeued cloud request. 2026-09-30T15:41:14.388 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T15:41:14.982 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A057BA96-5EB3-2C2D-11A5-9C754582ECAA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 15:41:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T15:41:15.482 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T15:53:33.362 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T15:54:13.987 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T15:54:13.987 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T15:54:13.987 [Cloud] Queued cloud request. 2026-09-30T15:54:13.987 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T15:54:13.987 [Cloud] Dequeued cloud request. 2026-09-30T15:54:13.987 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T15:54:14.144 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D4AD21BB-8507-654F-15B4-49D4235DC85F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 15:54:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T15:54:14.659 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T15:55:57.769 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T15:55:57.769 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T15:55:57.769 [Cloud] Queued cloud request. 2026-09-30T15:55:57.769 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T15:55:57.769 [Cloud] Dequeued cloud request. 2026-09-30T15:55:57.769 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T15:55:57.925 [Cloud] End of cloud request. 2026-09-30T15:55:58.425 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T15:56:26.019 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T15:56:26.019 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T15:56:26.019 [Cloud] Queued cloud request. 2026-09-30T15:56:26.019 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T15:56:26.019 [Cloud] Dequeued cloud request. 2026-09-30T15:56:26.019 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T15:56:26.097 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EC8F6F41-58A9-DA4F-340D-33825B735915} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 15:56:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T15:56:26.612 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T16:08:38.371 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T16:15:44.153 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T16:15:44.153 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T16:15:44.153 [Cloud] Queued cloud request. 2026-09-30T16:15:44.153 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T16:15:44.153 [Cloud] Dequeued cloud request. 2026-09-30T16:15:44.153 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T16:15:44.325 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0AC48EBF-9BA0-515E-7D02-C1F3BDA187D4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 16:15:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T16:15:44.840 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T16:23:43.376 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T16:36:28.618 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T16:36:28.618 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T16:36:28.618 [Cloud] Queued cloud request. 2026-09-30T16:36:28.618 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T16:36:28.806 [Cloud] Dequeued cloud request. 2026-09-30T16:36:28.806 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T16:36:29.025 [Cloud] End of cloud request. 2026-09-30T16:36:29.525 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T16:38:48.386 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T16:39:30.120 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T16:39:30.120 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T16:39:30.120 [Cloud] Queued cloud request. 2026-09-30T16:39:30.120 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T16:39:30.120 [Cloud] Dequeued cloud request. 2026-09-30T16:39:30.120 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T16:39:30.308 [Cloud] End of cloud request. 2026-09-30T16:39:30.808 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T16:41:20.355 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T16:41:20.355 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T16:41:20.355 [Cloud] Queued cloud request. 2026-09-30T16:41:20.355 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T16:41:20.355 [Cloud] Dequeued cloud request. 2026-09-30T16:41:20.355 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T16:41:20.542 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B84624DC-E820-A1EA-9D84-4B2B65E8CD0C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 16:41:20 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T16:41:21.058 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T16:53:53.391 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T17:00:15.787 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T17:00:15.787 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T17:00:15.787 [Cloud] Queued cloud request. 2026-09-30T17:00:15.787 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T17:00:15.787 [Cloud] Dequeued cloud request. 2026-09-30T17:00:15.787 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T17:00:15.959 [Cloud] End of cloud request. 2026-09-30T17:00:16.459 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T17:07:45.556 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T17:07:45.556 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T17:07:45.556 [Cloud] Queued cloud request. 2026-09-30T17:07:45.556 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T17:07:45.556 [Cloud] Dequeued cloud request. 2026-09-30T17:07:45.556 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T17:07:55.650 [Cloud] End of cloud request. 2026-09-30T17:07:56.150 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T17:08:02.103 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T17:08:02.103 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T17:08:02.103 [Cloud] Queued cloud request. 2026-09-30T17:08:02.103 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T17:08:02.103 [Cloud] Dequeued cloud request. 2026-09-30T17:08:02.103 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T17:08:02.197 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{28448A6C-3272-F6D2-8288-5FBE49612B4B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 17:08:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T17:08:02.713 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T17:08:58.401 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T17:10:52.963 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T17:10:52.963 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T17:10:52.963 [Cloud] Queued cloud request. 2026-09-30T17:10:52.963 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T17:10:53.213 [Cloud] Dequeued cloud request. 2026-09-30T17:10:53.370 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T17:10:53.557 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{05A0C512-D829-B5B6-E707-6702CE59DCC1} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 17:10:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T17:10:54.073 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T17:16:49.856 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T17:16:49.856 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T17:16:49.856 [Cloud] Queued cloud request. 2026-09-30T17:16:49.856 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T17:16:49.856 [Cloud] Dequeued cloud request. 2026-09-30T17:16:49.856 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T17:16:50.043 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{ED6B0E9C-7B56-1972-B4A3-8DD230B5FBBF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 17:16:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T17:16:50.543 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T17:24:03.406 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T17:30:14.520 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T17:30:14.520 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T17:30:14.520 [Cloud] Queued cloud request. 2026-09-30T17:30:14.520 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T17:30:14.520 [Cloud] Dequeued cloud request. 2026-09-30T17:30:14.520 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T17:30:14.692 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4759FDF6-FABD-A185-4619-811EA8F36195} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 17:30:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T17:30:15.192 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T17:32:35.801 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T17:32:35.801 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T17:32:35.801 [Cloud] Queued cloud request. 2026-09-30T17:32:35.801 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T17:32:35.801 [Cloud] Dequeued cloud request. 2026-09-30T17:32:35.801 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T17:32:35.942 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E193AF7C-2551-7E7E-BDFC-E7702645F277} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 17:32:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T17:32:36.442 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T17:38:06.915 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T17:38:06.915 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T17:38:06.915 [Cloud] Queued cloud request. 2026-09-30T17:38:06.915 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T17:38:06.915 [Cloud] Dequeued cloud request. 2026-09-30T17:38:06.915 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T17:38:07.056 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2AF72431-1C61-0FC5-8BDD-0CFB4FB4519D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 17:38:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T17:38:07.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T17:39:08.416 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T17:39:45.416 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 37202, Count: 2488, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-30T17:39:45.416 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 21552, Count: 1695, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-30T17:39:45.416 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 3432, Count: 291, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T17:39:45.416 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-30T17:39:45.416 ProcessImageName: WmiPrvSE.exe, Pid: 6732, TotalTime: 692, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-30T17:39:45.416 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 666, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-09-30T17:39:45.416 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 602, Count: 45, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T17:39:45.416 ProcessImageName: WmiPrvSE.exe, Pid: 6572, TotalTime: 301, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 27% 2026-09-30T17:39:45.416 ProcessImageName: powershell.exe, Pid: 6820, TotalTime: 279, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 24% 2026-09-30T17:39:45.416 ProcessImageName: python.exe, Pid: 7144, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-30T17:39:45.416 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T17:39:45.416 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 151, Count: 64, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 0% 2026-09-30T17:39:45.416 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-30T17:39:45.416 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-30T17:39:45.416 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_49BCF7F68F5E4EDB9588A98C4F0569CB.MAI, EstimatedImpact: 55% 2026-09-30T17:39:45.416 ProcessImageName: taskhostw.exe, Pid: 6904, TotalTime: 46, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 15% 2026-09-30T17:39:45.416 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-30T17:39:45.416 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\ADDRESS-MAP.TAB, EstimatedImpact: 0% 2026-09-30T17:39:45.416 ProcessImageName: DeviceCensus.exe, Pid: 7856, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-30T17:39:45.416 ProcessImageName: mysqldump.exe, Pid: 7220, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 15% 2026-09-30T17:39:45.416 ProcessImageName: powershell.exe, Pid: 964, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-30T17:39:45.416 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 30, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-30T17:39:45.416 ProcessImageName: powershell.exe, Pid: 7944, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp85B8.tmp, EstimatedImpact: 0% 2026-09-30T17:39:45.416 ProcessImageName: ngentask.exe, Pid: 1436, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-30T17:39:45.416 ProcessImageName: cmd.exe, Pid: 2248, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-30T17:39:45.416 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-09-30T17:42:50.041 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T17:42:50.041 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T17:42:50.041 [Cloud] Queued cloud request. 2026-09-30T17:42:50.041 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T17:42:50.041 [Cloud] Dequeued cloud request. 2026-09-30T17:42:50.041 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T17:42:50.338 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3DF484DE-17AA-CAD6-7E92-B408399FF952} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 17:42:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T17:42:50.853 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T17:45:41.432 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T17:45:41.432 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T17:45:41.432 [Cloud] Queued cloud request. 2026-09-30T17:45:41.432 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T17:45:41.432 [Cloud] Dequeued cloud request. 2026-09-30T17:45:41.432 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T17:45:51.510 [Cloud] End of cloud request. 2026-09-30T17:45:52.026 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T17:46:05.088 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T17:46:05.088 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T17:46:05.088 [Cloud] Queued cloud request. 2026-09-30T17:46:05.088 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T17:46:05.088 [Cloud] Dequeued cloud request. 2026-09-30T17:46:05.088 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T17:46:05.182 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FF0526D1-DED3-42A6-AD18-4063EE12B167} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 17:46:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T17:46:05.682 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T17:54:13.422 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T17:54:56.015 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T17:54:56.015 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T17:54:56.015 [Cloud] Queued cloud request. 2026-09-30T17:54:56.015 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T17:54:56.015 [Cloud] Dequeued cloud request. 2026-09-30T17:54:56.015 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T17:55:06.156 [Cloud] End of cloud request. 2026-09-30T17:55:06.671 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T18:04:46.536 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T18:04:46.536 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T18:04:46.536 [Cloud] Queued cloud request. 2026-09-30T18:04:46.536 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T18:04:46.536 [Cloud] Dequeued cloud request. 2026-09-30T18:04:46.551 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T18:04:46.739 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FBE69485-01B6-F5B8-A35A-C562B9FB054C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 18:04:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T18:04:47.239 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T18:04:51.176 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T18:04:51.176 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T18:04:51.176 [Cloud] Queued cloud request. 2026-09-30T18:04:51.176 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T18:04:51.176 [Cloud] Dequeued cloud request. 2026-09-30T18:04:51.176 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T18:04:51.332 [Cloud] End of cloud request. 2026-09-30T18:04:51.848 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T18:08:24.321 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T18:08:24.321 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T18:08:24.321 [Cloud] Queued cloud request. 2026-09-30T18:08:24.321 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T18:08:24.321 [Cloud] Dequeued cloud request. 2026-09-30T18:08:24.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T18:08:24.493 [Cloud] End of cloud request. 2026-09-30T18:08:24.993 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T18:09:18.431 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T18:11:12.712 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T18:11:12.712 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T18:11:12.712 [Cloud] Queued cloud request. 2026-09-30T18:11:12.712 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T18:11:12.712 [Cloud] Dequeued cloud request. 2026-09-30T18:11:12.712 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T18:11:12.868 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8FF07E3D-0B60-AA3A-BE84-9BD6BF59F456} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 18:11:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T18:11:13.368 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T18:13:53.556 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T18:13:53.556 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T18:13:53.556 [Cloud] Queued cloud request. 2026-09-30T18:13:53.556 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T18:13:53.556 [Cloud] Dequeued cloud request. 2026-09-30T18:13:53.556 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T18:13:53.696 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0CB7B576-7204-E8A6-4762-B9774D2498DE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 18:13:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T18:13:54.196 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T18:24:23.436 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T18:24:29.639 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T18:24:29.639 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T18:24:29.639 [Cloud] Queued cloud request. 2026-09-30T18:24:29.639 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T18:24:29.639 [Cloud] Dequeued cloud request. 2026-09-30T18:24:29.639 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T18:24:29.842 [Cloud] End of cloud request. 2026-09-30T18:24:30.342 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T18:25:09.343 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T18:25:09.343 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T18:25:09.343 [Cloud] Queued cloud request. 2026-09-30T18:25:09.343 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T18:25:09.343 [Cloud] Dequeued cloud request. 2026-09-30T18:25:09.343 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T18:25:19.374 [Cloud] End of cloud request. 2026-09-30T18:25:19.875 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T18:28:09.534 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T18:28:09.534 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T18:28:09.534 [Cloud] Queued cloud request. 2026-09-30T18:28:09.534 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T18:28:09.534 [Cloud] Dequeued cloud request. 2026-09-30T18:28:09.534 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T18:28:11.768 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9013F662-389D-13C9-F3D8-EAE80B72773A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 18:28:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T18:28:12.284 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T18:30:27.441 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T18:30:27.441 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T18:30:27.441 [Cloud] Queued cloud request. 2026-09-30T18:30:27.441 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T18:30:27.441 [Cloud] Dequeued cloud request. 2026-09-30T18:30:27.441 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T18:30:27.628 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7B856A3B-2EE7-9C2F-91FE-62F0C5F69448} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 18:30:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T18:30:28.144 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T18:39:28.446 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T18:49:47.654 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T18:49:47.654 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T18:49:47.654 [Cloud] Queued cloud request. 2026-09-30T18:49:47.654 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T18:49:47.654 [Cloud] Dequeued cloud request. 2026-09-30T18:49:47.654 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T18:49:47.841 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CC3C03D3-27D3-5B80-B34D-4512A0E61C53} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 18:49:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T18:49:48.357 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T18:50:27.451 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T18:50:27.451 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T18:50:27.451 [Cloud] Queued cloud request. 2026-09-30T18:50:27.451 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T18:50:27.451 [Cloud] Dequeued cloud request. 2026-09-30T18:50:27.451 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T18:50:27.529 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3869045B-EFAB-15DF-086E-F8D8241A3343} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 18:50:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T18:50:28.029 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T18:54:33.451 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T18:56:19.282 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T18:56:19.282 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T18:56:19.282 [Cloud] Queued cloud request. 2026-09-30T18:56:19.282 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T18:56:19.282 [Cloud] Dequeued cloud request. 2026-09-30T18:56:19.282 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T18:56:19.469 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{47ABA72F-C8EF-138B-8492-C8B36533BF15} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 18:56:19 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T18:56:19.985 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:09:38.461 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T19:10:28.821 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T19:10:28.821 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T19:10:28.821 [Cloud] Queued cloud request. 2026-09-30T19:10:28.821 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T19:10:28.821 [Cloud] Dequeued cloud request. 2026-09-30T19:10:28.821 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T19:10:34.493 [Cloud] End of cloud request. 2026-09-30T19:10:34.993 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:24:43.467 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T19:26:11.765 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T19:26:11.765 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T19:26:11.765 [Cloud] Queued cloud request. 2026-09-30T19:26:11.765 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T19:26:11.765 [Cloud] Dequeued cloud request. 2026-09-30T19:26:11.765 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T19:26:11.983 [Cloud] End of cloud request. 2026-09-30T19:26:12.499 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:26:16.921 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T19:26:16.921 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T19:26:16.921 [Cloud] Queued cloud request. 2026-09-30T19:26:16.921 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T19:26:16.921 [Cloud] Dequeued cloud request. 2026-09-30T19:26:16.921 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T19:26:17.046 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9AD31A1D-E4EB-0990-0AE0-CEC97DD99EB3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 19:26:17 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T19:26:17.562 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:30:14.845 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T19:30:14.845 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T19:30:14.845 [Cloud] Queued cloud request. 2026-09-30T19:30:14.845 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T19:30:14.845 [Cloud] Dequeued cloud request. 2026-09-30T19:30:14.845 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T19:30:15.033 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C2371D9A-50DC-45CD-2B01-491F04C2295A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 19:30:15 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T19:30:15.548 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:32:54.423 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T19:32:54.423 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T19:32:54.423 [Cloud] Queued cloud request. 2026-09-30T19:32:54.423 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T19:32:54.423 [Cloud] Dequeued cloud request. 2026-09-30T19:32:54.423 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T19:32:54.611 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9D3897E1-95DF-CDB3-E1C1-4246E658C3B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 19:32:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T19:32:55.111 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:34:38.549 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T19:34:38.549 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T19:34:38.549 [Cloud] Queued cloud request. 2026-09-30T19:34:38.549 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T19:34:38.549 [Cloud] Dequeued cloud request. 2026-09-30T19:34:38.549 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T19:34:38.736 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{57E33B07-F461-8B15-D7C6-8F0DECFC9C3E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 19:34:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T19:34:39.252 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:39:18.476 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-09-30T19:39:18.507 Job Notification: New process added to job (960) 2026-09-30T19:39:18.507 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-09-30T19:39:18.507 Aggressive catchup quick scan threshold: 660106308344 / 25920000000000 2026-09-30T19:39:18.507 Job Notification: New process added to job (1472) 2026-09-30T19:39:18.523 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:960] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:1472]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-30T19:39:18.648 Job Notification: New process added to job (2148) 2026-09-30T19:39:18.648 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-09-30T19:39:18.663 Job Notification: New process added to job (2176) 2026-09-30T19:39:18.726 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:2148] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:2176]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-09-30T19:39:18.835 Job Notification: New process added to job (8064) 2026-09-30T19:39:18.835 Task(GetDeviceTicket -AccessKey EBD64B77-009C-FA59-4383-11EE8C6B2707 ) launched as network service 2026-09-30T19:39:19.024 [RTP] [RtpConfig] Config change detected, type: 32 2026-09-30T19:39:19.024 [RTP] Duplicating the current plugin configuration object... 2026-09-30T19:39:19.024 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-09-30T19:39:19.024 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-09-30T19:39:19.024 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-30T19:39:19.024 [RTP] No config change detected. Not updating plugin configuration. 2026-09-30T19:39:19.024 [RTP] No config changes found. No configuration switch. 2026-09-30T19:39:19.024 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-09-30T19:39:19.444 Job Notification: Process exited from job (8064) 2026-09-30T19:39:19.601 [Cloud] SubmitReport(CMpHeartbeatSpyNetReportContext), ShouldSendEvenOnPaidNetworks: 0 2026-09-30T19:39:19.601 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T19:39:19.601 [Cloud] Queued cloud request. 2026-09-30T19:39:19.601 [Cloud] Dequeued cloud request. 2026-09-30T19:39:19.601 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T19:39:19.788 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-09-30T19:39:19.788 [Cloud] End of cloud request. 2026-09-30T19:39:20.101 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:39:31.663 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\2014C305-139E-4485-899B-520D2A10A0F71b30.1dd511367d4a3c3 2026-09-30T19:39:31.757 Verifying engine and signature files (source: 0) ... 2026-09-30T19:39:31.757 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1}\mpengine.dll] due to PPL. 2026-09-30T19:39:31.757 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1}\mpasbase.vdm]. File not in cache (0x1) 2026-09-30T19:39:32.819 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1}\mpasbase.vdm] 2026-09-30T19:39:32.819 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1}\mpasdlta.vdm]. File not in cache (0x1) 2026-09-30T19:39:32.882 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1}\mpasdlta.vdm] 2026-09-30T19:39:32.882 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1}\mpavbase.vdm]. File not in cache (0x1) 2026-09-30T19:39:33.351 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1}\mpavbase.vdm] 2026-09-30T19:39:33.351 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1}\mpavdlta.vdm]. File not in cache (0x1) 2026-09-30T19:39:33.382 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1}\mpavdlta.vdm] 2026-09-30T19:39:33.554 [Engine] IsHybridMode: 0 2026-09-30T19:39:33.569 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-09-30T19:39:33.569 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-152BD2D7DF91EEF652A0B2ED5EB2783C8CDC70AE.bin): 0x00000002 2026-09-30T19:39:33.585 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-152BD2D7DF91EEF652A0B2ED5EB2783C8CDC70AE.bin) 2026-09-30T19:39:33.585 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-09-30T19:39:33.585 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-09-30T19:39:33.585 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-09-30T19:39:33.585 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff 2026-09-30T19:39:45.491 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 37217, Count: 2491, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 23832, Count: 1869, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 3432, Count: 291, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-30T19:39:45.491 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 692, Count: 54, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: WmiPrvSE.exe, Pid: 6732, TotalTime: 692, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-30T19:39:45.491 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 666, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-09-30T19:39:45.491 ProcessImageName: WmiPrvSE.exe, Pid: 6572, TotalTime: 301, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 27% 2026-09-30T19:39:45.491 ProcessImageName: powershell.exe, Pid: 6820, TotalTime: 279, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 24% 2026-09-30T19:39:45.491 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 196, Count: 70, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: python.exe, Pid: 7144, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-30T19:39:45.491 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T19:39:45.491 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-30T19:39:45.491 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-30T19:39:45.491 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 60, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_49BCF7F68F5E4EDB9588A98C4F0569CB.MAI, EstimatedImpact: 55% 2026-09-30T19:39:45.491 ProcessImageName: taskhostw.exe, Pid: 6904, TotalTime: 46, Count: 2, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\hidparse.sys, EstimatedImpact: 15% 2026-09-30T19:39:45.491 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 45, Count: 9, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\ADDRESS-MAP.TAB, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 45, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: DeviceCensus.exe, Pid: 7856, TotalTime: 45, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val, EstimatedImpact: 5% 2026-09-30T19:39:45.491 ProcessImageName: mysqldump.exe, Pid: 7220, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 15% 2026-09-30T19:39:45.491 ProcessImageName: powershell.exe, Pid: 964, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\0, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: svchost.exe, Pid: 2544, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: powershell.exe, Pid: 7944, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp85B8.tmp, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: ngentask.exe, Pid: 1436, TotalTime: 15, Count: 5, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 7% 2026-09-30T19:39:45.491 ProcessImageName: cmd.exe, Pid: 2248, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpuploadlog.txt, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.aggregators.json, EstimatedImpact: 0% 2026-09-30T19:39:45.491 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-09-30T19:39:45.820 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-09-30T19:39:45.820 [AutoExclusion] Applied roles from cache. 2026-09-30T19:39:45.820 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-09-30T19:39:45.913 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF68AB020, lRefCount: 6, hr=0 2026-09-30T19:39:45.913 [Engine] New active engine 00007FFCF4ABB020 replacing engine 00007FFCF68AB020. Number of active engines: 2 2026-09-30T19:39:45.929 EngineInit:Global ASOC is enabled 2026-09-30T19:39:45.929 EngineInit:ASOO is enabled for developer volumes 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.038 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.054 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.054 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-09-30T19:39:46.085 MpWriteUupSignatureVersion 1.459.489.0, hr = 0 2026-09-30T19:39:46.085 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-09-30T19:39:46.116 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-09-30T19:39:46.116 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-09-30T19:39:46.116 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-09-30T19:39:46.116 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-09-30T19:39:46.148 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-09-30T19:39:46.148 [Plugin] Initializing RTP plugin state... 2026-09-30T19:39:46.148 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-09-30T19:39:46.148 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎29‎-‎2026 21:39:45 Last Perf:‎09‎-‎29‎-‎2026 21:39:44 First RTP Scan:‎09‎-‎29‎-‎2026 21:39:45 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:1470 Misses:8030 BM Queue:0,45,0 Proc:0,32,0 File:0,45,0 NamedPipe:0,0,0 Plugin Queue:0,2,0 Threat:0,0,0 Susp:0,2,0 Unknown:0,0,0 Error:0,0,0 Request Queue:2,3,0 SetEngine:1,1,0 SetState:1,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:5827702 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:1289640320 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:3681 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:280853 TotalHits:3190920 InstanceCacheInserts:34069 InstanceCacheUpdates:0 InstanceCacheDeletes:19788 InstanceCacheHits:1313 InstanceCacheMisses:152635 InstanceCacheOverflows:12907 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:5ms (7528/1463) Success: 1463, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-09-30T19:39:46.148 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1} 2026-09-30T19:39:46.148 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4C8C3B7D-A7BB-437F-8DBC-B29F4C74E5CC} removed 2026-09-30T19:39:46.148 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378}\mpasbase.vdm in use, hr=0x80070020 2026-09-30T19:39:46.148 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-09-30T19:39:46.148 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-30T19:39:46.148 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-30T19:39:46.148 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-30T19:39:46.148 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-30T19:39:46.148 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:09-30-2026 19:39:46 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:09-30-2026 19:39:46 2026-09-30T19:39:46.163 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-30T19:39:46.163 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-09-30T19:39:46.179 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-09-30T19:39:46.179 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-09-30T19:39:46.179 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:39:46.195 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-09-30T19:39:46.195 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-09-30T19:39:46.195 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-09-30T19:39:46.195 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-09-30T19:39:46.195 MdCoreSvc is supported in this platform and OS Signature updated on 09-30-2026 19:39:46 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.489.0 AV Signature Version: 1.459.489.0 ************************************************************ 2026-09-30T19:39:46.241 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-09-30T19:39:46.241 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\2014C305-139E-4485-899B-520D2A10A0F71b30.1dd511367d4a3c3 2026-09-30T19:39:46.257 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-09-30T19:39:46.257 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 2026-09-30T19:39:46.351 Process scan (postsignatureupdatescan) started. Signature updated via MicrosoftUpdateServer on 09-30-2026 19:39:46 ************************************************************ 2026-09-30T19:39:46.538 Job Notification: Process exited from job (2148) 2026-09-30T19:39:46.554 Job Notification: Process exited from job (2176) 2026-09-30T19:39:46.554 Job Notification: Process exited from job (960) 2026-09-30T19:39:46.570 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-09-30T19:39:46.570 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-09-30T19:39:46.570 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-09-30T19:39:46.570 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-09-30T19:39:46.570 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-09-30T19:39:46.570 Job Notification: Process exited from job (1472) 2026-09-30T19:39:46.585 [Engine] Engine 00007FFCF68AB020 no longer in use. Number of active engines: 1 2026-09-30T19:39:46.585 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-09-30T19:39:46.585 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-09-30T19:39:46.601 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-09-30T19:39:46.601 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-09-30T19:39:46.601 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-09-30T19:39:47.179 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 37217, Count: 2491, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\spaghetti-skeletti\js\jquery.js, EstimatedImpact: 0% 2026-09-30T19:39:47.179 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 23832, Count: 1869, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-09-30T19:39:47.179 ProcessImageName: AgentShell.exe, Pid: 4800, TotalTime: 3432, Count: 291, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T19:39:47.179 ProcessImageName: powershell.exe, Pid: 7632, TotalTime: 1678, Count: 107, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 33% 2026-09-30T19:39:47.179 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 692, Count: 54, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T19:39:47.179 ProcessImageName: WmiPrvSE.exe, Pid: 6732, TotalTime: 692, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 5% 2026-09-30T19:39:47.179 ProcessImageName: AgentShellService.exe, Pid: 5856, TotalTime: 666, Count: 24, MaxTime: 187, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-09-30T19:39:47.179 ProcessImageName: WmiPrvSE.exe, Pid: 6572, TotalTime: 301, Count: 38, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-constraints.js, EstimatedImpact: 27% 2026-09-30T19:39:47.179 ProcessImageName: powershell.exe, Pid: 6820, TotalTime: 279, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\244745c6d39933769228c0febbbf809d\Microsoft.PowerShell.ConsoleHost.ni.dll, EstimatedImpact: 24% 2026-09-30T19:39:47.179 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 196, Count: 70, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2a185-0.MAI, EstimatedImpact: 0% 2026-09-30T19:39:47.179 ProcessImageName: python.exe, Pid: 7144, TotalTime: 195, Count: 14, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 6% 2026-09-30T19:39:47.179 ProcessImageName: WmiPrvSE.exe, Pid: 7756, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T19:39:47.179 ProcessImageName: taskhostw.exe, Pid: 6824, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 10% 2026-09-30T19:39:47.179 ProcessImageName: taskhostw.exe, Pid: 7676, TotalTime: 76, Count: 8, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 1% 2026-09-30T19:39:47.257 [Engine] RSIG_UNLOADENGINE, 00007FFCF68AB020, err=0x0 2026-09-30T19:39:47.273 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DC36665-83AE-4843-888E-A88E5D8D0378} removed 2026-09-30T19:39:48.476 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) Internal signature match:subtype=Lowfi, sigseq=0x0000157E67AA49DF, sigsha=cd8f16a9d4beb15e15e36fc9a546c2d5bfbafd06, cached=false, source=0, resourceid=0x0d0ba041 2026-09-30T19:40:00.757 Process scan (postsignatureupdatescan) completed. 2026-09-30T19:44:45.976 [RbM] Setting Last known good engine candidate. hr = 0 2026-09-30T19:48:09.090 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T19:48:09.090 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T19:48:09.090 [Cloud] Queued cloud request. 2026-09-30T19:48:09.090 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T19:48:09.090 [Cloud] Dequeued cloud request. 2026-09-30T19:48:09.090 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{FAFA1733-7234-2A56-E832-C54657C0546B} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 19:48:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T19:48:19.230 [Cloud] End of cloud request. 2026-09-30T19:48:19.730 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:51:59.387 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T19:51:59.387 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T19:51:59.387 [Cloud] Queued cloud request. 2026-09-30T19:51:59.387 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T19:51:59.387 [Cloud] Dequeued cloud request. 2026-09-30T19:51:59.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T19:51:59.981 [Cloud] End of cloud request. 2026-09-30T19:52:00.481 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:53:51.575 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T19:53:51.575 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T19:53:51.575 [Cloud] Queued cloud request. 2026-09-30T19:53:51.575 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T19:53:51.575 [Cloud] Dequeued cloud request. 2026-09-30T19:53:51.575 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T19:54:01.700 [Cloud] End of cloud request. 2026-09-30T19:54:02.200 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:54:53.481 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T19:55:05.825 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T19:55:05.825 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T19:55:05.825 [Cloud] Queued cloud request. 2026-09-30T19:55:05.825 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T19:55:05.825 [Cloud] Dequeued cloud request. 2026-09-30T19:55:05.825 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T19:55:06.263 [Cloud] End of cloud request. 2026-09-30T19:55:06.763 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T19:59:04.783 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T19:59:04.783 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T19:59:04.783 [Cloud] Queued cloud request. 2026-09-30T19:59:04.783 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T19:59:04.783 [Cloud] Dequeued cloud request. 2026-09-30T19:59:04.783 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T19:59:05.111 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BABD7AC4-77C4-1ADB-5FFA-672A6FA08FD5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 19:59:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T19:59:05.626 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T20:09:58.491 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T20:10:14.772 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T20:10:14.772 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T20:10:14.772 [Cloud] Queued cloud request. 2026-09-30T20:10:14.772 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T20:10:14.772 [Cloud] Dequeued cloud request. 2026-09-30T20:10:14.772 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T20:10:14.959 [Cloud] End of cloud request. 2026-09-30T20:10:15.459 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T20:23:03.308 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T20:23:03.308 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T20:23:03.308 [Cloud] Queued cloud request. 2026-09-30T20:23:03.308 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T20:23:03.308 [Cloud] Dequeued cloud request. 2026-09-30T20:23:03.308 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T20:23:13.417 [Cloud] End of cloud request. 2026-09-30T20:23:13.933 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T20:25:03.495 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T20:27:28.328 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T20:27:28.328 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T20:27:28.328 [Cloud] Queued cloud request. 2026-09-30T20:27:28.328 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T20:27:28.328 [Cloud] Dequeued cloud request. 2026-09-30T20:27:28.328 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T20:27:29.312 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{94D7621D-F48F-03C1-5556-A64199FBEA7A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 20:27:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T20:27:29.812 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T20:40:08.505 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T20:43:08.786 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T20:43:08.786 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T20:43:08.786 [Cloud] Queued cloud request. 2026-09-30T20:43:08.786 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T20:43:08.786 [Cloud] Dequeued cloud request. 2026-09-30T20:43:08.786 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T20:43:08.943 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{164E9120-D1AC-6516-1A75-506BF3D00B70} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 20:43:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T20:43:09.458 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T20:55:13.513 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T21:10:18.518 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T21:25:23.526 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T21:28:00.014 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T21:28:00.014 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T21:28:00.014 [Cloud] Queued cloud request. 2026-09-30T21:28:00.014 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T21:28:00.014 [Cloud] Dequeued cloud request. 2026-09-30T21:28:00.029 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T21:28:06.920 [Cloud] End of cloud request. 2026-09-30T21:28:07.420 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T21:39:45.972 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 5153, Count: 385, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\inc\functions.inc.php, EstimatedImpact: 0% 2026-09-30T21:39:45.972 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 2153, Count: 172, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T21:39:45.972 ProcessImageName: powershell.exe, Pid: 3420, TotalTime: 1509, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-30T21:39:45.972 ProcessImageName: WmiPrvSE.exe, Pid: 3052, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T21:39:45.972 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 90, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T21:39:45.972 ProcessImageName: taskhostw.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-30T21:39:45.972 ProcessImageName: ngentask.exe, Pid: 2976, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-30T21:39:45.972 ProcessImageName: taskhostw.exe, Pid: 6572, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-30T21:39:45.972 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-30T21:40:28.535 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T21:41:56.894 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T21:41:56.894 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T21:41:56.894 [Cloud] Queued cloud request. 2026-09-30T21:41:56.894 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T21:41:56.894 [Cloud] Dequeued cloud request. 2026-09-30T21:41:56.894 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T21:41:57.050 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{906073D8-CD3E-6915-0FD3-1E57D21126F6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 21:41:57 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T21:41:57.566 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T21:55:33.540 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T22:10:38.549 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T22:20:27.492 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T22:20:27.492 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T22:20:27.492 [Cloud] Queued cloud request. 2026-09-30T22:20:27.492 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T22:20:27.492 [Cloud] Dequeued cloud request. 2026-09-30T22:20:27.492 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T22:20:27.679 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4D8E1C61-B619-F7FB-8AF1-F0A2BC0A0848} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 22:20:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T22:20:28.195 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T22:20:43.695 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T22:20:43.695 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T22:20:43.695 [Cloud] Queued cloud request. 2026-09-30T22:20:43.695 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T22:20:43.695 [Cloud] Dequeued cloud request. 2026-09-30T22:20:43.695 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T22:20:43.773 [Cloud] End of cloud request. 2026-09-30T22:20:44.289 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T22:25:43.556 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T22:26:49.853 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T22:26:49.853 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T22:26:49.853 [Cloud] Queued cloud request. 2026-09-30T22:26:49.853 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T22:26:49.853 [Cloud] Dequeued cloud request. 2026-09-30T22:26:49.853 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T22:26:50.041 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1029C854-8382-6DA1-8868-8CA520AD049B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 22:26:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T22:26:50.556 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T22:29:16.012 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T22:29:16.012 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T22:29:16.012 [Cloud] Queued cloud request. 2026-09-30T22:29:16.012 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T22:29:16.012 [Cloud] Dequeued cloud request. 2026-09-30T22:29:16.012 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T22:29:16.262 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5ABF3CD1-BC66-2791-551C-2A84AAC3E3BE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:09-30-2026 22:29:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T22:29:16.762 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T22:40:48.564 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T22:55:53.569 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T23:10:58.577 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T23:26:03.584 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{DD23C9E7-8469-45F9-843C-E0EFC8564223} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2892 ProcessCreationTime:134326768175536622 SessionID:0 CreationTime:09-30-2026 23:29:06 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-09-30T23:29:07.603 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-09-30T23:29:07.603 [Cloud] Start of cloud request. Passive mode: 0 2026-09-30T23:29:07.603 [Cloud] Queued cloud request. 2026-09-30T23:29:07.603 [Cloud] MpEngineCloudRequest(). hr = 0 2026-09-30T23:29:07.603 [Cloud] Dequeued cloud request. 2026-09-30T23:29:07.603 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-09-30T23:29:07.962 [Cloud] End of cloud request. 2026-09-30T23:29:08.478 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-09-30T23:39:46.045 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 6052, Count: 444, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\webboard\inc\functions.inc.php, EstimatedImpact: 0% 2026-09-30T23:39:46.045 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 4644, Count: 376, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-09-30T23:39:46.045 ProcessImageName: powershell.exe, Pid: 3420, TotalTime: 1509, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-09-30T23:39:46.045 ProcessImageName: WmiPrvSE.exe, Pid: 6896, TotalTime: 661, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-09-30T23:39:46.045 ProcessImageName: WmiPrvSE.exe, Pid: 3052, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-09-30T23:39:46.045 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 150, Count: 12, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache, EstimatedImpact: 0% 2026-09-30T23:39:46.045 ProcessImageName: taskhostw.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-09-30T23:39:46.045 ProcessImageName: ngentask.exe, Pid: 2976, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-09-30T23:39:46.045 ProcessImageName: taskhostw.exe, Pid: 6572, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-09-30T23:39:46.045 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-09-30T23:39:46.045 ProcessImageName: powershell.exe, Pid: 6056, TotalTime: 15, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDF09.tmp, EstimatedImpact: 0% 2026-09-30T23:41:08.592 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-09-30T23:56:13.598 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T00:00:01.101 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-7.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915284, FileId: 0xd00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.117 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-7.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915285, FileId: 0x1700000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.133 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915290, FileId: 0x1900000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.133 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915291, FileId: 0xf00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.133 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915297, FileId: 0x1b00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.133 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915298, FileId: 0x1100000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.148 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-10.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915303, FileId: 0x1d00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.148 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-10.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915304, FileId: 0x1300000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.164 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-13.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915309, FileId: 0x1500000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.164 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-13.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915310, FileId: 0x1f00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.180 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-16.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915316, FileId: 0x1700000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.180 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-16.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915315, FileId: 0x2100000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.195 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-19.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915322, FileId: 0x1900000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.195 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-19.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915321, FileId: 0x2300000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.211 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-1c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915327, FileId: 0x2500000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.211 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-1c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915328, FileId: 0x1b00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.226 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-1f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915334, FileId: 0x1d00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.226 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-1f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915333, FileId: 0x2700000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.242 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-22.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915340, FileId: 0x1f00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.242 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-22.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915339, FileId: 0x2900000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.258 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-25.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915345, FileId: 0x2b00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.258 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-25.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915346, FileId: 0x2100000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.273 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-28.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915351, FileId: 0x2d00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.273 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-28.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915352, FileId: 0x2300000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.289 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-2b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915358, FileId: 0x2500000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.289 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-2b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915357, FileId: 0x2f00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.305 [RTP] [Mini-filter] Unsuccessful scan status(#27): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-2e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915363, FileId: 0x3100000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.305 [RTP] [Mini-filter] Unsuccessful scan status(#28): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-2e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915364, FileId: 0x2700000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.336 [RTP] [Mini-filter] Unsuccessful scan status(#29): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-32.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915369, FileId: 0x3300000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.336 [RTP] [Mini-filter] Unsuccessful scan status(#30): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-32.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915370, FileId: 0x2900000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.336 [RTP] [Mini-filter] Unsuccessful scan status(#31): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-35.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915375, FileId: 0x3500000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.351 [RTP] [Mini-filter] Unsuccessful scan status(#32): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-35.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915376, FileId: 0x2b00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.351 [RTP] [Mini-filter] Unsuccessful scan status(#33): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-38.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915381, FileId: 0x2d00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.351 [RTP] [Mini-filter] Unsuccessful scan status(#34): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-38.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915382, FileId: 0x3700000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.367 [RTP] [Mini-filter] Unsuccessful scan status(#35): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-3b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915387, FileId: 0x3900000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.367 [RTP] [Mini-filter] Unsuccessful scan status(#36): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-3b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915388, FileId: 0x2f00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.383 [RTP] [Mini-filter] Unsuccessful scan status(#37): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-3e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915393, FileId: 0x3100000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.383 [RTP] [Mini-filter] Unsuccessful scan status(#38): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-3e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915394, FileId: 0x3b00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.398 [RTP] [Mini-filter] Unsuccessful scan status(#39): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-41.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915399, FileId: 0x3d00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.398 [RTP] [Mini-filter] Unsuccessful scan status(#40): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-41.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915400, FileId: 0x3300000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.414 [RTP] [Mini-filter] Unsuccessful scan status(#41): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-44.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915405, FileId: 0x3f00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.414 [RTP] [Mini-filter] Unsuccessful scan status(#42): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-44.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915406, FileId: 0x3500000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.461 [RTP] [Mini-filter] Unsuccessful scan status(#43): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-4a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915417, FileId: 0x3000000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.461 [RTP] [Mini-filter] Unsuccessful scan status(#44): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-4a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915418, FileId: 0x3100000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.476 [RTP] [Mini-filter] Unsuccessful scan status(#45): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-4d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915424, FileId: 0x3300000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.476 [RTP] [Mini-filter] Unsuccessful scan status(#46): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-4d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915423, FileId: 0x3200000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.492 [RTP] [Mini-filter] Unsuccessful scan status(#47): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-50.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915429, FileId: 0x3400000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.492 [RTP] [Mini-filter] Unsuccessful scan status(#48): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-50.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915430, FileId: 0x3500000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.508 [RTP] [Mini-filter] Unsuccessful scan status(#49): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-53.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915436, FileId: 0x3700000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.508 [RTP] [Mini-filter] Unsuccessful scan status(#50): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-53.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915435, FileId: 0x3600000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.526 [RTP] [Mini-filter] Unsuccessful scan status(#51): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-56.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915441, FileId: 0x3800000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.526 [RTP] [Mini-filter] Unsuccessful scan status(#52): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-56.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915442, FileId: 0x3900000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.539 [RTP] [Mini-filter] Unsuccessful scan status(#53): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-59.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915447, FileId: 0x3b00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.539 [RTP] [Mini-filter] Unsuccessful scan status(#54): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-59.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915448, FileId: 0x3a00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.555 [RTP] [Mini-filter] Unsuccessful scan status(#55): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-5c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915453, FileId: 0x3c00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.555 [RTP] [Mini-filter] Unsuccessful scan status(#56): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-5c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915454, FileId: 0x3d00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.570 [RTP] [Mini-filter] Unsuccessful scan status(#57): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-5f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915459, FileId: 0x3e00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.570 [RTP] [Mini-filter] Unsuccessful scan status(#58): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-5f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915460, FileId: 0x3f00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.586 [RTP] [Mini-filter] Unsuccessful scan status(#59): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-62.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915465, FileId: 0x4000000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.586 [RTP] [Mini-filter] Unsuccessful scan status(#60): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-62.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915466, FileId: 0x4100000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.586 [RTP] [Mini-filter] Unsuccessful scan status(#61): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-65.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915471, FileId: 0x4300000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.601 [RTP] [Mini-filter] Unsuccessful scan status(#62): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-65.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915472, FileId: 0x4200000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.601 [RTP] [Mini-filter] Unsuccessful scan status(#63): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-68.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915477, FileId: 0x4400000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.601 [RTP] [Mini-filter] Unsuccessful scan status(#64): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-68.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915478, FileId: 0x4500000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.633 [RTP] [Mini-filter] Unsuccessful scan status(#65): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-6b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915483, FileId: 0x4600000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.633 [RTP] [Mini-filter] Unsuccessful scan status(#66): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-6b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915484, FileId: 0x4700000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.648 [RTP] [Mini-filter] Unsuccessful scan status(#67): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-6f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915490, FileId: 0x4800000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.648 [RTP] [Mini-filter] Unsuccessful scan status(#68): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-6f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915491, FileId: 0x4900000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.664 [RTP] [Mini-filter] Unsuccessful scan status(#69): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-72.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915496, FileId: 0x4b00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.664 [RTP] [Mini-filter] Unsuccessful scan status(#70): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-72.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915497, FileId: 0x4a00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.664 [RTP] [Mini-filter] Unsuccessful scan status(#71): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-75.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915503, FileId: 0x4d00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.664 [RTP] [Mini-filter] Unsuccessful scan status(#72): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-75.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915502, FileId: 0x4c00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.680 [RTP] [Mini-filter] Unsuccessful scan status(#73): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-78.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915508, FileId: 0x4e00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.680 [RTP] [Mini-filter] Unsuccessful scan status(#74): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-78.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915509, FileId: 0x4f00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.695 [RTP] [Mini-filter] Unsuccessful scan status(#75): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-7b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915515, FileId: 0x5100000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.695 [RTP] [Mini-filter] Unsuccessful scan status(#76): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-7b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915514, FileId: 0x5000000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.711 [RTP] [Mini-filter] Unsuccessful scan status(#77): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-7e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915520, FileId: 0x5200000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.711 [RTP] [Mini-filter] Unsuccessful scan status(#78): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-7e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915521, FileId: 0x5300000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.742 [RTP] [Mini-filter] Unsuccessful scan status(#79): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-81.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915526, FileId: 0x5400000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.742 [RTP] [Mini-filter] Unsuccessful scan status(#80): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-81.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915527, FileId: 0x5500000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.758 [RTP] [Mini-filter] Unsuccessful scan status(#81): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-84.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915532, FileId: 0x5600000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.758 [RTP] [Mini-filter] Unsuccessful scan status(#82): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-84.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915533, FileId: 0x5700000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.773 [RTP] [Mini-filter] Unsuccessful scan status(#84): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-87.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915539, FileId: 0x5800000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.773 [RTP] [Mini-filter] Unsuccessful scan status(#83): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-87.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915538, FileId: 0x5900000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.789 [RTP] [Mini-filter] Unsuccessful scan status(#85): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-8b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915544, FileId: 0x5a00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.789 [RTP] [Mini-filter] Unsuccessful scan status(#86): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-8b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915545, FileId: 0x5b00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.805 [RTP] [Mini-filter] Unsuccessful scan status(#87): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-8e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915553, FileId: 0x5c00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.805 [RTP] [Mini-filter] Unsuccessful scan status(#88): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-8e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915554, FileId: 0x5d00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.820 [RTP] [Mini-filter] Unsuccessful scan status(#89): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-91.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915559, FileId: 0x5e00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.820 [RTP] [Mini-filter] Unsuccessful scan status(#90): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-91.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915560, FileId: 0x5f00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.836 [RTP] [Mini-filter] Unsuccessful scan status(#91): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-94.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915565, FileId: 0x6100000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.836 [RTP] [Mini-filter] Unsuccessful scan status(#92): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-94.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915566, FileId: 0x6000000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.851 [RTP] [Mini-filter] Unsuccessful scan status(#93): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-97.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915572, FileId: 0x6300000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.851 [RTP] [Mini-filter] Unsuccessful scan status(#94): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-97.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915571, FileId: 0x6200000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.867 [RTP] [Mini-filter] Unsuccessful scan status(#95): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-9a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915577, FileId: 0x6400000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.867 [RTP] [Mini-filter] Unsuccessful scan status(#96): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-9a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915578, FileId: 0x6500000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.883 [RTP] [Mini-filter] Unsuccessful scan status(#97): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-9d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915584, FileId: 0x6700000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.883 [RTP] [Mini-filter] Unsuccessful scan status(#98): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-9d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915583, FileId: 0x6600000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.914 [RTP] [Mini-filter] Unsuccessful scan status(#99): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-a1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915589, FileId: 0x6800000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.914 [RTP] [Mini-filter] Unsuccessful scan status(#100): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-a1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915590, FileId: 0x6900000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:01.992 [RTP] [Mini-filter] Unsuccessful scan status(#110): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-b0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915620, FileId: 0x7300000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:02.101 [RTP] [Mini-filter] Unsuccessful scan status(#120): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-bf.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915650, FileId: 0x7d00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:02.211 [RTP] [Mini-filter] Unsuccessful scan status(#130): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-d1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915687, FileId: 0x1300000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:02.289 [RTP] [Mini-filter] Unsuccessful scan status(#140): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-e0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915716, FileId: 0x1d00000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:02.367 [RTP] [Mini-filter] Unsuccessful scan status(#150): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-ef.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915746, FileId: 0x9d00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:02.414 [RTP] [Mini-filter] Unsuccessful scan status(#160): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-fe.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915776, FileId: 0x3100000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:02.476 [RTP] [Mini-filter] Unsuccessful scan status(#170): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-10d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915807, FileId: 0x3b00000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:02.555 [RTP] [Mini-filter] Unsuccessful scan status(#180): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-11c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915837, FileId: 0x4500000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:02.633 [RTP] [Mini-filter] Unsuccessful scan status(#190): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-12b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915867, FileId: 0x4f00000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:02.695 [RTP] [Mini-filter] Unsuccessful scan status(#200): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-13a.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915898, FileId: 0x5900000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:02.805 [RTP] [Mini-filter] Unsuccessful scan status(#210): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-14c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915937, FileId: 0x3a00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:02.883 [RTP] [Mini-filter] Unsuccessful scan status(#220): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-15b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915967, FileId: 0x4d00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:02.945 [RTP] [Mini-filter] Unsuccessful scan status(#230): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-16a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5915998, FileId: 0x4e00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.039 [RTP] [Mini-filter] Unsuccessful scan status(#240): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-179.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916027, FileId: 0x6100000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.101 [RTP] [Mini-filter] Unsuccessful scan status(#250): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-188.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916057, FileId: 0x6b00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.195 [RTP] [Mini-filter] Unsuccessful scan status(#260): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-197.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916088, FileId: 0x7500000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.289 [RTP] [Mini-filter] Unsuccessful scan status(#270): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-1a6.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916119, FileId: 0x7600000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.336 [RTP] [Mini-filter] Unsuccessful scan status(#280): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-1b5.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916149, FileId: 0x8000000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.398 [RTP] [Mini-filter] Unsuccessful scan status(#290): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-1c4.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916178, FileId: 0x8a00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.476 [RTP] [Mini-filter] Unsuccessful scan status(#300): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-1d3.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916208, FileId: 0x9d00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.555 [RTP] [Mini-filter] Unsuccessful scan status(#310): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-1e3.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916238, FileId: 0xa700000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.617 [RTP] [Mini-filter] Unsuccessful scan status(#320): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-1f2.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916268, FileId: 0xb100000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.664 [RTP] [Mini-filter] Unsuccessful scan status(#330): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-1fe.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916294, FileId: 0xb000000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.742 [RTP] [Mini-filter] Unsuccessful scan status(#340): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-20d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916325, FileId: 0xba00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.805 [RTP] [Mini-filter] Unsuccessful scan status(#350): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-21c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916355, FileId: 0xc400000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.867 [RTP] [Mini-filter] Unsuccessful scan status(#360): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-22b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916388, FileId: 0xd700000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.930 [RTP] [Mini-filter] Unsuccessful scan status(#370): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-23a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916418, FileId: 0xd800000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:03.992 [RTP] [Mini-filter] Unsuccessful scan status(#380): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-24a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916448, FileId: 0xe200000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.070 [RTP] [Mini-filter] Unsuccessful scan status(#390): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-259.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916478, FileId: 0xec00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.133 [RTP] [Mini-filter] Unsuccessful scan status(#400): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-268.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916507, FileId: 0xff00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.226 [RTP] [Mini-filter] Unsuccessful scan status(#410): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-277.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916539, FileId: 0x10000000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.273 [RTP] [Mini-filter] Unsuccessful scan status(#420): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-286.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916569, FileId: 0x10a00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.336 [RTP] [Mini-filter] Unsuccessful scan status(#430): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-295.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916599, FileId: 0x11d00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.383 [RTP] [Mini-filter] Unsuccessful scan status(#440): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-2a4.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916629, FileId: 0x12700000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.461 [RTP] [Mini-filter] Unsuccessful scan status(#450): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-2b4.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916659, FileId: 0x12800000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.508 [RTP] [Mini-filter] Unsuccessful scan status(#460): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-2c3.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916689, FileId: 0x13200000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.555 [RTP] [Mini-filter] Unsuccessful scan status(#470): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-2d2.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916719, FileId: 0x13c00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.617 [RTP] [Mini-filter] Unsuccessful scan status(#480): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-2e1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916748, FileId: 0x14f00000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.680 [RTP] [Mini-filter] Unsuccessful scan status(#490): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-2f0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916779, FileId: 0x15900000000bf2a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.742 [RTP] [Mini-filter] Unsuccessful scan status(#500): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-302.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916815, FileId: 0xdf00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.789 [RTP] [Mini-filter] Unsuccessful scan status(#510): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-311.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916845, FileId: 0x16600000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.867 [RTP] [Mini-filter] Unsuccessful scan status(#520): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-320.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916878, FileId: 0xf300000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.914 [RTP] [Mini-filter] Unsuccessful scan status(#530): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-32f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916909, FileId: 0x17a00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:04.961 [RTP] [Mini-filter] Unsuccessful scan status(#540): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-33f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916938, FileId: 0x8600000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.039 [RTP] [Mini-filter] Unsuccessful scan status(#550): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-34e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916969, FileId: 0x18e00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.086 [RTP] [Mini-filter] Unsuccessful scan status(#560): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-35d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5916998, FileId: 0x9a00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.133 [RTP] [Mini-filter] Unsuccessful scan status(#570): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-36c.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917029, FileId: 0xa400000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.180 [RTP] [Mini-filter] Unsuccessful scan status(#580): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-37b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917060, FileId: 0x1ac00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.242 [RTP] [Mini-filter] Unsuccessful scan status(#590): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-38b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917091, FileId: 0x1b600000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.289 [RTP] [Mini-filter] Unsuccessful scan status(#600): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-39a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917121, FileId: 0x1c000000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.351 [RTP] [Mini-filter] Unsuccessful scan status(#610): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-3a9.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917151, FileId: 0x1ca00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.398 [RTP] [Mini-filter] Unsuccessful scan status(#620): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-3b8.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917181, FileId: 0xd600000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.445 [RTP] [Mini-filter] Unsuccessful scan status(#630): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-3c7.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917211, FileId: 0xe000000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.539 [RTP] [Mini-filter] Unsuccessful scan status(#640): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-3d6.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917241, FileId: 0x1e800000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.586 [RTP] [Mini-filter] Unsuccessful scan status(#650): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-3e5.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917271, FileId: 0x11000000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.664 [RTP] [Mini-filter] Unsuccessful scan status(#660): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-3f3.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917299, FileId: 0x1fa00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.711 [RTP] [Mini-filter] Unsuccessful scan status(#670): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-402.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917331, FileId: 0x20400000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.789 [RTP] [Mini-filter] Unsuccessful scan status(#680): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-411.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917361, FileId: 0x20e00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.851 [RTP] [Mini-filter] Unsuccessful scan status(#690): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-420.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917394, FileId: 0x21800000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.898 [RTP] [Mini-filter] Unsuccessful scan status(#700): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-42f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917424, FileId: 0x14000000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:05.945 [RTP] [Mini-filter] Unsuccessful scan status(#710): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-43e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917453, FileId: 0x22c00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.023 [RTP] [Mini-filter] Unsuccessful scan status(#720): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-44f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917489, FileId: 0x23500000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.086 [RTP] [Mini-filter] Unsuccessful scan status(#730): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-45e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917519, FileId: 0x23f00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.133 [RTP] [Mini-filter] Unsuccessful scan status(#740): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-46e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917549, FileId: 0x16700000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.180 [RTP] [Mini-filter] Unsuccessful scan status(#750): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-47d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917579, FileId: 0x17100000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.242 [RTP] [Mini-filter] Unsuccessful scan status(#760): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-48d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917609, FileId: 0x17b00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.289 [RTP] [Mini-filter] Unsuccessful scan status(#770): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-49d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917639, FileId: 0x18500000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.367 [RTP] [Mini-filter] Unsuccessful scan status(#780): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-4ad.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917670, FileId: 0x27100000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.445 [RTP] [Mini-filter] Unsuccessful scan status(#790): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-4bd.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917700, FileId: 0x27b00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.539 [RTP] [Mini-filter] Unsuccessful scan status(#800): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-4d3.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917742, FileId: 0x6a00000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.617 [RTP] [Mini-filter] Unsuccessful scan status(#810): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-4e2.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917773, FileId: 0x7400000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.680 [RTP] [Mini-filter] Unsuccessful scan status(#820): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-4f1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917803, FileId: 0x2b00000000d8a2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.773 [RTP] [Mini-filter] Unsuccessful scan status(#830): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-504.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917841, FileId: 0x8a00000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.820 [RTP] [Mini-filter] Unsuccessful scan status(#840): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-513.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917871, FileId: 0x9400000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.898 [RTP] [Mini-filter] Unsuccessful scan status(#850): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-523.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917904, FileId: 0x28500000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:06.961 [RTP] [Mini-filter] Unsuccessful scan status(#860): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-532.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917935, FileId: 0x28f00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.039 [RTP] [Mini-filter] Unsuccessful scan status(#870): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-542.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917965, FileId: 0x29900000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.101 [RTP] [Mini-filter] Unsuccessful scan status(#880): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-551.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5917995, FileId: 0x1bf00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.148 [RTP] [Mini-filter] Unsuccessful scan status(#890): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-560.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918025, FileId: 0x2ad00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.195 [RTP] [Mini-filter] Unsuccessful scan status(#900): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-570.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918056, FileId: 0x2b700000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.289 [RTP] [Mini-filter] Unsuccessful scan status(#910): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-582.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918094, FileId: 0xf300000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.351 [RTP] [Mini-filter] Unsuccessful scan status(#920): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-592.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918124, FileId: 0xac00000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.430 [RTP] [Mini-filter] Unsuccessful scan status(#930): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-5a1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918154, FileId: 0x10700000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.492 [RTP] [Mini-filter] Unsuccessful scan status(#940): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-5b1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918184, FileId: 0x11100000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.555 [RTP] [Mini-filter] Unsuccessful scan status(#950): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-5c0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918215, FileId: 0x11b00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.617 [RTP] [Mini-filter] Unsuccessful scan status(#960): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-5cf.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918245, FileId: 0x12500000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.680 [RTP] [Mini-filter] Unsuccessful scan status(#970): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-5df.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918275, FileId: 0x12f00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.726 [RTP] [Mini-filter] Unsuccessful scan status(#980): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-5ee.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918305, FileId: 0x13900000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.789 [RTP] [Mini-filter] Unsuccessful scan status(#990): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-5fe.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918336, FileId: 0x14300000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:07.851 [RTP] [Mini-filter] Unsuccessful scan status(#1000): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-60d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918366, FileId: 0xfc00000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:08.508 [RTP] [Mini-filter] Unsuccessful scan status(#1100): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-6a7.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918671, FileId: 0x2e200000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:09.133 [RTP] [Mini-filter] Unsuccessful scan status(#1200): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-744.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5918981, FileId: 0x1ae00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:09.867 [RTP] [Mini-filter] Unsuccessful scan status(#1300): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-7e0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5919294, FileId: 0x3ae00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:10.539 [RTP] [Mini-filter] Unsuccessful scan status(#1400): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ce-87b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5919601, FileId: 0x25a00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:11.523 [RTP] [Mini-filter] Unsuccessful scan status(#1500): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6cf-33.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5919922, FileId: 0x47700000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:12.476 [RTP] [Mini-filter] Unsuccessful scan status(#1600): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6d3-33.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5920250, FileId: 0x2d400000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:13.117 [RTP] [Mini-filter] Unsuccessful scan status(#1700): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6d3-cc.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5920561, FileId: 0x17100000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:13.883 [RTP] [Mini-filter] Unsuccessful scan status(#1800): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6d4-30.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5920884, FileId: 0x52700000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:14.633 [RTP] [Mini-filter] Unsuccessful scan status(#1900): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6d5-5d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5921197, FileId: 0x40a00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:15.414 [RTP] [Mini-filter] Unsuccessful scan status(#2000): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6d6-8a.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5921507, FileId: 0x5f300000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:16.148 [RTP] [Mini-filter] Unsuccessful scan status(#2100): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6d8-51.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5921828, FileId: 0x30400000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:16.977 [RTP] [Mini-filter] Unsuccessful scan status(#2200): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6da-1e.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5922155, FileId: 0x4cf00000000c6b3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:18.164 [RTP] [Mini-filter] Unsuccessful scan status(#2300): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6e1-c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5922491, FileId: 0x73100000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:19.023 [RTP] [Mini-filter] Unsuccessful scan status(#2400): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6e5-12.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5922817, FileId: 0x79d00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:19.961 [RTP] [Mini-filter] Unsuccessful scan status(#2500): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6e9-18.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5923144, FileId: 0x80900000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:20.945 [RTP] [Mini-filter] Unsuccessful scan status(#2600): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6ed-1e.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5923470, FileId: 0x87500000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:21.758 [RTP] [Mini-filter] Unsuccessful scan status(#2700): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6f0-3c.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5923795, FileId: 0x8df00000000bf08, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:22.789 [RTP] [Mini-filter] Unsuccessful scan status(#2800): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6f5-15.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5924132, FileId: 0x36d00000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:24.039 [RTP] [Mini-filter] Unsuccessful scan status(#2900): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6f6-183.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5925292, FileId: 0x5200000000d87b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:24.977 [RTP] [Mini-filter] Unsuccessful scan status(#3000): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6f6-2dc.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5926424, FileId: 0x1ec00000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:25.477 [RTP] [Mini-filter] Unsuccessful scan status(#3100): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6f6-369.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5926933, FileId: 0x22100000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:25.883 [RTP] [Mini-filter] Unsuccessful scan status(#3200): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6f6-3e8.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5927437, FileId: 0x25400000000d043, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:26.852 [RTP] [Mini-filter] Unsuccessful scan status(#3300): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6fa-2d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #5927761, FileId: 0x48400000000c754, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T00:00:40.602 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T00:00:40.602 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T00:00:40.602 [Cloud] Queued cloud request. 2026-10-01T00:00:40.602 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T00:00:40.602 [Cloud] Dequeued cloud request. 2026-10-01T00:00:40.602 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T00:00:40.758 [Cloud] End of cloud request. 2026-10-01T00:00:41.258 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T00:08:44.386 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T00:08:44.386 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T00:08:44.386 [Cloud] Queued cloud request. 2026-10-01T00:08:44.386 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T00:08:44.386 [Cloud] Dequeued cloud request. 2026-10-01T00:08:44.386 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T00:08:44.527 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EB2C048B-EE93-8391-8F01-828B07409E87} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 00:08:44 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T00:08:45.027 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T00:11:18.605 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T00:16:07.009 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T00:16:07.009 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T00:16:07.009 [Cloud] Queued cloud request. 2026-10-01T00:16:07.009 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T00:16:07.009 [Cloud] Dequeued cloud request. 2026-10-01T00:16:07.009 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T00:16:07.197 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D8085771-5559-88CD-DFFF-EB24168E2C9C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 00:16:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T00:16:07.712 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T00:26:23.607 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T00:27:11.295 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T00:27:11.295 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T00:27:11.295 [Cloud] Queued cloud request. 2026-10-01T00:27:11.295 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T00:27:11.295 [Cloud] Dequeued cloud request. 2026-10-01T00:27:11.295 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T00:27:11.483 [Cloud] End of cloud request. 2026-10-01T00:27:11.983 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T00:35:14.117 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T00:35:14.117 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T00:35:14.117 [Cloud] Queued cloud request. 2026-10-01T00:35:14.117 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T00:35:14.117 [Cloud] Dequeued cloud request. 2026-10-01T00:35:14.117 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T00:35:14.320 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C193B72B-08BF-DA96-0594-C875145426B7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 00:35:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T00:35:14.820 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T00:41:28.619 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T00:48:12.931 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T00:48:12.931 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T00:48:12.931 [Cloud] Queued cloud request. 2026-10-01T00:48:12.931 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T00:48:12.931 [Cloud] Dequeued cloud request. 2026-10-01T00:48:12.931 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T00:48:13.087 [Cloud] End of cloud request. 2026-10-01T00:48:13.587 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T00:50:08.025 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T00:50:08.025 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T00:50:08.025 [Cloud] Queued cloud request. 2026-10-01T00:50:08.025 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T00:50:08.025 [Cloud] Dequeued cloud request. 2026-10-01T00:50:08.025 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T00:50:08.228 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CB427276-CEDE-F7B3-E99F-B9B9954253CE} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 00:50:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T00:50:08.743 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T00:51:18.321 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T00:51:18.321 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T00:51:18.321 [Cloud] Queued cloud request. 2026-10-01T00:51:18.321 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T00:51:18.321 [Cloud] Dequeued cloud request. 2026-10-01T00:51:18.321 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T00:51:18.493 [Cloud] End of cloud request. 2026-10-01T00:51:18.993 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T00:55:29.174 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T00:55:29.174 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T00:55:29.174 [Cloud] Queued cloud request. 2026-10-01T00:55:29.174 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T00:55:29.174 [Cloud] Dequeued cloud request. 2026-10-01T00:55:29.174 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T00:55:29.330 [Cloud] End of cloud request. 2026-10-01T00:55:29.830 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T00:56:16.924 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T00:56:16.924 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T00:56:16.924 [Cloud] Queued cloud request. 2026-10-01T00:56:16.924 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T00:56:16.924 [Cloud] Dequeued cloud request. 2026-10-01T00:56:16.924 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T00:56:17.002 [Cloud] End of cloud request. 2026-10-01T00:56:17.518 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T00:56:33.627 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T01:04:21.505 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:04:21.505 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:04:21.505 [Cloud] Queued cloud request. 2026-10-01T01:04:21.505 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:04:21.505 [Cloud] Dequeued cloud request. 2026-10-01T01:04:21.505 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:04:21.708 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5C416EC2-4AA0-520F-EEA4-C6BC50299C4E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 01:04:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T01:04:22.223 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:06:38.880 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:06:38.880 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:06:38.880 [Cloud] Queued cloud request. 2026-10-01T01:06:38.880 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:06:38.880 [Cloud] Dequeued cloud request. 2026-10-01T01:06:38.880 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:06:39.068 [Cloud] End of cloud request. 2026-10-01T01:06:39.583 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:10:29.993 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:10:29.993 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:10:29.993 [Cloud] Queued cloud request. 2026-10-01T01:10:29.993 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:10:29.993 [Cloud] Dequeued cloud request. 2026-10-01T01:10:29.993 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:10:30.602 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CBCB18A0-FDC3-E340-F74A-6A1F38C790EC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 01:10:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T01:10:31.103 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:11:38.635 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T01:15:00.807 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:15:00.807 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:15:00.807 [Cloud] Queued cloud request. 2026-10-01T01:15:00.807 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:15:00.807 [Cloud] Dequeued cloud request. 2026-10-01T01:15:00.807 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:15:01.276 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6C3056F8-59C3-34A3-8A8F-14D06850D524} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 01:15:01 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T01:15:01.791 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:15:57.683 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:15:57.683 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:15:57.683 [Cloud] Queued cloud request. 2026-10-01T01:15:57.683 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:15:57.683 [Cloud] Dequeued cloud request. 2026-10-01T01:15:57.683 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:15:58.308 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F9593C40-4707-A1AD-4377-7FD512DBCA67} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 01:15:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T01:15:58.808 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:19:07.888 Created on demand scan context for ScanType:1. ScanTrigger:55, ScanId:38840D1A-21AD-464B-88AD-9D80E340035C, Source: MPSOURCE_SYSTEM(2), EngineSource: MP_SCANSOURCE_SCHEDULED(1) 2026-10-01T01:19:07.888 Scheduled scan with Id 38840D1A-21AD-464B-88AD-9D80E340035C configured CPU priority: normal (LowCpuPriority: 0) 2026-10-01T01:19:07.904 [SFC] MpCmIsBuildPermissible(1) returns S_OK. Start SFC build. 2026-10-01T01:19:07.904 [SFC] System file cache build is not needed (already completed) Internal signature match:subtype=Lowfi, sigseq=0x0000157E67AA49DF, sigsha=cd8f16a9d4beb15e15e36fc9a546c2d5bfbafd06, cached=false, source=0, resourceid=0x0d0ba041 2026-10-01T01:19:30.685 Engine:Triggered AR EMS scan 2026-10-01T01:19:30.700 Engine:EMS scan for process: lsass pid: 624, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.732 Engine:EMS scan for process: svchost pid: 736, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.732 Engine:EMS scan for process: svchost pid: 856, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.747 Engine:EMS scan for process: svchost pid: 912, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.747 Engine:EMS scan for process: svchost pid: 976, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.763 Engine:EMS scan for process: svchost pid: 996, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.779 Engine:EMS scan for process: svchost pid: 1016, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.794 Engine:EMS scan for process: svchost pid: 372, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.794 Engine:EMS scan for process: svchost pid: 1080, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.794 Engine:EMS scan for process: svchost pid: 1124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.794 Engine:EMS scan for process: svchost pid: 1196, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.810 Engine:EMS scan for process: svchost pid: 1260, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.810 Engine:EMS scan for process: svchost pid: 1276, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.810 Engine:EMS scan for process: svchost pid: 1308, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.825 Engine:EMS scan for process: svchost pid: 1384, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.825 Engine:EMS scan for process: svchost pid: 1400, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.841 Engine:EMS scan for process: svchost pid: 1408, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.841 Engine:EMS scan for process: svchost pid: 1416, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.841 Engine:EMS scan for process: svchost pid: 1448, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.857 Engine:EMS scan for process: svchost pid: 1600, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.857 Engine:EMS scan for process: svchost pid: 1692, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.857 Engine:EMS scan for process: svchost pid: 1780, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.872 Engine:EMS scan for process: svchost pid: 1788, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.872 Engine:EMS scan for process: svchost pid: 1916, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.872 Engine:EMS scan for process: svchost pid: 1952, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.888 Engine:EMS scan for process: svchost pid: 2000, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.888 Engine:EMS scan for process: svchost pid: 1272, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.904 Engine:EMS scan for process: svchost pid: 1256, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.904 Engine:EMS scan for process: svchost pid: 1480, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.904 Engine:EMS scan for process: svchost pid: 1684, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.919 Engine:EMS scan for process: svchost pid: 2192, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.919 Engine:EMS scan for process: svchost pid: 2228, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.919 Engine:EMS scan for process: svchost pid: 2488, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.935 Engine:EMS scan for process: svchost pid: 2528, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.935 Engine:EMS scan for process: svchost pid: 2544, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.950 Engine:EMS scan for process: svchost pid: 2572, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.950 Engine:EMS scan for process: svchost pid: 2608, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.950 Engine:EMS scan for process: svchost pid: 2644, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.966 Engine:EMS scan for process: svchost pid: 2688, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.966 Engine:EMS scan for process: svchost pid: 1980, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.966 Engine:EMS scan for process: svchost pid: 2668, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.966 Engine:EMS scan for process: svchost pid: 3104, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.982 Engine:EMS scan for process: svchost pid: 3112, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.982 Engine:EMS scan for process: svchost pid: 3116, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.982 Engine:EMS scan for process: svchost pid: 3248, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.997 Engine:EMS scan for process: svchost pid: 3288, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.997 Engine:EMS scan for process: svchost pid: 3312, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:30.997 Engine:EMS scan for process: svchost pid: 4124, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.013 Engine:EMS scan for process: svchost pid: 4168, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.013 Engine:EMS scan for process: dllhost pid: 4244, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.013 Engine:EMS scan for process: svchost pid: 1140, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.029 Engine:EMS scan for process: svchost pid: 2588, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.029 Engine:EMS scan for process: svchost pid: 5472, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.029 Engine:EMS scan for process: svchost pid: 5852, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.044 Engine:EMS scan for process: svchost pid: 3336, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.044 Engine:EMS scan for process: svchost pid: 1520, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.044 Engine:EMS scan for process: svchost pid: 760, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.060 Engine:EMS scan for process: svchost pid: 632, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.075 Engine:EMS scan for process: svchost pid: 5860, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.091 Engine:EMS scan for process: svchost pid: 7832, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:19:31.091 Engine:EMS scan for process: svchost pid: 6412, sigseq: 0x0, sendMemoryScanReport: 0, source: 1 2026-10-01T01:20:09.436 QuickScan:ScanID:38840D1A-21AD-464B-88AD-9D80E340035C: Quick scan finished with error 0 2026-10-01T01:20:09.936 [RTP] [RtpConfig] Config change detected, type: 32 2026-10-01T01:20:09.936 [RTP] Duplicating the current plugin configuration object... 2026-10-01T01:20:09.936 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-10-01T01:20:09.936 [RTP] Updating plugin configuration due to recent config changes (0x20) ... 2026-10-01T01:20:09.936 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-10-01T01:20:09.936 [RTP] No config change detected. Not updating plugin configuration. 2026-10-01T01:20:09.936 [RTP] No config changes found. No configuration switch. 2026-10-01T01:20:09.936 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x20, Changed: 0 2026-10-01T01:22:03.795 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:22:03.795 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:22:03.795 [Cloud] Queued cloud request. 2026-10-01T01:22:03.795 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:22:03.795 [Cloud] Dequeued cloud request. 2026-10-01T01:22:03.795 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:22:03.952 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4B17FD6C-3247-2683-06B6-2DE2311BEB67} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 01:22:03 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T01:22:04.467 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:26:28.922 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:26:28.922 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:26:28.922 [Cloud] Queued cloud request. 2026-10-01T01:26:28.922 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:26:28.922 [Cloud] Dequeued cloud request. 2026-10-01T01:26:28.922 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:26:29.078 [Cloud] End of cloud request. 2026-10-01T01:26:29.578 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:26:43.641 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T01:36:20.958 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:36:20.958 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:36:20.958 [Cloud] Queued cloud request. 2026-10-01T01:36:20.958 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:36:20.958 [Cloud] Dequeued cloud request. 2026-10-01T01:36:20.958 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:36:31.036 [Cloud] End of cloud request. 2026-10-01T01:36:31.536 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:39:46.101 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 8696, Count: 627, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0% 2026-10-01T01:39:46.101 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 6524, Count: 530, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-10-01T01:39:46.101 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 1636, Count: 6912, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6f7-2.MAI, EstimatedImpact: 0% 2026-10-01T01:39:46.101 ProcessImageName: powershell.exe, Pid: 3420, TotalTime: 1509, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-10-01T01:39:46.101 ProcessImageName: AgentShell.exe, Pid: 6132, TotalTime: 1015, Count: 55, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-10-01T01:39:46.101 ProcessImageName: AgentShellService.exe, Pid: 6036, TotalTime: 775, Count: 27, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-10-01T01:39:46.101 ProcessImageName: WmiPrvSE.exe, Pid: 6896, TotalTime: 661, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-10-01T01:39:46.101 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 346, Count: 25, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-10-01T01:39:46.101 ProcessImageName: WmiPrvSE.exe, Pid: 3052, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-10-01T01:39:46.101 ProcessImageName: cmd.exe, Pid: 5768, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\dumpalldatabases.bat, EstimatedImpact: 0% 2026-10-01T01:39:46.101 ProcessImageName: taskhostw.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-10-01T01:39:46.101 ProcessImageName: DeviceCensus.exe, Pid: 7880, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-10-01T01:39:46.101 ProcessImageName: ngentask.exe, Pid: 2976, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-10-01T01:39:46.101 ProcessImageName: taskhostw.exe, Pid: 6572, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-10-01T01:39:46.101 ProcessImageName: mysqldump.exe, Pid: 4836, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 0% 2026-10-01T01:39:46.101 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-10-01T01:39:46.101 ProcessImageName: cmd.exe, Pid: 7928, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-10-01T01:39:46.101 ProcessImageName: powershell.exe, Pid: 6056, TotalTime: 15, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDF09.tmp, EstimatedImpact: 0% 2026-10-01T01:39:46.101 ProcessImageName: powershell.exe, Pid: 3384, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp7E54.tmp, EstimatedImpact: 0% 2026-10-01T01:41:48.648 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T01:42:04.976 [AutoPurge] Verification Routine tasks have started.ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-10-01T01:42:05.025 [AutoPurge] Routine task for Cache Maintenance has started. 2026-10-01T01:42:05.025 [AutoPurge] Routine task for Cache Maintenance ... 2026-10-01T01:42:05.025 [AutoPurge] Routine task for MpSFCBuild ... 2026-10-01T01:42:05.025 [AutoPurge] MpCmIsBuildCompleted() - S_OK 2026-10-01T01:42:05.025 [AutoPurge] MpSignalMaintenanceMode ... 2026-10-01T01:42:05.025 [AutoPurge] Routine task for Cache Maintenance has ended. 2026-10-01T01:42:05.054 [AutoPurge] Cleanup Routine tasks have started. 2026-10-01T01:42:05.054 Detection State: Finished(0) Failed(0) CriticalFailed(0) Additional Actions(0) 2026-10-01T01:42:05.054 [AutoPurge] Purged 0 expired detection item(s) from a total of 0. 2026-10-01T01:42:05.054 [AutoPurge] 0 expired file(s) deleted under C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store (total: 0, expiration in 86400 seconds) Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:65538 Start time:10-01-2026 01:42:05 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:10-01-2026 01:42:05 2026-10-01T01:42:05.070 [PlatUpd] Purging orphaned platform update directories under C:\ProgramData\Microsoft\Windows Defender\Platform ... 2026-10-01T01:42:05.070 [PlatUpd] Not purging current location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 ... 2026-10-01T01:42:05.070 [PlatUpd] Not purging backup location C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0 ... 2026-10-01T01:42:05.070 [PlatUpd] Deleting orphaned platform update directory C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0 ... 2026-10-01T01:42:05.070 [PlatUpd] Purging orphaned platform update directories under C:\Program Files\Windows Defender\Platform ... 2026-10-01T01:42:05.070 [AutoPurge] Cleanup Routine tasks have ended. 2026-10-01T01:42:05.164 EnsureProtectedFolderAcls(), hr = 0x0 2026-10-01T01:42:05.164 [AutoPurge] MpReinforceServiceAcls: 0 2026-10-01T01:42:05.195 [AutoPurge] Readded platform files to MOAC after ACL enforcement. hr=0 2026-10-01T01:42:05.195 [AutoPurge] Removing expired default signature package ... 2026-10-01T01:42:05.429 Job Notification: New process added to job (3148) 2026-10-01T01:42:06.320 Job Notification: Process exited from job (3148) 2026-10-01T01:42:06.382 [AutoPurge] Verification Routine tasks have ended. 2026-10-01T01:45:21.601 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:45:21.601 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:45:21.601 [Cloud] Queued cloud request. 2026-10-01T01:45:21.601 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:45:21.601 [Cloud] Dequeued cloud request. 2026-10-01T01:45:21.601 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:45:21.757 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A4A26A65-FD6A-8D09-51CA-67CEFE1ED274} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 01:45:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T01:45:22.273 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-10-01T01:45:22.289 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:45:22.289 [RTP] [RtpConfig] Config change detected, type: 32 2026-10-01T01:45:22.289 [RTP] [RtpConfig] Config change detected, type: 2 2026-10-01T01:45:22.289 [RTP] [RtpConfig] Config change detected, type: 4096 2026-10-01T01:45:22.289 [RTP] [RtpConfig] Config change detected, type: 4 2026-10-01T01:45:22.289 [RTP] [RtpConfig] Config change detected, type: 8 2026-10-01T01:45:22.289 [RTP] [RtpConfig] Config change detected, type: 16 2026-10-01T01:45:22.289 [RTP] [RtpConfig] Config change detected, type: 1024 2026-10-01T01:45:22.289 [RTP] [RtpConfig] Config change detected, type: 2048 2026-10-01T01:45:22.289 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-10-01T01:45:22.289 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-10-01T01:45:22.289 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-10-01T01:45:22.289 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-10-01T01:45:22.289 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-10-01T01:45:22.289 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-10-01T01:45:22.289 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-10-01T01:45:22.289 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-10-01T01:45:22.289 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-10-01T01:45:22.289 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-10-01T01:45:22.289 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:45:22.289 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-10-01T01:45:22.289 [RTP] [RtpConfig] Config change detected, type: 64 2026-10-01T01:45:22.289 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:45:22.304 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:45:22.304 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:45:24.867 [RTP] Duplicating the current plugin configuration object... 2026-10-01T01:45:24.867 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-10-01T01:45:24.867 [RTP] Updating plugin configuration due to recent config changes (0x43e) ... 2026-10-01T01:45:24.867 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-10-01T01:45:24.867 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-10-01T01:45:24.867 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x43e, Changed: 0x218 2026-10-01T01:53:48.074 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:53:48.074 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:53:48.074 [Cloud] Queued cloud request. 2026-10-01T01:53:48.074 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:53:48.074 [Cloud] Dequeued cloud request. 2026-10-01T01:53:48.074 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:53:48.214 [Cloud] End of cloud request. 2026-10-01T01:53:48.730 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:55:34.168 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:55:34.168 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:55:34.168 [Cloud] Queued cloud request. 2026-10-01T01:55:34.168 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:55:34.168 [Cloud] Dequeued cloud request. 2026-10-01T01:55:34.168 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:55:34.309 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{37AC893F-9704-2650-863D-37C9865CC37E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 01:55:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T01:55:34.824 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:56:23.137 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:56:23.137 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:56:23.137 [Cloud] Queued cloud request. 2026-10-01T01:56:23.137 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:56:23.137 [Cloud] Dequeued cloud request. 2026-10-01T01:56:23.137 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:56:23.216 [Cloud] End of cloud request. 2026-10-01T01:56:23.731 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:56:53.653 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T01:57:52.578 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:57:52.578 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:57:52.578 [Cloud] Queued cloud request. 2026-10-01T01:57:52.578 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:57:52.578 [Cloud] Dequeued cloud request. 2026-10-01T01:57:52.578 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:57:52.719 [Cloud] End of cloud request. 2026-10-01T01:57:53.219 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:58:36.875 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:58:36.875 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:58:36.875 [Cloud] Queued cloud request. 2026-10-01T01:58:36.875 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:58:36.875 [Cloud] Dequeued cloud request. 2026-10-01T01:58:36.875 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:58:36.953 [Cloud] End of cloud request. 2026-10-01T01:58:37.469 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T01:59:23.516 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T01:59:23.516 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T01:59:23.516 [Cloud] Queued cloud request. 2026-10-01T01:59:23.516 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T01:59:23.516 [Cloud] Dequeued cloud request. 2026-10-01T01:59:23.516 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T01:59:23.594 [Cloud] End of cloud request. 2026-10-01T01:59:24.110 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T02:01:37.860 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T02:01:37.860 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T02:01:37.860 [Cloud] Queued cloud request. 2026-10-01T02:01:37.860 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T02:01:37.860 [Cloud] Dequeued cloud request. 2026-10-01T02:01:37.860 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T02:01:38.001 [Cloud] End of cloud request. 2026-10-01T02:01:38.516 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T02:05:22.719 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T02:05:22.719 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T02:05:22.719 [Cloud] Queued cloud request. 2026-10-01T02:05:22.719 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T02:05:22.876 [Cloud] Dequeued cloud request. 2026-10-01T02:05:22.876 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T02:05:23.016 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F449BD66-9DF7-1ED8-5432-5B775C220055} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 02:05:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T02:05:23.516 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T02:06:44.988 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T02:06:44.988 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T02:06:44.988 [Cloud] Queued cloud request. 2026-10-01T02:06:44.988 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T02:06:44.988 [Cloud] Dequeued cloud request. 2026-10-01T02:06:44.988 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T02:06:45.175 [Cloud] End of cloud request. 2026-10-01T02:06:45.691 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T02:11:58.661 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T02:13:54.286 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T02:13:54.286 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T02:13:54.286 [Cloud] Queued cloud request. 2026-10-01T02:13:54.286 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T02:13:54.443 [Cloud] Dequeued cloud request. 2026-10-01T02:13:54.599 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T02:13:54.896 [Cloud] End of cloud request. 2026-10-01T02:13:55.396 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T02:27:03.667 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T02:32:45.296 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T02:32:45.296 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T02:32:45.296 [Cloud] Queued cloud request. 2026-10-01T02:32:45.296 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T02:32:45.296 [Cloud] Dequeued cloud request. 2026-10-01T02:32:45.296 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T02:32:55.390 [Cloud] End of cloud request. 2026-10-01T02:32:55.905 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T02:39:30.518 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T02:39:30.518 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T02:39:30.518 [Cloud] Queued cloud request. 2026-10-01T02:39:30.518 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T02:39:30.518 [Cloud] Dequeued cloud request. 2026-10-01T02:39:30.518 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T02:39:30.674 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{844CB297-C544-A221-9525-3D34649558E2} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 02:39:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T02:39:31.174 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T02:40:32.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T02:40:32.643 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T02:40:32.643 [Cloud] Queued cloud request. 2026-10-01T02:40:32.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T02:40:32.643 [Cloud] Dequeued cloud request. 2026-10-01T02:40:32.643 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T02:40:32.784 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B75591D0-E092-15C3-A653-0DAAF4218735} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 02:40:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T02:40:33.299 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T02:41:54.690 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T02:41:54.690 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T02:41:54.690 [Cloud] Queued cloud request. 2026-10-01T02:41:54.690 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T02:41:54.690 [Cloud] Dequeued cloud request. 2026-10-01T02:41:54.690 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T02:41:54.846 [Cloud] End of cloud request. 2026-10-01T02:41:55.346 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T02:42:08.674 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T02:52:04.227 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T02:52:04.227 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T02:52:04.227 [Cloud] Queued cloud request. 2026-10-01T02:52:04.227 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T02:52:04.227 [Cloud] Dequeued cloud request. 2026-10-01T02:52:04.227 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T02:52:04.415 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{589A8E55-BA98-B21A-00FD-3AAA01C50497} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 02:52:04 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T02:52:04.915 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T02:54:07.883 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T02:54:07.883 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T02:54:07.883 [Cloud] Queued cloud request. 2026-10-01T02:54:07.883 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T02:54:07.883 [Cloud] Dequeued cloud request. 2026-10-01T02:54:07.883 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T02:54:08.071 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{711F5A10-B02F-3A5A-2204-6A1C203B2E4E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 02:54:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T02:54:08.571 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T02:57:13.681 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T03:05:25.825 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T03:05:25.825 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T03:05:25.825 [Cloud] Queued cloud request. 2026-10-01T03:05:25.825 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T03:05:25.825 [Cloud] Dequeued cloud request. 2026-10-01T03:05:25.825 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T03:05:26.012 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C3DDAADA-621E-5F44-3BAF-52F38A57CA69} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 03:05:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T03:05:26.528 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T03:10:34.001 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T03:10:34.001 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T03:10:34.001 [Cloud] Queued cloud request. 2026-10-01T03:10:34.001 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T03:10:34.001 [Cloud] Dequeued cloud request. 2026-10-01T03:10:34.001 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T03:10:34.173 [Cloud] End of cloud request. 2026-10-01T03:10:34.688 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T03:12:18.690 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T03:14:42.190 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T03:14:42.190 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T03:14:42.190 [Cloud] Queued cloud request. 2026-10-01T03:14:42.190 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T03:14:42.190 [Cloud] Dequeued cloud request. 2026-10-01T03:14:42.190 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T03:14:42.408 [Cloud] End of cloud request. 2026-10-01T03:14:42.909 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T03:27:23.695 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T03:39:46.155 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 10938, Count: 798, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\index_top.html, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 6524, Count: 530, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: AgentShell.exe, Pid: 6132, TotalTime: 2996, Count: 243, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 1636, Count: 6912, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6f7-2.MAI, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: powershell.exe, Pid: 3420, TotalTime: 1509, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-10-01T03:39:46.155 ProcessImageName: AgentShellService.exe, Pid: 6036, TotalTime: 775, Count: 27, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-10-01T03:39:46.155 ProcessImageName: WmiPrvSE.exe, Pid: 6896, TotalTime: 661, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-10-01T03:39:46.155 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 422, Count: 29, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: WmiPrvSE.exe, Pid: 3052, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-10-01T03:39:46.155 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: cmd.exe, Pid: 5768, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\dumpalldatabases.bat, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: taskhostw.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-10-01T03:39:46.155 ProcessImageName: DeviceCensus.exe, Pid: 7880, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-10-01T03:39:46.155 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: ngentask.exe, Pid: 2976, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-10-01T03:39:46.155 ProcessImageName: taskhostw.exe, Pid: 6572, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-10-01T03:39:46.155 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 30, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: mysqldump.exe, Pid: 4836, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload_all_db_backups.bat, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: cmd.exe, Pid: 7928, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: powershell.exe, Pid: 6056, TotalTime: 15, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDF09.tmp, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: powershell.exe, Pid: 3384, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp7E54.tmp, EstimatedImpact: 0% 2026-10-01T03:39:46.155 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-10-01T03:42:28.702 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T03:42:46.202 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T03:42:46.202 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T03:42:46.202 [Cloud] Queued cloud request. 2026-10-01T03:42:46.202 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T03:42:46.202 [Cloud] Dequeued cloud request. 2026-10-01T03:42:46.202 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T03:42:52.858 [Cloud] End of cloud request. 2026-10-01T03:42:53.358 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T03:42:58.702 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T03:42:58.702 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T03:42:58.702 [Cloud] Queued cloud request. 2026-10-01T03:42:58.702 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T03:42:58.702 [Cloud] Dequeued cloud request. 2026-10-01T03:42:58.702 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T03:42:58.780 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{7CE161BD-26DB-420A-10D0-58187677B7A5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 03:42:58 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T03:42:59.280 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T03:48:19.440 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T03:48:19.440 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T03:48:19.440 [Cloud] Queued cloud request. 2026-10-01T03:48:19.440 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T03:48:19.440 [Cloud] Dequeued cloud request. 2026-10-01T03:48:19.440 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T03:48:19.597 [Cloud] End of cloud request. 2026-10-01T03:48:20.097 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T03:52:38.566 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T03:52:38.566 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T03:52:38.566 [Cloud] Queued cloud request. 2026-10-01T03:52:38.566 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T03:52:38.722 [Cloud] Dequeued cloud request. 2026-10-01T03:52:38.722 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T03:52:38.925 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{56EE70DB-77AF-33DF-07A6-6C4F3BACB577} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 03:52:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T03:52:39.425 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T03:57:33.709 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T04:05:29.556 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T04:05:29.556 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T04:05:29.556 [Cloud] Queued cloud request. 2026-10-01T04:05:29.556 [Cloud] Dequeued cloud request. 2026-10-01T04:05:29.556 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T04:05:29.556 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T04:05:29.743 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{5E60DDB1-F90A-7472-38BD-4BDF6099ADFD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 04:05:29 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T04:05:30.259 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T04:09:36.450 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T04:09:36.450 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T04:09:36.450 [Cloud] Queued cloud request. 2026-10-01T04:09:36.450 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T04:09:36.450 [Cloud] Dequeued cloud request. 2026-10-01T04:09:36.450 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T04:09:36.684 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{51C90F13-01CC-0F13-C8A9-144F97B49BEB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 04:09:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T04:09:37.184 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T04:12:38.716 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T04:15:06.497 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T04:15:06.497 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T04:15:06.497 [Cloud] Queued cloud request. 2026-10-01T04:15:06.497 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T04:15:06.497 [Cloud] Dequeued cloud request. 2026-10-01T04:15:06.497 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T04:15:06.872 [Cloud] End of cloud request. 2026-10-01T04:15:07.372 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T04:15:48.544 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T04:15:48.544 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T04:15:48.544 [Cloud] Queued cloud request. 2026-10-01T04:15:48.544 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T04:15:48.544 [Cloud] Dequeued cloud request. 2026-10-01T04:15:48.544 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T04:15:48.622 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{80047ED1-5347-BA55-9716-6AA83C1BE2AF} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 04:15:48 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T04:15:49.122 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T04:16:08.716 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T04:16:08.716 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T04:16:08.716 [Cloud] Queued cloud request. 2026-10-01T04:16:08.716 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T04:16:08.716 [Cloud] Dequeued cloud request. 2026-10-01T04:16:08.716 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T04:16:08.794 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F544EB7-0952-D3E9-4010-9906AEE715DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 04:16:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T04:16:09.310 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T04:16:27.700 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T04:16:27.700 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T04:16:27.700 [Cloud] Queued cloud request. 2026-10-01T04:16:27.700 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T04:16:27.700 [Cloud] Dequeued cloud request. 2026-10-01T04:16:27.700 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T04:16:27.778 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{AE001E17-0D1B-CB37-EEB6-9978FC7A3D26} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 04:16:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T04:16:28.294 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T04:18:38.266 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T04:18:38.266 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T04:18:38.266 [Cloud] Queued cloud request. 2026-10-01T04:18:38.266 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T04:18:38.266 [Cloud] Dequeued cloud request. 2026-10-01T04:18:38.266 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T04:18:38.469 [Cloud] End of cloud request. 2026-10-01T04:18:38.969 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T04:27:43.723 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T04:33:58.990 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T04:33:58.990 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T04:33:58.990 [Cloud] Queued cloud request. 2026-10-01T04:33:58.990 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T04:33:58.990 [Cloud] Dequeued cloud request. 2026-10-01T04:33:58.990 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T04:33:59.177 [Cloud] End of cloud request. 2026-10-01T04:33:59.677 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T04:41:51.854 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T04:41:51.854 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T04:41:51.854 [Cloud] Queued cloud request. 2026-10-01T04:41:51.854 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T04:41:51.854 [Cloud] Dequeued cloud request. 2026-10-01T04:41:51.854 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T04:41:52.026 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B8D10EAB-B158-1B78-EBC4-593EB368A7EB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 04:41:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T04:41:52.541 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T04:42:48.729 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T04:43:17.245 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T04:43:17.245 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T04:43:17.245 [Cloud] Queued cloud request. 2026-10-01T04:43:17.245 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T04:43:17.245 [Cloud] Dequeued cloud request. 2026-10-01T04:43:17.245 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T04:43:17.432 [Cloud] End of cloud request. 2026-10-01T04:43:17.932 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T04:53:00.608 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T04:53:00.608 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T04:53:00.608 [Cloud] Queued cloud request. 2026-10-01T04:53:00.608 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T04:53:00.608 [Cloud] Dequeued cloud request. 2026-10-01T04:53:00.608 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T04:53:00.764 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BFA80C46-D79E-840D-2954-D59BC0908DA5} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 04:53:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T04:53:01.264 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T04:57:53.737 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T05:05:32.332 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T05:05:32.332 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T05:05:32.332 [Cloud] Queued cloud request. 2026-10-01T05:05:32.332 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T05:05:32.332 [Cloud] Dequeued cloud request. 2026-10-01T05:05:32.332 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T05:05:32.535 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{592E28FB-FB9C-6A51-7329-B39F9510DB02} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 05:05:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T05:05:33.035 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T05:12:58.743 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T05:24:22.934 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Apache24\logs\error.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #6037210, FileId: 0xf00000001e8ea, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x2020, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T05:26:13.591 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2dd07-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6037924, FileId: 0x1100000002105a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T05:26:13.591 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2dd07-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6037925, FileId: 0xc000000020060, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T05:26:13.669 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2dd12-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6037935, FileId: 0x1200000002105a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T05:26:13.685 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2dd12-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6037936, FileId: 0xd000000020060, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T05:26:18.935 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2dd2e-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6037988, FileId: 0x1300000002105a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T05:26:18.935 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2dd2e-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6037989, FileId: 0xe000000020060, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T05:26:23.732 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2dd37-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6038042, FileId: 0xe0000000210ca, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T05:26:23.732 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2dd37-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6038043, FileId: 0x1400000002105a, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T05:28:03.750 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T05:39:46.208 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 72068, Count: 4805, MaxTime: 484, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\_phpMyAdmin.new\js\vendor\codemirror\lib\codemirror.js, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 6524, Count: 530, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: AgentShell.exe, Pid: 6132, TotalTime: 5099, Count: 428, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 1741, Count: 6936, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6f7-2.MAI, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: powershell.exe, Pid: 3420, TotalTime: 1509, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-10-01T05:39:46.208 ProcessImageName: php.exe, Pid: 732, TotalTime: 846, Count: 20, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 29% 2026-10-01T05:39:46.208 ProcessImageName: AgentShellService.exe, Pid: 6036, TotalTime: 775, Count: 27, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-10-01T05:39:46.208 ProcessImageName: WmiPrvSE.exe, Pid: 6896, TotalTime: 661, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-10-01T05:39:46.208 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 452, Count: 31, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: httpd.exe, Pid: 7812, TotalTime: 315, Count: 36, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\rryzTqXIVv-idpXltF0h_B702npPzBjXjR9t1GVB0M8, EstimatedImpact: 5% 2026-10-01T05:39:46.208 ProcessImageName: python.exe, Pid: 1324, TotalTime: 240, Count: 24, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: powershell.exe, Pid: 356, TotalTime: 231, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 56% 2026-10-01T05:39:46.208 ProcessImageName: WmiPrvSE.exe, Pid: 3052, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-10-01T05:39:46.208 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 122, Count: 6, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: httpd.exe, Pid: 1564, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-vhosts.conf, EstimatedImpact: 74% 2026-10-01T05:39:46.208 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 90, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: httpd.exe, Pid: 2468, TotalTime: 90, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\mime.types, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: taskhostw.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-10-01T05:39:46.208 ProcessImageName: cmd.exe, Pid: 5768, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\dumpalldatabases.bat, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: DeviceCensus.exe, Pid: 7880, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-10-01T05:39:46.208 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: ngentask.exe, Pid: 2976, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-10-01T05:39:46.208 ProcessImageName: taskhostw.exe, Pid: 6572, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-10-01T05:39:46.208 ProcessImageName: mysqldump.exe, Pid: 4836, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload_all_db_backups.bat, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: cmd.exe, Pid: 7928, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: powershell.exe, Pid: 6056, TotalTime: 15, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDF09.tmp, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: powershell.exe, Pid: 3384, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp7E54.tmp, EstimatedImpact: 0% 2026-10-01T05:39:46.208 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-10-01T05:43:08.756 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T05:49:41.572 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2de2c-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6053364, FileId: 0x100000000228ee, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T05:49:41.572 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2de2c-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6053363, FileId: 0xf0000000228ef, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T05:58:13.764 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T06:13:18.770 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T06:28:23.777 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T06:43:28.783 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T06:45:29.768 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T06:45:29.768 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T06:45:29.768 [Cloud] Queued cloud request. 2026-10-01T06:45:29.768 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T06:45:29.768 [Cloud] Dequeued cloud request. 2026-10-01T06:45:29.768 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T06:45:30.033 [Cloud] End of cloud request. 2026-10-01T06:45:30.549 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T06:56:33.352 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T06:56:33.352 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T06:56:33.352 [Cloud] Queued cloud request. 2026-10-01T06:56:33.352 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T06:56:33.352 [Cloud] Dequeued cloud request. 2026-10-01T06:56:33.352 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T06:56:33.945 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{197EE3B2-B24A-684F-8B50-84DFD37FD1B8} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 06:56:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T06:56:34.445 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T06:58:33.790 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T07:02:27.009 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T07:02:27.009 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T07:02:27.009 [Cloud] Queued cloud request. 2026-10-01T07:02:27.009 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T07:02:27.009 [Cloud] Dequeued cloud request. 2026-10-01T07:02:27.009 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T07:02:27.915 [Cloud] End of cloud request. 2026-10-01T07:02:28.431 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T07:12:50.201 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2ec97-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6101572, FileId: 0xf00000001b1bc, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T07:12:50.201 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2ec97-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6101571, FileId: 0x2800000001b7a2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T07:12:53.389 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2ec9d-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6101612, FileId: 0x1000000001b1bc, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T07:12:53.389 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2ec9d-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6101611, FileId: 0x2900000001b7a2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T07:13:38.795 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T07:15:38.235 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2ecc1-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6103382, FileId: 0xc000000006708, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T07:15:38.235 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2ecc1-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6103381, FileId: 0x130000000236e2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T07:16:32.236 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T07:16:32.236 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T07:16:32.236 [Cloud] Queued cloud request. 2026-10-01T07:16:32.236 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T07:16:32.236 [Cloud] Dequeued cloud request. 2026-10-01T07:16:32.236 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T07:16:32.423 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FDC5ECC0-162D-4F89-74CB-59E6E0CDBF48} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 07:16:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T07:16:32.939 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T07:28:43.804 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T07:31:52.962 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T07:31:52.962 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T07:31:52.962 [Cloud] Queued cloud request. 2026-10-01T07:31:52.962 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T07:31:52.962 [Cloud] Dequeued cloud request. 2026-10-01T07:31:52.962 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T07:31:53.118 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3AD10837-4FF4-BBB7-BF51-25C6D83BA3F0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 07:31:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T07:31:53.618 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T07:37:14.182 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T07:37:14.182 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T07:37:14.182 [Cloud] Queued cloud request. 2026-10-01T07:37:14.182 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T07:37:14.182 [Cloud] Dequeued cloud request. 2026-10-01T07:37:14.182 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T07:37:14.479 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FB15A511-9319-CB1C-837F-87646AF9F3CA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 07:37:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T07:37:14.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T07:37:21.135 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T07:37:21.135 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T07:37:21.135 [Cloud] Queued cloud request. 2026-10-01T07:37:21.135 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T07:37:21.135 [Cloud] Dequeued cloud request. 2026-10-01T07:37:21.135 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T07:37:21.479 [Cloud] End of cloud request. 2026-10-01T07:37:21.979 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T07:39:46.261 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 284247, Count: 24443, MaxTime: 1343, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: AgentShell.exe, Pid: 6132, TotalTime: 7092, Count: 607, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 6524, Count: 530, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 1801, Count: 6952, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6f7-2.MAI, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: powershell.exe, Pid: 3420, TotalTime: 1509, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-10-01T07:39:46.261 ProcessImageName: php.exe, Pid: 732, TotalTime: 846, Count: 20, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 29% 2026-10-01T07:39:46.261 ProcessImageName: AgentShellService.exe, Pid: 6036, TotalTime: 775, Count: 27, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-10-01T07:39:46.261 ProcessImageName: WmiPrvSE.exe, Pid: 6896, TotalTime: 661, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-10-01T07:39:46.261 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 467, Count: 33, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: httpd.exe, Pid: 7812, TotalTime: 315, Count: 36, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\rryzTqXIVv-idpXltF0h_B702npPzBjXjR9t1GVB0M8, EstimatedImpact: 5% 2026-10-01T07:39:46.261 ProcessImageName: python.exe, Pid: 1324, TotalTime: 240, Count: 24, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: powershell.exe, Pid: 356, TotalTime: 231, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 56% 2026-10-01T07:39:46.261 ProcessImageName: WmiPrvSE.exe, Pid: 3052, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-10-01T07:39:46.261 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 122, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: httpd.exe, Pid: 1564, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-vhosts.conf, EstimatedImpact: 74% 2026-10-01T07:39:46.261 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 90, Count: 13, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\DOMAIN.TAB, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: httpd.exe, Pid: 2468, TotalTime: 90, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\mime.types, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: cmd.exe, Pid: 5768, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\dumpalldatabases.bat, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: taskhostw.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-10-01T07:39:46.261 ProcessImageName: DeviceCensus.exe, Pid: 7880, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-10-01T07:39:46.261 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: ngentask.exe, Pid: 2976, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-10-01T07:39:46.261 ProcessImageName: taskhostw.exe, Pid: 6572, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-10-01T07:39:46.261 ProcessImageName: mysqldump.exe, Pid: 4836, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload_all_db_backups.bat, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: svchost.exe, Pid: 2544, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: cmd.exe, Pid: 7928, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: powershell.exe, Pid: 6056, TotalTime: 15, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDF09.tmp, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: powershell.exe, Pid: 3384, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp7E54.tmp, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 0, Count: 4, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-10-01T07:39:46.261 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-10-01T07:43:48.810 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T07:52:50.250 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T07:52:50.250 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T07:52:50.250 [Cloud] Queued cloud request. 2026-10-01T07:52:50.250 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T07:52:50.250 [Cloud] Dequeued cloud request. 2026-10-01T07:52:50.250 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T07:52:50.547 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{28F70683-9DE9-70AC-5DBA-96E03038ADE0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 07:52:50 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T07:52:51.047 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T07:55:49.722 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T07:55:49.722 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T07:55:49.722 [Cloud] Queued cloud request. 2026-10-01T07:55:49.722 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T07:55:49.722 [Cloud] Dequeued cloud request. 2026-10-01T07:55:49.722 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T07:55:49.925 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{38E2D598-86E9-423A-6C5D-3CC32871DC3C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 07:55:49 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T07:55:50.441 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T07:58:53.817 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T08:02:25.583 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T08:02:25.583 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T08:02:25.583 [Cloud] Queued cloud request. 2026-10-01T08:02:25.583 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T08:02:25.583 [Cloud] Dequeued cloud request. 2026-10-01T08:02:25.583 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T08:02:25.817 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EC425CC1-0D58-3FFC-9719-033FAB8B463B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 08:02:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T08:02:26.333 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e 2026-10-01T08:03:42.505 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T08:03:42.505 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T08:03:42.505 [Cloud] Queued cloud request. 2026-10-01T08:03:42.505 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T08:03:42.505 [Cloud] Dequeued cloud request. 2026-10-01T08:03:42.505 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T08:03:45.021 [Cloud] End of cloud request. 2026-10-01T08:03:45.021 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40070000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7 2026-10-01T08:03:45.036 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T08:03:45.036 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T08:03:45.036 [Cloud] Queued cloud request. 2026-10-01T08:03:45.036 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T08:03:45.036 [Cloud] Dequeued cloud request. 2026-10-01T08:03:45.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T08:03:45.302 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-10-01T08:03:45.302 [Cloud] End of cloud request. 2026-10-01T08:03:45.536 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T08:06:50.336 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2ee9a-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6125533, FileId: 0xf00000002434d, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:06:50.336 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2ee9a-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6125534, FileId: 0x1000000002434c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:06:52.508 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T08:06:52.508 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T08:06:52.508 [Cloud] Queued cloud request. 2026-10-01T08:06:52.508 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T08:06:52.508 [Cloud] Dequeued cloud request. 2026-10-01T08:06:52.508 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T08:06:52.789 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C3D1991B-C3B3-7083-E8C9-61320458A461} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 08:06:52 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T08:06:53.289 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T08:07:11.617 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2eea7-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6125659, FileId: 0x12000000024536, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:07:11.617 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2eea7-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6125660, FileId: 0x1000000002434e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:08:23.696 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2eebb-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6126875, FileId: 0x14000000024582, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:08:23.696 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2eebb-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6126876, FileId: 0x16000000024581, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:08:23.696 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2eebc-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6126877, FileId: 0x310000000245d9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:08:23.696 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2eebc-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6126878, FileId: 0x12000000024583, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:08:23.759 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2eebd-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6126882, FileId: 0x15000000024582, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:08:23.759 [RTP] [Mini-filter] Unsuccessful scan status(#27): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2eebd-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6126883, FileId: 0x17000000024581, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:08:23.884 [RTP] [Mini-filter] Unsuccessful scan status(#28): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2eebe-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6126886, FileId: 0x16000000024582, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:08:23.884 [RTP] [Mini-filter] Unsuccessful scan status(#29): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2eebe-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6126887, FileId: 0x18000000024581, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:08:23.900 [RTP] [Mini-filter] Unsuccessful scan status(#30): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2eebf-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6126890, FileId: 0x17000000024582, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:08:23.900 [RTP] [Mini-filter] Unsuccessful scan status(#31): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2eebf-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6126891, FileId: 0x19000000024581, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:12:56.370 [RTP] [Mini-filter] Unsuccessful scan status(#32): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2efbc-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6129246, FileId: 0x170000000266b9, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:12:56.370 [RTP] [Mini-filter] Unsuccessful scan status(#33): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2efbc-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6129247, FileId: 0x13000000026606, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:13:58.823 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T08:14:32.057 [RTP] [Mini-filter] Unsuccessful scan status(#34): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2efe9-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6129772, FileId: 0x1a00000002719c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:14:32.057 [RTP] [Mini-filter] Unsuccessful scan status(#35): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2efe9-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6129773, FileId: 0x2b000000027031, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:15:08.604 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T08:15:08.604 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T08:15:08.604 [Cloud] Queued cloud request. 2026-10-01T08:15:08.604 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T08:15:08.604 [Cloud] Dequeued cloud request. 2026-10-01T08:15:08.604 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T08:15:08.995 [Cloud] End of cloud request. 2026-10-01T08:15:09.495 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T08:29:03.831 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T08:36:04.973 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T08:36:04.973 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T08:36:04.973 [Cloud] Queued cloud request. 2026-10-01T08:36:04.973 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T08:36:04.973 [Cloud] Dequeued cloud request. 2026-10-01T08:36:04.973 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T08:36:05.129 [Cloud] End of cloud request. 2026-10-01T08:36:05.629 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T08:44:08.837 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T08:44:54.915 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T08:44:54.915 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T08:44:54.915 [Cloud] Queued cloud request. 2026-10-01T08:44:54.915 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T08:44:55.071 [Cloud] Dequeued cloud request. 2026-10-01T08:44:55.071 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T08:44:55.212 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BDC96474-9391-AC98-F5FD-96C9FC14D125} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 08:44:55 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T08:44:55.728 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x56d96c17 2026-10-01T08:49:33.887 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpMyAdmin\tbl_changer.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x3329faf726b1 BEGIN BM telemetry GUID:{3581FD6D-FF78-27FE-8831-9FC15892D5CB} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:10-01-2026 08:49:36 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T08:49:37.200 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T08:49:37.200 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T08:49:37.200 [Cloud] Queued cloud request. 2026-10-01T08:49:37.200 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T08:49:37.200 [Cloud] Dequeued cloud request. 2026-10-01T08:49:37.215 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T08:49:37.387 [Cloud] End of cloud request. 2026-10-01T08:49:37.903 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T08:49:47.231 [RTP] [Mini-filter] Unsuccessful scan status(#37): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2f140-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6142085, FileId: 0x2d000000029cf8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:49:47.231 [RTP] [Mini-filter] Unsuccessful scan status(#36): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2f140-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6142084, FileId: 0x1f000000029d20, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:51:01.965 [RTP] [Mini-filter] Unsuccessful scan status(#39): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2f1a1-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6142625, FileId: 0x7000000007d6f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:51:01.965 [RTP] [Mini-filter] Unsuccessful scan status(#38): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2f1a1-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6142624, FileId: 0x500000000809b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T08:59:13.845 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T09:04:12.925 [RTP] [Mini-filter] Unsuccessful scan status(#40): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2fbe2-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6149610, FileId: 0x2e00000002aef7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:04:12.925 [RTP] [Mini-filter] Unsuccessful scan status(#41): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2fbe2-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6149611, FileId: 0x2500000002ae79, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:04:57.957 [RTP] [Mini-filter] Unsuccessful scan status(#42): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2fc0f-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6149867, FileId: 0x3900000002af7f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:04:57.957 [RTP] [Mini-filter] Unsuccessful scan status(#43): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2fc0f-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6149868, FileId: 0x2f00000002aef7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:14:18.851 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T09:14:59.883 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T09:14:59.883 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T09:14:59.883 [Cloud] Queued cloud request. 2026-10-01T09:14:59.883 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T09:14:59.883 [Cloud] Dequeued cloud request. 2026-10-01T09:14:59.883 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T09:15:00.055 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0B51755B-469E-8E7A-C3AC-1C77087AC342} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 09:15:00 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T09:15:00.570 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T09:16:14.806 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T09:16:14.806 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T09:16:14.806 [Cloud] Queued cloud request. 2026-10-01T09:16:14.806 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T09:16:14.806 [Cloud] Dequeued cloud request. 2026-10-01T09:16:14.806 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T09:16:14.978 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{EB2D47F4-5B99-BD70-87BD-DDF0CF35B3DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 09:16:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T09:16:15.494 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T09:21:05.152 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T09:21:05.152 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T09:21:05.152 [Cloud] Queued cloud request. 2026-10-01T09:21:05.152 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T09:21:05.152 [Cloud] Dequeued cloud request. 2026-10-01T09:21:05.152 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T09:21:05.449 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{3184A18B-D7F9-E689-BEAB-3B2E7461D03D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 09:21:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T09:21:05.949 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T09:25:17.387 Bm signature throttled:0x000135b39c9104ce 2026-10-01T09:29:23.860 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T09:33:30.502 [RTP] [Mini-filter] Unsuccessful scan status(#45): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161932, FileId: 0x4100000002ceba, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.502 [RTP] [Mini-filter] Unsuccessful scan status(#44): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161931, FileId: 0x1b00000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#46): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-3.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161935, FileId: 0x1c00000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#47): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-3.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161936, FileId: 0x4200000002ceba, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#48): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-5.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161953, FileId: 0x4300000002ceba, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#50): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-7.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161955, FileId: 0x4400000002ceba, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#51): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-9.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161957, FileId: 0x4500000002ceba, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#49): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-7.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161954, FileId: 0x1e00000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#52): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161960, FileId: 0x4600000002ceba, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#55): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161963, FileId: 0x2200000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#54): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161962, FileId: 0x4700000002ceba, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#56): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-5.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161941, FileId: 0x1d00000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#53): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161961, FileId: 0x2100000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#58): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161958, FileId: 0x2000000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#59): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161964, FileId: 0x4800000002ceba, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#57): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-9.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161956, FileId: 0x1f00000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#61): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-11.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161966, FileId: 0x4900000002ceba, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:33:30.642 [RTP] [Mini-filter] Unsuccessful scan status(#60): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3007e-11.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6161965, FileId: 0x2300000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:36:31.643 [RTP] [Mini-filter] Unsuccessful scan status(#63): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30129-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6163232, FileId: 0x2b00000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:36:31.643 [RTP] [Mini-filter] Unsuccessful scan status(#62): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30129-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6163231, FileId: 0x2c00000002cf5e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:36:31.815 [RTP] [Mini-filter] Unsuccessful scan status(#64): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3012a-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6163236, FileId: 0x2d00000002cf5e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:36:31.815 [RTP] [Mini-filter] Unsuccessful scan status(#65): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3012a-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6163237, FileId: 0x2c00000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:36:31.987 [RTP] [Mini-filter] Unsuccessful scan status(#66): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3012b-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6163242, FileId: 0x2e00000002cf5e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:36:31.987 [RTP] [Mini-filter] Unsuccessful scan status(#67): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3012b-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6163243, FileId: 0x2d00000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:36:32.721 [RTP] [Mini-filter] Unsuccessful scan status(#69): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3012c-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6163249, FileId: 0x2e00000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:36:32.721 [RTP] [Mini-filter] Unsuccessful scan status(#68): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3012c-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6163248, FileId: 0x2f00000002cf5e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:36:32.799 [RTP] [Mini-filter] Unsuccessful scan status(#70): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3012d-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6163253, FileId: 0x3000000002cf5e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:36:32.799 [RTP] [Mini-filter] Unsuccessful scan status(#71): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3012d-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6163254, FileId: 0x2f00000002cf3e, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:38:27.989 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T09:38:27.989 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T09:38:27.989 [Cloud] Queued cloud request. 2026-10-01T09:38:27.989 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T09:38:27.989 [Cloud] Dequeued cloud request. 2026-10-01T09:38:27.989 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T09:38:28.145 [Cloud] End of cloud request. 2026-10-01T09:38:28.661 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T09:39:46.333 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 439989, Count: 37743, MaxTime: 1343, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15625, Count: 2458, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\030941ED6FBB4D6582169DC496570F50.MAI, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 9605, Count: 992, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\832793BC1E4E4EA991003CEB936DE6B2.MAI, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: AgentShell.exe, Pid: 6132, TotalTime: 9213, Count: 790, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 6524, Count: 530, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 1996, Count: 7018, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6f7-2.MAI, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: powershell.exe, Pid: 3420, TotalTime: 1509, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-10-01T09:39:46.333 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 1366, Count: 282, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_A48F9458D0AB48E98C4F26C8B66D27E8.MAI, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: php.exe, Pid: 732, TotalTime: 846, Count: 20, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 29% 2026-10-01T09:39:46.333 ProcessImageName: AgentShellService.exe, Pid: 6036, TotalTime: 775, Count: 27, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Newtonsoft.Json.dll, EstimatedImpact: 50% 2026-10-01T09:39:46.333 ProcessImageName: WmiPrvSE.exe, Pid: 6896, TotalTime: 661, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\pacer.sys, EstimatedImpact: 5% 2026-10-01T09:39:46.333 ProcessImageName: svchost.exe, Pid: 1600, TotalTime: 497, Count: 35, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Windows Media Player\wmpnscfg.exe, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: httpd.exe, Pid: 7812, TotalTime: 315, Count: 36, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Certbot\webroot\.well-known\acme-challenge\rryzTqXIVv-idpXltF0h_B702npPzBjXjR9t1GVB0M8, EstimatedImpact: 5% 2026-10-01T09:39:46.333 ProcessImageName: python.exe, Pid: 1324, TotalTime: 240, Count: 24, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\Certbot\Python\python39._pth, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: powershell.exe, Pid: 356, TotalTime: 231, Count: 23, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 56% 2026-10-01T09:39:46.333 ProcessImageName: WmiPrvSE.exe, Pid: 3052, TotalTime: 185, Count: 5, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\acpi.sys, EstimatedImpact: 100% 2026-10-01T09:39:46.333 ProcessImageName: AggregatorHost.exe, Pid: 4608, TotalTime: 122, Count: 7, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: httpd.exe, Pid: 1564, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\extra\httpd-vhosts.conf, EstimatedImpact: 74% 2026-10-01T09:39:46.333 ProcessImageName: httpd.exe, Pid: 2468, TotalTime: 90, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Apache24\conf\mime.types, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: taskhostw.exe, Pid: 356, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\usbport.sys, EstimatedImpact: 7% 2026-10-01T09:39:46.333 ProcessImageName: cmd.exe, Pid: 5768, TotalTime: 61, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\dumpalldatabases.bat, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: DeviceCensus.exe, Pid: 7880, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx, EstimatedImpact: 6% 2026-10-01T09:39:46.333 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 46, Count: 2, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WinMgmtR.dll, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: ngentask.exe, Pid: 2976, TotalTime: 31, Count: 5, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config, EstimatedImpact: 22% 2026-10-01T09:39:46.333 ProcessImageName: taskhostw.exe, Pid: 6572, TotalTime: 31, Count: 3, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config, EstimatedImpact: 16% 2026-10-01T09:39:46.333 ProcessImageName: mysqldump.exe, Pid: 4836, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\my.ini, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: cmd.exe, Pid: 1296, TotalTime: 30, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload_all_db_backups.bat, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: svchost.exe, Pid: 2544, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\DiagTrack\utc.allow.diffbase, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: cmd.exe, Pid: 7928, TotalTime: 30, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\ftpupload.bat, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: powershell.exe, Pid: 6056, TotalTime: 15, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmpDF09.tmp, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: powershell.exe, Pid: 3384, TotalTime: 15, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\SystemTemp\tmp7E54.tmp, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: dllhost.exe, Pid: 4244, TotalTime: 0, Count: 4, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-10-01T09:39:46.333 ProcessImageName: svchost.exe, Pid: 2228, TotalTime: 0, Count: 2, MaxTime: 0, MaxTimeFile: \Device\HarddiskVolume2\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_9cbdca91-13b5-438f-bae8-03752a62f6a9, EstimatedImpact: 0% 2026-10-01T09:41:28.521 [RTP] [Mini-filter] Unsuccessful scan status(#72): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30188-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6167102, FileId: 0x2b00000002e14f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:41:28.521 [RTP] [Mini-filter] Unsuccessful scan status(#73): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30188-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6167103, FileId: 0x4200000002db55, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:41:46.521 [RTP] [Mini-filter] Unsuccessful scan status(#74): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3018d-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6167209, FileId: 0x2c00000002e14f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:41:46.521 [RTP] [Mini-filter] Unsuccessful scan status(#75): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3018d-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6167210, FileId: 0x4300000002db55, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:42:01.349 [RTP] [Mini-filter] Unsuccessful scan status(#76): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30195-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6167292, FileId: 0x2d00000002e14f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:42:01.349 [RTP] [Mini-filter] Unsuccessful scan status(#77): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30195-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6167293, FileId: 0x4400000002db55, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:42:04.349 [RTP] [Mini-filter] Unsuccessful scan status(#78): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30198-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6167313, FileId: 0x2e00000002e14f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:42:04.349 [RTP] [Mini-filter] Unsuccessful scan status(#79): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30198-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6167314, FileId: 0x4500000002db55, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:43:57.896 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T09:43:57.896 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T09:43:57.896 [Cloud] Queued cloud request. 2026-10-01T09:43:57.896 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T09:43:57.896 [Cloud] Dequeued cloud request. 2026-10-01T09:43:57.896 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T09:43:58.052 [Cloud] End of cloud request. 2026-10-01T09:43:58.552 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T09:44:28.864 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T09:44:47.786 [RTP] [Mini-filter] Unsuccessful scan status(#80): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168881, FileId: 0xc7000000030b6b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.786 [RTP] [Mini-filter] Unsuccessful scan status(#81): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168882, FileId: 0x2200000003096c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.786 [RTP] [Mini-filter] Unsuccessful scan status(#82): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-3.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168885, FileId: 0xc8000000030b6b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.786 [RTP] [Mini-filter] Unsuccessful scan status(#83): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-3.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168886, FileId: 0x2300000003096c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.802 [RTP] [Mini-filter] Unsuccessful scan status(#84): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-5.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168889, FileId: 0xc9000000030b6b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.802 [RTP] [Mini-filter] Unsuccessful scan status(#85): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-5.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168890, FileId: 0x2400000003096c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.802 [RTP] [Mini-filter] Unsuccessful scan status(#86): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-7.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168893, FileId: 0xca000000030b6b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.802 [RTP] [Mini-filter] Unsuccessful scan status(#87): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-7.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168894, FileId: 0x2500000003096c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.818 [RTP] [Mini-filter] Unsuccessful scan status(#88): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-9.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168897, FileId: 0xcb000000030b6b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.818 [RTP] [Mini-filter] Unsuccessful scan status(#89): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-9.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168898, FileId: 0x2600000003096c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.818 [RTP] [Mini-filter] Unsuccessful scan status(#90): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-b.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168901, FileId: 0xcc000000030b6b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.818 [RTP] [Mini-filter] Unsuccessful scan status(#91): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-b.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168902, FileId: 0x2700000003096c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.833 [RTP] [Mini-filter] Unsuccessful scan status(#92): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168905, FileId: 0xcd000000030b6b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.833 [RTP] [Mini-filter] Unsuccessful scan status(#93): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-d.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168906, FileId: 0x2800000003096c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.833 [RTP] [Mini-filter] Unsuccessful scan status(#94): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168909, FileId: 0xce000000030b6b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.833 [RTP] [Mini-filter] Unsuccessful scan status(#95): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168910, FileId: 0x2900000003096c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.833 [RTP] [Mini-filter] Unsuccessful scan status(#96): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-11.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168913, FileId: 0xcf000000030b6b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:44:47.833 [RTP] [Mini-filter] Unsuccessful scan status(#97): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302af-11.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6168914, FileId: 0x2a00000003096c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:45:14.975 [RTP] [Mini-filter] Unsuccessful scan status(#98): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302b3-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6169183, FileId: 0xd2000000030b6b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:45:14.975 [RTP] [Mini-filter] Unsuccessful scan status(#99): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302b3-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6169184, FileId: 0x3400000003096c, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:45:14.991 [RTP] [Mini-filter] Unsuccessful scan status(#100): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302b3-3.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6169187, FileId: 0xd3000000030b6b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:45:15.022 [RTP] [Mini-filter] Unsuccessful scan status(#110): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-302b3-d.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6169207, FileId: 0xd8000000030b6b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T09:59:33.873 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T10:00:29.952 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T10:00:29.952 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T10:00:29.952 [Cloud] Queued cloud request. 2026-10-01T10:00:29.952 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T10:00:29.952 [Cloud] Dequeued cloud request. 2026-10-01T10:00:29.952 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T10:00:30.170 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{76CE6AA2-E4C2-5974-FAA1-2EF210780C4A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 10:00:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T10:00:30.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T10:09:46.082 Bm signature throttled:0x000135b39c9104ce 2026-10-01T10:12:33.396 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T10:12:33.396 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T10:12:33.396 [Cloud] Queued cloud request. 2026-10-01T10:12:33.396 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T10:12:33.396 [Cloud] Dequeued cloud request. 2026-10-01T10:12:33.396 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T10:12:33.693 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{648EF6DE-7F31-C754-4E64-B79D04C6386B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 10:12:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T10:12:34.209 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T10:14:38.881 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T10:18:10.962 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T10:18:10.962 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T10:18:10.962 [Cloud] Queued cloud request. 2026-10-01T10:18:10.962 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T10:18:10.962 [Cloud] Dequeued cloud request. 2026-10-01T10:18:10.962 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T10:18:11.118 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A1269466-E186-2E3D-D0DA-ED4588853E9A} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 10:18:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T10:18:11.618 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T10:18:16.337 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T10:18:16.337 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T10:18:16.337 [Cloud] Queued cloud request. 2026-10-01T10:18:16.337 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T10:18:16.337 [Cloud] Dequeued cloud request. 2026-10-01T10:18:16.337 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T10:18:16.446 [Cloud] End of cloud request. 2026-10-01T10:18:16.946 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T10:29:43.889 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T10:29:53.264 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T10:29:53.264 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T10:29:53.264 [Cloud] Queued cloud request. 2026-10-01T10:29:53.264 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T10:29:53.264 [Cloud] Dequeued cloud request. 2026-10-01T10:29:53.264 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T10:29:53.436 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FB4EF817-FD51-1D88-DDAD-319C0AE2FB38} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 10:29:53 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T10:29:53.936 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T10:37:28.456 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T10:37:28.456 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T10:37:28.456 [Cloud] Queued cloud request. 2026-10-01T10:37:28.456 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T10:37:28.456 [Cloud] Dequeued cloud request. 2026-10-01T10:37:28.456 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T10:37:28.628 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{755DC9FB-B02D-E8C1-AA42-87D603E5E1DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 10:37:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T10:37:29.128 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T10:40:13.583 [RTP] [Mini-filter] Unsuccessful scan status(#120): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-306b8-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6189827, FileId: 0x2e000000033dc8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T10:44:48.895 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T10:46:42.288 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T10:46:42.288 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T10:46:42.288 [Cloud] Queued cloud request. 2026-10-01T10:46:42.288 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T10:46:42.288 [Cloud] Dequeued cloud request. 2026-10-01T10:46:42.288 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T10:46:42.742 [Cloud] End of cloud request. 2026-10-01T10:46:43.242 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T10:46:47.176 ReportLowfi(ctfmon.exe, 0x437a0835) from 0x0006b6bd6566d2d9 2026-10-01T10:46:51.293 Engine:Triggered SMS scan for filename: explorer.exe, pid: 6884, sigseq: 0x65B3BACFC721, origin: signature, sendMemoryScanReport: 0 2026-10-01T10:58:25.188 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T10:58:25.188 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T10:58:25.188 [Cloud] Queued cloud request. 2026-10-01T10:58:25.188 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T10:58:25.188 [Cloud] Dequeued cloud request. 2026-10-01T10:58:25.188 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T10:58:25.391 [Cloud] End of cloud request. 2026-10-01T10:58:25.907 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T10:59:53.907 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T11:00:07.657 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:00:07.657 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:00:07.657 [Cloud] Queued cloud request. 2026-10-01T11:00:07.657 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:00:07.657 [Cloud] Dequeued cloud request. 2026-10-01T11:00:07.657 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:00:08.751 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{929B3918-ABF8-09AB-BF1A-25765FDC832D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 11:00:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T11:00:09.251 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:00:13.954 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:00:13.954 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:00:13.954 [Cloud] Queued cloud request. 2026-10-01T11:00:13.954 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:00:13.954 [Cloud] Dequeued cloud request. 2026-10-01T11:00:13.954 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:00:14.798 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A83F0765-3E52-2143-71B0-5AD7FE92E56E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 11:00:14 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T11:00:15.313 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:02:01.985 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:02:01.985 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:02:01.985 [Cloud] Queued cloud request. 2026-10-01T11:02:01.985 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:02:01.985 [Cloud] Dequeued cloud request. 2026-10-01T11:02:01.985 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:02:02.204 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6F5AB5E2-C17B-3EAE-2A83-A45946E2C787} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 11:02:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T11:02:02.720 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:05:35.036 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:05:35.036 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:05:35.036 [Cloud] Queued cloud request. 2026-10-01T11:05:35.036 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:05:35.036 [Cloud] Dequeued cloud request. 2026-10-01T11:05:35.036 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:05:35.364 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{79D441AC-3797-AEC1-880E-EC071FF2E5ED} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 11:05:35 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T11:05:35.879 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{E3BFFFA2-02CE-8A3E-11D9-9D8AA5D8A4B0} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:10-01-2026 11:09:59 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T11:10:00.475 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:10:00.475 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:10:00.475 [Cloud] Queued cloud request. 2026-10-01T11:10:00.475 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:10:00.475 [Cloud] Dequeued cloud request. 2026-10-01T11:10:00.475 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:10:00.865 [Cloud] End of cloud request. 2026-10-01T11:10:01.475 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:11:33.959 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\9855DD12-6000-4133-8E3A-BF93B147566D27fc.1dd51959c20ba19 2026-10-01T11:11:34.053 Verifying engine and signature files (source: 0) ... 2026-10-01T11:11:34.053 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpengine.dll] due to PPL. 2026-10-01T11:11:34.053 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpasbase.vdm]. File not in cache (0x1) 2026-10-01T11:11:34.990 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpasbase.vdm] 2026-10-01T11:11:34.990 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpasdlta.vdm]. File not in cache (0x1) 2026-10-01T11:11:35.053 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpasdlta.vdm] 2026-10-01T11:11:35.053 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpavbase.vdm]. File not in cache (0x1) 2026-10-01T11:11:35.475 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpavbase.vdm] 2026-10-01T11:11:35.475 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpavdlta.vdm]. File not in cache (0x1) 2026-10-01T11:11:35.506 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpavdlta.vdm] 2026-10-01T11:11:35.725 [Engine] IsHybridMode: 0 2026-10-01T11:11:35.725 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-10-01T11:11:35.725 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-F298A3766F69C923BBCBD2D52B5EA538542A2B2E.bin): 0x00000002 2026-10-01T11:11:35.740 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-F298A3766F69C923BBCBD2D52B5EA538542A2B2E.bin) 2026-10-01T11:11:35.740 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-10-01T11:11:35.740 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-10-01T11:11:35.740 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-10-01T11:11:35.740 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-10-01T11:11:52.193 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-10-01T11:11:52.193 [AutoExclusion] Applied roles from cache. 2026-10-01T11:11:52.193 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-10-01T11:11:52.350 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFCF4ABB020, lRefCount: 6, hr=0 2026-10-01T11:11:52.350 [Engine] New active engine 00007FFCE5A0B020 replacing engine 00007FFCF4ABB020. Number of active engines: 2 2026-10-01T11:11:52.365 EngineInit:Global ASOC is enabled 2026-10-01T11:11:52.365 EngineInit:ASOO is enabled for developer volumes 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.490 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T11:11:52.553 MpWriteUupSignatureVersion 1.459.491.0, hr = 0 2026-10-01T11:11:52.553 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-10-01T11:11:52.615 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-10-01T11:11:52.615 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-10-01T11:11:52.615 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-10-01T11:11:52.615 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-10-01T11:11:52.646 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-10-01T11:11:52.646 [Plugin] Initializing RTP plugin state... 2026-10-01T11:11:52.646 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-10-01T11:11:52.646 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎09‎-‎30‎-‎2026 21:39:46 Last Perf:‎09‎-‎30‎-‎2026 21:39:46 First RTP Scan:‎09‎-‎30‎-‎2026 21:39:46 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:17012 Misses:44328 BM Queue:0,559,0 Proc:0,548,0 File:0,246,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:2,3,0 SetEngine:1,1,0 SetState:1,1,0 SetUser:0,1,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:6204813 Pending:1 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:1532354476 AsyncQCurrent:0 BMFlags:40095 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:16558 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:624855 TotalHits:3704884 InstanceCacheInserts:107094 InstanceCacheUpdates:0 InstanceCacheDeletes:23381 InstanceCacheHits:26058 InstanceCacheMisses:492621 InstanceCacheOverflows:49463 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:6ms (9719/1439) Success: 1439, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-10-01T11:11:52.646 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-10-01T11:11:52.662 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89} 2026-10-01T11:11:52.662 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{175DE9CC-8248-4866-9A87-A84BF23BCC37} removed 2026-10-01T11:11:52.662 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1}\mpasbase.vdm in use, hr=0x80070020 2026-10-01T11:11:52.662 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-10-01T11:11:52.662 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-10-01T11:11:52.662 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-10-01T11:11:52.662 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-10-01T11:11:52.662 MdCoreSvc is supported in this platform and OS Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:10-01-2026 11:11:52 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:10-01-2026 11:11:52 2026-10-01T11:11:52.678 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-10-01T11:11:52.678 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-10-01T11:11:52.678 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-10-01T11:11:52.678 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-10-01T11:11:52.693 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:11:52.693 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-10-01T11:11:52.693 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-10-01T11:11:52.693 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-10-01T11:11:52.693 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-10-01T11:11:52.693 MdCoreSvc is supported in this platform and OS Signature updated on 10-01-2026 11:11:52 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.491.0 AV Signature Version: 1.459.491.0 ************************************************************ 2026-10-01T11:11:52.740 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-10-01T11:11:52.740 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\9855DD12-6000-4133-8E3A-BF93B147566D27fc.1dd51959c20ba19 2026-10-01T11:11:52.787 Process scan (postsignatureupdatescan) started. 2026-10-01T11:11:52.803 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-10-01T11:11:52.827 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 2026-10-01T11:11:53.068 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-10-01T11:11:53.068 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-10-01T11:11:53.068 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-10-01T11:11:53.178 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-10-01T11:11:53.178 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-10-01T11:11:53.178 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-10-01T11:11:53.178 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-10-01T11:11:53.178 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-10-01T11:11:53.225 [Engine] Engine 00007FFCF4ABB020 no longer in use. Number of active engines: 1 2026-10-01T11:11:53.225 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-10-01T11:11:53.225 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-10-01T11:11:53.740 ProcessImageName: httpd.exe, Pid: 5028, TotalTime: 596881, Count: 49693, MaxTime: 1343, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 1% 2026-10-01T11:11:53.740 ProcessImageName: MESMTPC.exe, Pid: 2892, TotalTime: 15746, Count: 2468, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Outgoing\030941ED6FBB4D6582169DC496570F50.MAI, EstimatedImpact: 0% 2026-10-01T11:11:53.740 ProcessImageName: AgentShell.exe, Pid: 6132, TotalTime: 10913, Count: 924, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Microsoft.Win32.TaskScheduler.dll, EstimatedImpact: 0% 2026-10-01T11:11:53.740 ProcessImageName: MEMTA.exe, Pid: 2828, TotalTime: 9620, Count: 994, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SMTP\Inbound\Messages\832793BC1E4E4EA991003CEB936DE6B2.MAI, EstimatedImpact: 0% 2026-10-01T11:11:53.740 ProcessImageName: AgentShell.exe, Pid: 5808, TotalTime: 6524, Count: 530, MaxTime: 109, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-10-01T11:11:53.740 ProcessImageName: Windows-KB890830-x64-V5.145.exe, Pid: 2284, TotalTime: 5030, Count: 2, MaxTime: 3296, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\MRT.exe, EstimatedImpact: 82% 2026-10-01T11:11:53.740 ProcessImageName: mysqld.exe, Pid: 2992, TotalTime: 2132, Count: 7070, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\SERVIC~1\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-2d6f7-2.MAI, EstimatedImpact: 0% 2026-10-01T11:11:53.740 ProcessImageName: powershell.exe, Pid: 3420, TotalTime: 1509, Count: 107, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 35% 2026-10-01T11:11:53.740 ProcessImageName: MEPOC.exe, Pid: 2844, TotalTime: 1411, Count: 290, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Queues\SF\Outgoing\Messages\_A48F9458D0AB48E98C4F26C8B66D27E8.MAI, EstimatedImpact: 0% 2026-10-01T11:11:53.740 ProcessImageName: RuntimeBroker.exe, Pid: 3196, TotalTime: 1311, Count: 7, MaxTime: 453, MaxTimeFile: \Device\HarddiskVolume2\Program Files\FileZilla FTP Client\filezilla.exe, EstimatedImpact: 1% 2026-10-01T11:11:53.740 ProcessImageName: explorer.exe, Pid: 6884, TotalTime: 1069, Count: 70, MaxTime: 265, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe, EstimatedImpact: 0% 2026-10-01T11:11:53.740 ProcessImageName: sdiagnhost.exe, Pid: 9448, TotalTime: 863, Count: 44, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\863251a448ec27990cea3f9420e05809\System.Management.Automation.ni.dll, EstimatedImpact: 16% 2026-10-01T11:11:53.740 ProcessImageName: php.exe, Pid: 732, TotalTime: 846, Count: 20, MaxTime: 171, MaxTimeFile: \Device\HarddiskVolume2\PHP53\libeay32.dll, EstimatedImpact: 29% 2026-10-01T11:11:53.740 ProcessImageName: AgentShellSystemTray.exe, Pid: 6364, TotalTime: 816, Count: 46, MaxTime: 203, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\Quartz.dll, EstimatedImpact: 28% 2026-10-01T11:11:53.740 ProcessImageName: WmiPrvSE.exe, Pid: 1472, TotalTime: 787, Count: 20, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\win32kbase.sys, EstimatedImpact: 29% 2026-10-01T11:11:53.803 [Engine] RSIG_UNLOADENGINE, 00007FFCF4ABB020, err=0x0 2026-10-01T11:11:53.834 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{332C4E85-0C97-4EE0-A496-59BD1FC33CA1} removed 2026-10-01T11:12:15.396 Process scan (postsignatureupdatescan) completed. BEGIN BM telemetry GUID:{165EF1DA-3D22-8165-2F76-C3780AEFCD7F} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:5028 ProcessCreationTime:134326768258765387 SessionID:0 CreationTime:10-01-2026 11:12:40 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T11:12:41.818 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:12:41.818 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:12:41.818 [Cloud] Queued cloud request. 2026-10-01T11:12:41.818 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:12:41.834 [Cloud] Dequeued cloud request. 2026-10-01T11:12:41.834 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:12:41.959 [Cloud] End of cloud request. 2026-10-01T11:12:42.459 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:14:58.915 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T11:15:05.477 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:15:05.477 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:15:05.477 [Cloud] Queued cloud request. 2026-10-01T11:15:05.477 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:15:05.477 [Cloud] Dequeued cloud request. 2026-10-01T11:15:05.477 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:15:05.665 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2D0C5A00-5829-DE01-33FF-4A644A420C16} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 11:15:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T11:15:06.165 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:16:52.400 [RbM] Setting Last known good engine candidate. hr = 0 2026-10-01T11:18:11.558 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:18:11.558 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:18:11.558 [Cloud] Queued cloud request. 2026-10-01T11:18:11.558 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:18:11.558 [Cloud] Dequeued cloud request. 2026-10-01T11:18:11.558 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:18:11.714 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{9E229198-2505-A189-5CF6-9DA4DFAA5199} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 11:18:11 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T11:18:12.230 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:20:36.464 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:20:36.464 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:20:36.464 [Cloud] Queued cloud request. 2026-10-01T11:20:36.464 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:20:36.620 [Cloud] Dequeued cloud request. 2026-10-01T11:20:36.620 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{85E48329-A0AF-2D0B-F745-65D809653606} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 11:20:36 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T11:20:36.870 [Cloud] End of cloud request. 2026-10-01T11:20:37.386 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:23:13.747 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3097f-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6212417, FileId: 0x1300000002249f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T11:23:13.747 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-3097f-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6212416, FileId: 0xa0000000224af, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x4652e614 2026-10-01T11:23:39.559 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpmyserver\help.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x3329faf726b1 2026-10-01T11:25:14.216 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:25:14.216 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:25:14.216 [Cloud] Queued cloud request. 2026-10-01T11:25:14.216 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:25:14.387 [Cloud] Dequeued cloud request. 2026-10-01T11:25:14.387 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:25:14.575 [Cloud] End of cloud request. 2026-10-01T11:25:15.091 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:26:21.825 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:26:21.825 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:26:21.825 [Cloud] Queued cloud request. 2026-10-01T11:26:21.825 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:26:21.825 [Cloud] Dequeued cloud request. 2026-10-01T11:26:21.825 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:26:21.997 [Cloud] End of cloud request. 2026-10-01T11:26:22.497 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:30:03.922 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T11:31:46.344 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:31:46.344 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:31:46.344 [Cloud] Queued cloud request. 2026-10-01T11:31:46.344 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:31:46.344 [Cloud] Dequeued cloud request. 2026-10-01T11:31:46.344 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:31:46.578 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{0E0A5CB5-24B6-3795-CD62-B9744400793C} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 11:31:46 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T11:31:47.078 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:33:51.860 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:33:51.860 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:33:51.860 [Cloud] Queued cloud request. 2026-10-01T11:33:51.860 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:33:51.860 [Cloud] Dequeued cloud request. 2026-10-01T11:33:51.860 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:33:52.454 [Cloud] End of cloud request. 2026-10-01T11:33:52.954 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:35:15.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:35:15.097 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:35:15.097 [Cloud] Queued cloud request. 2026-10-01T11:35:15.097 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:35:15.097 [Cloud] Dequeued cloud request. 2026-10-01T11:35:15.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:35:15.284 [Cloud] End of cloud request. 2026-10-01T11:35:15.784 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:36:54.144 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:36:54.144 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:36:54.144 [Cloud] Queued cloud request. 2026-10-01T11:36:54.144 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:36:54.144 [Cloud] Dequeued cloud request. 2026-10-01T11:36:54.144 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:36:54.347 [Cloud] End of cloud request. 2026-10-01T11:36:54.847 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:41:04.755 Bm signature throttled:0x000135b39c9104ce Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e 2026-10-01T11:43:14.257 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7 2026-10-01T11:43:14.273 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T11:43:14.273 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T11:43:14.273 [Cloud] Queued cloud request. 2026-10-01T11:43:14.273 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T11:43:14.273 [Cloud] Dequeued cloud request. 2026-10-01T11:43:14.273 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T11:43:14.836 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-10-01T11:43:14.836 [Cloud] End of cloud request. 2026-10-01T11:43:15.351 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T11:45:08.930 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T11:45:22.680 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30b4a-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6222970, FileId: 0xf0000000670b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T11:45:22.680 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30b4a-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6222971, FileId: 0x130000000670b5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T11:45:22.696 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30b4b-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6222975, FileId: 0x140000000670b5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T11:45:22.696 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30b4b-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6222974, FileId: 0x100000000670b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T11:45:37.680 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30b4e-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6223068, FileId: 0x110000000670b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T11:45:37.680 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30b4e-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6223069, FileId: 0x190000000670b5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T11:45:38.399 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30b4f-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6223075, FileId: 0x120000000670b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T11:45:38.399 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30b4f-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6223076, FileId: 0x1a0000000670b5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T11:45:38.665 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30b50-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6223083, FileId: 0x130000000670b7, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T11:45:38.665 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-bb0-30b50-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6223084, FileId: 0x1b0000000670b5, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 -------------------------------------------------------------------------------- Microsoft Defender Antivirus (77BDAF73-B396-481F-9042-AD358843EC24) Service Log Started On 10-01-2026 12:05:03 ************************************************************ OS install time: 01/03/2024 14:58:11.0 UTC Current time: 10/01/2026 12:05:03.879008500 UTC (17703 ms since boot) 2026-10-01T12:05:04.120 MpEnsureProcessMitigationPolicy(0x7) returns 0x1 2026-10-01T12:05:04.120 [HybridMode] isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-10-01T12:05:04.198 ProductId: 2, ProductFeature: 0, LaunchedProtected: 3, IsWcos: 0, IsContainerOs: 0, DirtyShutdownDetected: 0, PassiveRemediation: 0, IsHybridModePolicyEnabled: 0, IsVerifiedAndReputableTrustModeEnabled: 0 2026-10-01T12:05:04.401 [WPP] Starting WPP trace with buffersize 4MB, maxfilesize: 16MB, filename: MpWppTracing-20261001-120504-00000003-fffffffeffffffff.bin ... 2026-10-01T12:05:04.995 [WPP] Trace session started - MpWppTracing-20261001-120504-00000003-fffffffeffffffff.bin 2026-10-01T12:05:05.011 MpReinforceExclusionsAcls from LoadCapability: (hr = 0) 2026-10-01T12:05:05.011 [RbM] Rollback manager succesfully initialized. 2026-10-01T12:05:05.011 [RbM] Rollback manager EnableRollbackManager called. 2026-10-01T12:05:05.026 [RbM] Rollback manager EnableRollbackManager completed. 2026-10-01T12:05:05.026 [PlatUpd] Service launched successfully from: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 2026-10-01T12:05:05.026 MpWriteUupPlatformVersion 4.18.26080.4, hr = 0 2026-10-01T12:05:05.026 [WSC] MpPostPlatformUpdate: Initializing WSC library early on normal platform startup (before MpCheckAndUpdateBinaryLocationTo) 2026-10-01T12:05:05.276 [PlatUpd] Validating and fixing WMI MOF schema - Running command: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe" -RegisterWmiSchema -Root "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0" 2026-10-01T12:05:11.401 [PlatUpd] MpAddMpUxRegistration succeeded 2026-10-01T12:05:11.401 [PlatUpd] MpManagementUpdateHandler: starting update for install path %ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0. 2026-10-01T12:05:11.401 [PlatUpd] MpManagementUpdateHandler: calling MpUpdateManagement() 2026-10-01T12:05:11.401 [PlatUpd] MpUpdateManagement: Management platform update started for components (3) 2026-10-01T12:05:11.401 [PlatUpd] Defender MDM CSP platform update not supported on Server SKUs 2026-10-01T12:05:11.401 [PlatUpd] WMI/PS provider platform update started 2026-10-01T12:05:11.401 [PlatUpd] WMI/PS provider platform update not required 2026-10-01T12:05:11.401 [PlatUpd] MpUpdateManagement: Management platform update completed 2026-10-01T12:05:11.401 [PlatUpd] MpCheckAndUpdateBinaryLocationTo(%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0): 10 items checked, 0 required update. hrMui: 0x1 hrEtw: 0 2026-10-01T12:05:11.417 [TS] Troubleshooting mode is not available! 2026-10-01T12:05:11.417 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: False 2026-10-01T12:05:11.417 CheckProductDisabled(fWaitWSC: 1, fRemoveConfigs: 0) ... 2026-10-01T12:05:11.432 [Service] Enabling IOAV/IEV/ShellExt/EtwLogger registrations ... 2026-10-01T12:05:11.432 [Service] Enabling AutoLoggers ... 2026-10-01T12:05:11.479 DefenderApiLoggerLowPriv started successfully. 2026-10-01T12:05:11.479 [Service] Enabling AMSI registration ... 2026-10-01T12:05:11.479 [Service] Leaving EnableIOAVWorker(1, 0) with hr = 0 2026-10-01T12:05:11.495 Cache C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\654A635C-0000-0000-0000-500600000000-1.bin loaded.**********Cache stats************ No. Of buckets -> 61033 Each Bucket has max capacity of -> 1 entries number of Entries is 44402 Number of invalid entries is 0 Number of inserts issued is 741129 Number of replaces issued is 0 Number of insert failures is 7 Number of inserts with duplicate entries is 3450 Number of lookups is 76602696 Number of lookup misses is 2567461 Number of fast lookup misses is 17525206 Number of false fast lookups is 2567459 Number of invalidations is 398138 Number of maintenance invalidations is 90876 Current File Size is 1499136 Journal ID = 1d864ae105a6246 Trusted image state = 4 USN = 1171c7 Setup boot count = 2 2026-10-01T12:05:11.495 Verifying license file... 2026-10-01T12:05:11.495 Verified [C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\msmplics.dll] (file in cache) 2026-10-01T12:05:11.526 SharedSignatureRoot not configured. Disabling remote image load for msmpeng.exe. Once disabled, it can no longer be enabled without a service restart. hr=0x1 2026-10-01T12:05:11.526 Loaded module#0 MpComServer. 2026-10-01T12:05:11.526 Loaded module#1 StartupPolicies. 2026-10-01T12:05:11.526 Loaded module#2 DefenderBranding. 2026-10-01T12:05:11.526 [SCC][CID=25359_4852] Initializing SCC (phase: PreEngine) 2026-10-01T12:05:11.526 [SCC][CID=25359_4852] Early (pre-engine) SCC init disabled by feature control; deferring to Phase 2 2026-10-01T12:05:11.526 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: False 2026-10-01T12:05:11.526 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 2026-10-01T12:05:11.589 MpRefreshDefenderCoreConfigs: failed because engine is not ready, we cannot let the process continue because we might start core service while its configuration is not ready. 2026-10-01T12:05:11.604 [Plugin] Verifying C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\mprtp.dll ... 2026-10-01T12:05:11.604 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\mprtp.dll] due to PPL. 2026-10-01T12:05:11.604 COM server initialized successfully. 2026-10-01T12:05:11.620 [RTP] [RTP] FilterCommunicator object 0x00000158B68D60F0 initialized (\MicrosoftMalwareProtectionAsyncPortWD, , ), threads: 0 normal, 0 very low, 0 alt, thread pool threads: 4 normal, 0 very low, 0 alt 2026-10-01T12:05:11.620 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-10-01T12:05:11.620 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-10-01T12:05:11.620 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-10-01T12:05:11.620 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-10-01T12:05:11.620 [RTP] Setting RegLinkHardeningMode to 0 (hr=0). 2026-10-01T12:05:11.745 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-10-01T12:05:11.745 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-10-01T12:05:11.745 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-10-01T12:05:11.745 [RTP] Setting PreventPagingFileAbuse to 1 (hr=0). 2026-10-01T12:05:11.745 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-10-01T12:05:11.745 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-10-01T12:05:11.745 [RTP] [RTP] FilterCommunicator object 0x00000158B68D62F0 initialized (\MicrosoftMalwareProtectionPortWD, \MicrosoftMalwareProtectionVeryLowIoPortWD, \MicrosoftMalwareProtectionRemoteIoPortWD), threads: 6 normal, 2 very low, 0 alt, thread pool threads: 0 normal, 0 very low, 6 alt 2026-10-01T12:05:11.745 [RTP] SyncDssAvailableThreads cap limit initialized by MiscConfig to: 14 2026-10-01T12:05:11.745 [RTP] [RtpCopyAccelerator] Windows19H1 1, WindowsCobalt 0, IsServerSKU 1, IsPassiveOrSideBySidePassiveMode 0, IsDevMode 0, fIsWindowsInhouseBuild 0, BuildLabEx 20348.1.amd64fre.fe_release.210507-1500 2026-10-01T12:05:11.745 [RTP] [RTP] StartCommunication 0x00000158B68D60F0 (\MicrosoftMalwareProtectionAsyncPortWD, ), threads: 0 normal, 0 very low, 0 alt, thread pool threads: 4 normal, 0 very low, 0 alt 2026-10-01T12:05:11.745 [init][RTP] RTPPlugin initialization completed 2026-10-01T12:05:11.745 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\mpnirtp.dll] due to PPL. 2026-10-01T12:05:11.776 [RTP] [NiRTP] CNiRtpPlugin::Initialize completed successfully 2026-10-01T12:05:11.776 [init][NiRTP] NiRTPPlugin initialization completed 2026-10-01T12:05:11.776 OS boot count = 2 2026-10-01T12:05:11.776 OS Install = 0 2026-10-01T12:05:11.839 [ManagedAgent] HooksInitialize: skipped (unsupported platform) 2026-10-01T12:05:11.854 [init] MpAddMpUxRegistrationForToast failed (Ignored). hr = 0x8000401a 2026-10-01T12:05:11.970 [KSL] Entering CKSLEngine::Initialize. 2026-10-01T12:05:11.970 [KSL] Leaving CKSLEngine::Initialize(0). 2026-10-01T12:05:11.970 [KSL] Entering CKSLEngine::EnableKSL. State: [1] 2026-10-01T12:05:11.970 [KSL] MpInstallKslD: hr=0x1 2026-10-01T12:05:11.970 [KSL] MpRegisterKslD: hr=0 2026-10-01T12:05:11.979 [KSL] MpStartKslD: hr=0 2026-10-01T12:05:11.979 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-10-01T12:05:11.979 Loading engine... 2026-10-01T12:05:11.995 Verifying engine and signature files (source: 1) ... 2026-10-01T12:05:11.995 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpengine.dll] due to PPL. 2026-10-01T12:05:11.995 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpasbase.vdm] (file in cache) 2026-10-01T12:05:11.995 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpasdlta.vdm] (file in cache) 2026-10-01T12:05:11.995 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpavbase.vdm] (file in cache) 2026-10-01T12:05:11.995 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpavdlta.vdm] (file in cache) 2026-10-01T12:05:12.070 [Engine] IsHybridMode: 0 2026-10-01T12:05:12.073 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-10-01T12:05:12.089 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-6E6F0BFDF8480C247052901569B4332E682FE633.bin): 0x00000002 2026-10-01T12:05:12.089 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-6E6F0BFDF8480C247052901569B4332E682FE633.bin) 2026-10-01T12:05:12.089 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-10-01T12:05:12.089 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-10-01T12:05:12.089 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-10-01T12:05:12.089 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-10-01T12:05:27.918 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-10-01T12:05:27.918 [AutoExclusion] Applied roles from cache. 2026-10-01T12:05:27.918 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-10-01T12:05:27.918 [Engine] New active engine 00007FFFD5E0B020 (no old engine). Number of active engines: 1 2026-10-01T12:05:27.950 EngineInit:Global ASOC is enabled 2026-10-01T12:05:27.950 EngineInit:ASOO is enabled for developer volumes 2026-10-01T12:05:28.013 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-10-01T12:05:28.013 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:05:28.013 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-10-01T12:05:28.013 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-10-01T12:05:28.013 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-10-01T12:05:28.013 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:05:28.013 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:05:28.013 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:05:28.013 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-10-01T12:05:28.013 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:05:28.013 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-10-01T12:05:28.013 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) -------------------------------------------------------------------------------- Microsoft Defender Antivirus (77BDAF73-B396-481F-9042-AD358843EC24) Service Log Started On 10-01-2026 12:05:46 ************************************************************ OS install time: 01/03/2024 14:58:11.0 UTC Current time: 10/01/2026 12:05:46.631660900 UTC (11515 ms since boot) 2026-10-01T12:05:46.901 MpEnsureProcessMitigationPolicy(0x7) returns 0x1 2026-10-01T12:05:47.198 [HybridMode] isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-10-01T12:05:47.229 ProductId: 2, ProductFeature: 0, LaunchedProtected: 3, IsWcos: 0, IsContainerOs: 0, DirtyShutdownDetected: 0, PassiveRemediation: 0, IsHybridModePolicyEnabled: 0, IsVerifiedAndReputableTrustModeEnabled: 0 2026-10-01T12:05:47.448 [WPP] Starting WPP trace with buffersize 4MB, maxfilesize: 16MB, filename: MpWppTracing-20261001-120547-00000003-fffffffeffffffff.bin ... 2026-10-01T12:05:47.870 [WPP] Trace session started - MpWppTracing-20261001-120547-00000003-fffffffeffffffff.bin 2026-10-01T12:05:47.870 MpReinforceExclusionsAcls from LoadCapability: (hr = 0) 2026-10-01T12:05:47.870 [RbM] Rollback manager succesfully initialized. 2026-10-01T12:05:47.870 [RbM] Rollback manager EnableRollbackManager called. 2026-10-01T12:05:47.885 [RbM] Rollback manager EnableRollbackManager completed. 2026-10-01T12:05:47.885 [PlatUpd] Service launched successfully from: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0 2026-10-01T12:05:47.885 MpWriteUupPlatformVersion 4.18.26080.4, hr = 0 2026-10-01T12:05:47.885 [WSC] MpPostPlatformUpdate: Initializing WSC library early on normal platform startup (before MpCheckAndUpdateBinaryLocationTo) 2026-10-01T12:05:47.923 [PlatUpd] Validating and fixing WMI MOF schema - Running command: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe" -RegisterWmiSchema -Root "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0" 2026-10-01T12:05:54.167 [PlatUpd] MpAddMpUxRegistration succeeded 2026-10-01T12:05:54.167 [PlatUpd] MpManagementUpdateHandler: starting update for install path %ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0. 2026-10-01T12:05:54.167 [PlatUpd] MpManagementUpdateHandler: calling MpUpdateManagement() 2026-10-01T12:05:54.167 [PlatUpd] MpUpdateManagement: Management platform update started for components (3) 2026-10-01T12:05:54.167 [PlatUpd] Defender MDM CSP platform update not supported on Server SKUs 2026-10-01T12:05:54.167 [PlatUpd] WMI/PS provider platform update started 2026-10-01T12:05:54.167 [PlatUpd] WMI/PS provider platform update not required 2026-10-01T12:05:54.167 [PlatUpd] MpUpdateManagement: Management platform update completed 2026-10-01T12:05:54.167 [PlatUpd] MpCheckAndUpdateBinaryLocationTo(%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0): 10 items checked, 0 required update. hrMui: 0x1 hrEtw: 0 2026-10-01T12:05:54.167 [TS] Troubleshooting mode is not available! 2026-10-01T12:05:54.167 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: False 2026-10-01T12:05:54.167 CheckProductDisabled(fWaitWSC: 1, fRemoveConfigs: 0) ... 2026-10-01T12:05:54.182 [Service] Enabling IOAV/IEV/ShellExt/EtwLogger registrations ... 2026-10-01T12:05:54.182 [Service] Enabling AutoLoggers ... 2026-10-01T12:05:54.182 DefenderApiLoggerLowPriv started successfully. 2026-10-01T12:05:54.198 [Service] Enabling AMSI registration ... 2026-10-01T12:05:54.198 [Service] Leaving EnableIOAVWorker(1, 0) with hr = 0 2026-10-01T12:05:54.229 Cache C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\654A635C-0000-0000-0000-500600000000-1.bin loaded.**********Cache stats************ No. Of buckets -> 61033 Each Bucket has max capacity of -> 1 entries number of Entries is 44404 Number of invalid entries is 0 Number of inserts issued is 741135 Number of replaces issued is 0 Number of insert failures is 7 Number of inserts with duplicate entries is 3450 Number of lookups is 76602886 Number of lookup misses is 2567479 Number of fast lookup misses is 17525297 Number of false fast lookups is 2567477 Number of invalidations is 398142 Number of maintenance invalidations is 90876 Current File Size is 1499136 Journal ID = 1d864ae105a6246 Trusted image state = 4 USN = 1171c7 Setup boot count = 2 2026-10-01T12:05:54.229 Verifying license file... 2026-10-01T12:05:54.229 Verified [C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\msmplics.dll] (file in cache) 2026-10-01T12:05:54.245 SharedSignatureRoot not configured. Disabling remote image load for msmpeng.exe. Once disabled, it can no longer be enabled without a service restart. hr=0x1 2026-10-01T12:05:54.245 Loaded module#0 MpComServer. 2026-10-01T12:05:54.245 Loaded module#1 StartupPolicies. 2026-10-01T12:05:54.245 Loaded module#2 DefenderBranding. 2026-10-01T12:05:54.245 [SCC][CID=19140_4620] Initializing SCC (phase: PreEngine) 2026-10-01T12:05:54.245 [SCC][CID=19140_4620] Early (pre-engine) SCC init disabled by feature control; deferring to Phase 2 2026-10-01T12:05:54.245 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: False 2026-10-01T12:05:54.245 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 2026-10-01T12:05:54.292 MpRefreshDefenderCoreConfigs: failed because engine is not ready, we cannot let the process continue because we might start core service while its configuration is not ready. 2026-10-01T12:05:54.292 [Plugin] Verifying C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\mprtp.dll ... 2026-10-01T12:05:54.292 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\mprtp.dll] due to PPL. 2026-10-01T12:05:54.323 COM server initialized successfully. 2026-10-01T12:05:54.339 [RTP] [RTP] FilterCommunicator object 0x0000014BB14D5240 initialized (\MicrosoftMalwareProtectionAsyncPortWD, , ), threads: 0 normal, 0 very low, 0 alt, thread pool threads: 4 normal, 0 very low, 0 alt 2026-10-01T12:05:54.339 [RTP] Setting DisableAsyncScanOnClose to 0 (hr=0). 2026-10-01T12:05:54.339 [RTP] Setting DisableAsyncScanOnOpen to 0 in wdfilter (hr=0). 2026-10-01T12:05:54.339 [RTP] Setting FilterExperimentMode to 0 (hr=0). 2026-10-01T12:05:54.339 [RTP] Setting DisableDriverUnload to 1 (hr=0). 2026-10-01T12:05:54.339 [RTP] Setting RegLinkHardeningMode to 0 (hr=0). 2026-10-01T12:05:54.339 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-10-01T12:05:54.339 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-10-01T12:05:54.339 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-10-01T12:05:54.339 [RTP] Setting PreventPagingFileAbuse to 1 (hr=0). 2026-10-01T12:05:54.339 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-10-01T12:05:54.339 [RTP] [RTP] LastAccessTimeSuppression for network files is enabled by configuration. 2026-10-01T12:05:54.339 [RTP] [RTP] FilterCommunicator object 0x0000014BB14D5440 initialized (\MicrosoftMalwareProtectionPortWD, \MicrosoftMalwareProtectionVeryLowIoPortWD, \MicrosoftMalwareProtectionRemoteIoPortWD), threads: 6 normal, 2 very low, 0 alt, thread pool threads: 0 normal, 0 very low, 6 alt 2026-10-01T12:05:54.339 [RTP] SyncDssAvailableThreads cap limit initialized by MiscConfig to: 14 2026-10-01T12:05:54.339 [RTP] [RtpCopyAccelerator] Windows19H1 1, WindowsCobalt 0, IsServerSKU 1, IsPassiveOrSideBySidePassiveMode 0, IsDevMode 0, fIsWindowsInhouseBuild 0, BuildLabEx 20348.1.amd64fre.fe_release.210507-1500 2026-10-01T12:05:54.339 [RTP] [RTP] StartCommunication 0x0000014BB14D5240 (\MicrosoftMalwareProtectionAsyncPortWD, ), threads: 0 normal, 0 very low, 0 alt, thread pool threads: 4 normal, 0 very low, 0 alt 2026-10-01T12:05:54.339 [init][RTP] RTPPlugin initialization completed 2026-10-01T12:05:54.339 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\mpnirtp.dll] due to PPL. 2026-10-01T12:05:54.354 [RTP] [NiRTP] CNiRtpPlugin::Initialize completed successfully 2026-10-01T12:05:54.354 [init][NiRTP] NiRTPPlugin initialization completed 2026-10-01T12:05:54.354 OS boot count = 2 2026-10-01T12:05:54.354 OS Install = 0 2026-10-01T12:05:54.448 [ManagedAgent] HooksInitialize: skipped (unsupported platform) 2026-10-01T12:05:54.495 [init] MpAddMpUxRegistrationForToast failed (Ignored). hr = 0x8000401a 2026-10-01T12:05:54.542 [KSL] Entering CKSLEngine::Initialize. 2026-10-01T12:05:54.542 [KSL] Leaving CKSLEngine::Initialize(0). 2026-10-01T12:05:54.542 [KSL] Entering CKSLEngine::EnableKSL. State: [1] 2026-10-01T12:05:54.557 [KSL] MpInstallKslD: hr=0x1 2026-10-01T12:05:54.557 [KSL] MpRegisterKslD: hr=0 2026-10-01T12:05:54.557 [KSL] MpStartKslD: hr=0 2026-10-01T12:05:54.557 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-10-01T12:05:54.557 Loading engine... 2026-10-01T12:05:54.623 Verifying engine and signature files (source: 1) ... 2026-10-01T12:05:54.623 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpengine.dll] due to PPL. 2026-10-01T12:05:54.623 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpasbase.vdm]. File not in cache (0x1) 2026-10-01T12:05:56.135 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpasbase.vdm] 2026-10-01T12:05:56.135 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpasdlta.vdm] (file in cache) 2026-10-01T12:05:56.135 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpavbase.vdm]. File not in cache (0x1) 2026-10-01T12:05:56.792 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpavbase.vdm] 2026-10-01T12:05:56.792 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpavdlta.vdm] (file in cache) 2026-10-01T12:05:56.839 [Engine] IsHybridMode: 0 2026-10-01T12:05:56.839 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-10-01T12:05:57.026 Database:Using offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-6E6F0BFDF8480C247052901569B4332E682FE633.bin) IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-10-01T12:06:04.877 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-10-01T12:06:04.877 [AutoExclusion] Applied roles from cache. 2026-10-01T12:06:04.877 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-10-01T12:06:04.893 [Engine] New active engine 00007FFEEA77B020 (no old engine). Number of active engines: 1 2026-10-01T12:06:04.909 EngineInit:Global ASOC is enabled 2026-10-01T12:06:04.909 EngineInit:ASOO is enabled for developer volumes 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:04.987 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:06:05.049 MpWriteUupSignatureVersion 1.459.491.0, hr = 0 2026-10-01T12:06:05.049 [SigStatUpd] CSignatureStatus: back to good 2026-10-01T12:06:05.049 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-10-01T12:06:05.081 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-10-01T12:06:05.081 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-10-01T12:06:05.081 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)! 2026-10-01T12:06:05.081 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValiditApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-10-01T12:06:05.096 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-10-01T12:06:05.096 [Plugin] Initializing RTP plugin state... 2026-10-01T12:06:05.096 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-10-01T12:06:05.096 [RTP] ****************************RTP Perf Log*************************** RTP Start:N/A Last Perf:(null) First RTP Scan:N/A Plugin States: AV:2 AS:2 RTP:2 OA:2 BM:2 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:0 System File Cache: Hits:0 Misses:0 BM Queue:0,0,0 Proc:0,0,0 File:0,0,0 NamedPipe:0,0,0 Plugin Queue:0,0,0 Threat:0,0,0 Susp:0,0,0 Unknown:0,0,0 Error:0,0,0 Request Queue:2,2,0 SetEngine:1,1,0 SetState:1,1,0 SetUser:0,0,0 Config:0,0,0 ProcExcl:0,0,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:0 Pending:0 RegSize:2882 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:2102 AsyncQCurrent:0 BMFlags:8 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:1898 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:10214 TotalHits:0 InstanceCacheInserts:8 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:2529 InstanceCacheOverflows:0 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:-1ms (0/0) Success: 0, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-10-01T12:06:05.131 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89} 2026-10-01T12:06:05.131 Engine:Failure in process enumeration: Image:, Error:GetImageNameConfigurationEx, 0x80078020, PID: 0 2026-10-01T12:06:05.131 Engine:Failure in process enumeration: Image:, Error:GetImageNameConfigurationEx, 0x80078020, PID: 4 2026-10-01T12:06:05.131 [SCC][CID=19140_4620] [1DS] SCCState hr=0x0 msg={"error":"","hr":"0x0","init":false,"source":"None","state":"None"} 2026-10-01T12:06:05.131 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-10-01T12:06:05.131 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-10-01T12:06:05.131 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-10-01T12:06:05.131 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-10-01T12:06:05.131 Engine loaded! 2026-10-01T12:06:05.143 [DLP] Create FeatureControlState instance 2026-10-01T12:06:05.143 [SCC][CID=19140_4620] Initializing SCC (phase: PostEngine) 2026-10-01T12:06:05.143 [SCC][CID=19140_4620] SCC Initialize! The feature is OFF on this machine (E5 = 0), hr: 0x80004001 2026-10-01T12:06:05.143 RegisterSModeChangeListener: hr = 0x1 2026-10-01T12:06:05.143 RegisterHybridModeChangeListener: hr = 0 2026-10-01T12:06:05.174 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). 2026-10-01T12:06:05.174 [AutoPurge] Auto purger task is scheduled to run in 600000(ms) from now with period 86400000(ms) 2026-10-01T12:06:05.174 [SigReleaseHb] Initialized with Stage 0 2026-10-01T12:06:05.174 [EmergencySigManager] Emergency sig checks are currently disabled. Timer interval: 15 minutes. 2026-10-01T12:06:05.206 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-10-01T12:06:05.206 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-10-01T12:06:05.252 [NRI] Stopping NIS service ... 2026-10-01T12:06:05.252 [RTP] [RTP] Killbits updated: 0x200000000000000 -> 0x4000000 2026-10-01T12:06:05.252 [RTP] [RTP] LastAccessTimeSuppression is enabled (default behavior). 2026-10-01T12:06:05.268 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-10-01T12:06:05.268 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.491.0 AV Signature Version: 1.459.491.0 ************************************************************ 2026-10-01T12:06:05.268 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-10-01T12:06:05.268 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-10-01T12:06:05.268 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-10-01T12:06:05.268 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-10-01T12:06:05.268 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-10-01T12:06:05.268 [RTP] Generating the base plugin configuration ... 2026-10-01T12:06:05.268 [RTP] Path exclusion changed, new size in bytes: 2 2026-10-01T12:06:05.268 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-10-01T12:06:05.268 [RTP] Calling GenerateEngineConfigStruct (0x3e) ... 2026-10-01T12:06:05.268 Ci Endpoint Security Policy Installation: Unsupported, hr = 0x00000001 2026-10-01T12:06:05.268 [RTP] [RTP] RTPPlugin state has changed as follow: ASStatus:0->1, AVStatus:0->1, RTPStatus:0->1 2026-10-01T12:06:05.268 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-10-01T12:06:05.268 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-10-01T12:06:05.284 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-10-01T12:06:05.284 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-10-01T12:06:05.284 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-10-01T12:06:05.284 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-10-01T12:06:05.284 MdCoreSvc is supported in this platform and OS 2026-10-01T12:06:05.284 MdCoreSvc is supported in this platform and OS 2026-10-01T12:06:05.284 [PlatUpd] MDCoreSvc is supported by the version of the platform we are switching to. Making sure the service is registered with SCM 2026-10-01T12:06:05.284 [PlatUpd] Starting MdCoreSvc service 2026-10-01T12:06:05.284 [WSC] WSCReconcile InitComplete v=1 succeeded=1 tentativeOnReported=0 2026-10-01T12:06:05.284 [RTP] [RTP] StartCommunication 0x0000014BB14D5440 (\MicrosoftMalwareProtectionPortWD, \MicrosoftMalwareProtectionVeryLowIoPortWD), threads: 6 normal, 2 very low, 0 alt, thread pool threads: 0 normal, 0 very low, 6 alt 2026-10-01T12:06:05.284 Trying to initialize resource usage monitoring... 2026-10-01T12:06:05.284 Resource usage Monitoring is enabled 2026-10-01T12:06:05.377 [RTP] [RTP] RTP worker threads ready [6 threads] 2026-10-01T12:06:05.377 Job Notification: New process added to job (3292) 2026-10-01T12:06:05.487 [RTP] [Mini-filter] First scan on a volume: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\CLUSTER\LS-LS.ACT 2026-10-01T12:06:05.487 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:5592] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:5668]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-10-01T12:06:05.565 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b IDynamicConfig::ReportChange value=EnableSmsEmsOnArm64_MpRamp new=False oldTrue IDynamicConfig::ReportChange value=MpFC_CoreSvcEnableUpdateLogging new=0 old1 IDynamicConfig::ReportChange value=MpDisableBmHealthOneDsEvent new=False oldTrue IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-10-01T12:06:05.581 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-10-01T12:06:05.581 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-10-01T12:06:05.581 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-10-01T12:06:05.581 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-10-01T12:06:05.581 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-10-01T12:06:05.581 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-10-01T12:06:05.596 [PlatUpd] WMI MOF schema validation completed successfully 2026-10-01T12:06:05.737 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T12:06:05.737 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T12:06:05.737 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T12:06:05.737 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T12:06:05.737 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T12:06:08.315 [RTP] Duplicating the current plugin configuration object... 2026-10-01T12:06:08.315 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-10-01T12:06:08.315 [RTP] Updating plugin configuration due to recent config changes (0x600) ... 2026-10-01T12:06:08.315 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-10-01T12:06:08.315 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x600, Changed: 0x218 2026-10-01T12:06:55.253 Process scan (poststartupscan) started. 2026-10-01T12:06:55.253 Process scan (poststartupscan) completed. 2026-10-01T12:06:55.753 CheckProductDisabled(fWaitWSC: 0, fRemoveConfigs: 1) ... 2026-10-01T12:06:55.768 [RTP] [RtpConfig] Config change detected, type: 1024 2026-10-01T12:06:58.346 [RTP] Duplicating the current plugin configuration object... 2026-10-01T12:06:58.346 [RTP] CCMPluginConfiguration::Duplicate() - no GenerateEngineEngineConfigStruct ... 2026-10-01T12:06:58.346 [RTP] Updating plugin configuration due to recent config changes (0x400) ... 2026-10-01T12:06:58.346 [RTP] Calling GenerateEngineConfigStruct (0x18) ... 2026-10-01T12:06:58.362 [RTP] RefreshPluginConfiguration completed successfully. Requested: 0x400, Changed: 0x218 2026-10-01T12:07:24.799 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\Temp\cab_5516_2. Process: \Device\HarddiskVolume2\Windows\System32\makecab.exe, Status: 0xc0000001, State: 0, ScanRequest #3270, FileId: 0xb00000000055dd, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:07:26.440 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\Temp\cab_5516_6. Process: \Device\HarddiskVolume2\Windows\System32\makecab.exe, Status: 0xc0000001, State: 0, ScanRequest #3285, FileId: 0x10000000007226, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:09:15.597 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T12:09:15.597 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T12:09:15.597 [Cloud] Queued cloud request. 2026-10-01T12:09:15.597 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T12:09:15.597 [Cloud] Dequeued cloud request. 2026-10-01T12:09:15.613 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T12:09:15.941 [Cloud] End of cloud request. 2026-10-01T12:09:16.441 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T12:11:04.942 [RbM] Setting Last known good engine candidate. hr = 0 2026-10-01T12:11:05.176 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T12:14:42.661 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-3-f.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6616, FileId: 0x2100000000d8c3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:14:42.661 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-3-f.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6618, FileId: 0x1100000000d633, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:14:43.255 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-3-10.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6637, FileId: 0x1200000000d633, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:14:43.255 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-3-10.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6636, FileId: 0x2200000000d8c3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:14:59.661 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-3-28.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6747, FileId: 0x1300000000d633, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:14:59.661 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-3-28.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6746, FileId: 0x2300000000d8c3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:14:59.677 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-3-29.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6751, FileId: 0x1400000000d633, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:14:59.677 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-3-29.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6750, FileId: 0x2400000000d8c3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:15:23.286 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-32-52.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6880, FileId: 0x1500000000d633, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:15:23.286 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-32-52.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6879, FileId: 0x2500000000d8c3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:15:31.318 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-32-70.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6938, FileId: 0x1600000000d633, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:15:31.318 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-32-70.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6937, FileId: 0x2600000000d8c3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:15:31.333 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-32-71.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6941, FileId: 0x2700000000d8c3, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:15:31.333 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-32-71.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #6942, FileId: 0x1700000000d633, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:16:05.177 [AutoPurge] AutoPurgeWorker triggered with dwWork=0x3 2026-10-01T12:16:05.177 Timer callback: Initializating/verifying scheduled tasks ... 2026-10-01T12:16:05.208 Job Notification: New process added to job (4552) 2026-10-01T12:16:05.224 Job Notification: New process added to job (5752) 2026-10-01T12:16:05.255 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:4552] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:5752]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-10-01T12:16:05.333 Task(SignatureUpdate -ScheduleJob -RestrictPrivileges) launched 2026-10-01T12:16:05.349 Task(Scan -ScheduleJob -RestrictPrivileges -ScanType 2 -ScanTrigger 52) is scheduled to run in 54532675(ms) from now at 05:24 (03:24 UTC) with period 86400000(ms). Daily task start time is randomized to reduce spikes. 2026-10-01T12:16:05.364 Job Notification: New process added to job (4504) 2026-10-01T12:16:05.364 Task(SignaturesUpdateService -ScheduleJob -UnmanagedUpdate) launched 2026-10-01T12:16:05.380 Job Notification: New process added to job (5340) 2026-10-01T12:16:05.380 [RTP] [Mini-filter] Denied OB operation OpenProcess[\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe][Pid:4504] from process [\Device\HarddiskVolume2\Windows\System32\conhost.exe][Pid:5340]. OriginalDesiredAccess: [0x1fffff] ResultingAccess: [0x1ff7d4] 2026-10-01T12:16:26.646 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\b48997d3b3604f07416b6e397ec50909\System.Core.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #7624, FileId: 0x43000000033996, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:16:29.693 UpdateEngine start: Source: 1, szUpdateDirectory: C:\Windows\Temp\9B48CB20-F3A1-4589-BA5A-F57FCB5D3A1A1b7c.1dd519eae00dd9b 2026-10-01T12:16:29.833 Verifying engine and signature files (source: 0) ... 2026-10-01T12:16:29.833 Skipped verification of [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1D1803CF-C3BC-4C79-8B93-09D58EE1D900}\mpengine.dll] due to PPL. 2026-10-01T12:16:29.833 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1D1803CF-C3BC-4C79-8B93-09D58EE1D900}\mpasbase.vdm]. File not in cache (0x1) 2026-10-01T12:16:34.396 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1D1803CF-C3BC-4C79-8B93-09D58EE1D900}\mpasbase.vdm] 2026-10-01T12:16:34.396 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1D1803CF-C3BC-4C79-8B93-09D58EE1D900}\mpasdlta.vdm]. File not in cache (0x1) 2026-10-01T12:16:34.521 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1D1803CF-C3BC-4C79-8B93-09D58EE1D900}\mpasdlta.vdm] 2026-10-01T12:16:34.521 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1D1803CF-C3BC-4C79-8B93-09D58EE1D900}\mpavbase.vdm]. File not in cache (0x1) 2026-10-01T12:16:35.527 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1D1803CF-C3BC-4C79-8B93-09D58EE1D900}\mpavbase.vdm] 2026-10-01T12:16:35.527 MpCacheManagerIsTrustedFile [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1D1803CF-C3BC-4C79-8B93-09D58EE1D900}\mpavdlta.vdm]. File not in cache (0x1) 2026-10-01T12:16:35.583 Verified [C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1D1803CF-C3BC-4C79-8B93-09D58EE1D900}\mpavdlta.vdm] 2026-10-01T12:16:35.896 [Engine] IsHybridMode: 0 2026-10-01T12:16:35.896 [KSL]KSL(1.1.26080.64012) Is available via CAMP. KslDevice : KslD 2026-10-01T12:16:35.927 Database:Can't find offline cache cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-81570E307FE7D081C2E2A3A8E13286F21F58DBAB.bin): 0x00000002 2026-10-01T12:16:35.927 Database:Creating offline cache (C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-81570E307FE7D081C2E2A3A8E13286F21F58DBAB.bin) 2026-10-01T12:16:35.927 Database:Product:1, ProductVersion:5, Platform:6, PlatformVersion:19, IsBeta:0, IsAdvancedAtLoad:1, IsParanoid: 0, IsOffline: 0 2026-10-01T12:16:35.927 Database:IsEmbedded: 0, IsIEVEnabled: 1, IsServerSku: 1, IsRsdhSku: 1, IsEnterpriseProduct: 0, IsMsft: 0, IsSeville: 0, IsMsSense: 0, IsImmune: 0, IsMba: 0, IsPus: 0, IsManaged: 0, IsSmode: 0 2026-10-01T12:16:35.927 Database:IsAutoSubmit:1, IsPusRem:0, LoadedAS:1, LoadedAV:1, LoadedInternal: 0, PassiveMode: 0, SxsPassiveMode:0, IsDevMode:0, IsTestSigning:0, IsWCOS: 0, IsInsideContainer: 0, IsHybridMode: 0 2026-10-01T12:16:35.927 Database:kLCID:1033, kOsVersion:655360, kProcessorArch:9, dwIsTest:0, kOOsVersion:655360, kOsSP:0, kOsBld:20348, dwPvpRing=0xffffffff 2026-10-01T12:16:49.333 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\WindowsBase\79d904cd103fa8bb34bbd6529f6dc215\WindowsBase.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8062, FileId: 0x1400000004ed1e, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:16:54.027 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T12:16:54.027 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T12:16:54.027 [Cloud] Queued cloud request. 2026-10-01T12:16:54.027 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T12:16:54.027 [Cloud] Dequeued cloud request. 2026-10-01T12:16:54.027 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T12:16:54.193 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{22FF6771-1B38-82FF-11A1-991768262659} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 12:16:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T12:16:54.739 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T12:16:59.755 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T12:16:59.755 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T12:16:59.755 [Cloud] Queued cloud request. 2026-10-01T12:16:59.755 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T12:16:59.755 [Cloud] Dequeued cloud request. 2026-10-01T12:16:59.755 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T12:16:59.896 [Cloud] End of cloud request. 2026-10-01T12:17:00.396 [NRI] Successfully updated NIS service with platform settings for enforcement level Log IDynamicConfig::ReportError value=BruteForceProtectionIPExclusion hr=0x8007007b IDynamicConfig::ReportError value=BruteForceProtectionStatus hr=0x8007007b IDynamicConfig::ReportError value=DisableGradualRelease hr=0x8007007b IDynamicConfig::ReportError value=EnableFileHashComputation hr=0x8007007b IDynamicConfig::ReportError value=MpBafsExtendedTimeout hr=0x8007000d IDynamicConfig::ReportError value=MpCampRingThrottled hr=0x8007007b IDynamicConfig::ReportError value=MpCloudBlockLevel hr=0x8007000d IDynamicConfig::ReportError value=MpEngineRingThrottled hr=0x8007007b 2026-10-01T12:17:06.802 Geo ID not found using standard default set: :SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx 2026-10-01T12:17:06.802 [AutoExclusion] Applied roles from cache. 2026-10-01T12:17:06.802 [AutoExclusion] Started roles monitoring. IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=EnableSmsEmsOnArm64_MpRamp new=True oldFalse IDynamicConfig::ReportChange ECS value=MpFC_CoreSvcEnableUpdateLogging new=1 old0 IDynamicConfig::ReportChange ECS value=MpDisableBmHealthOneDsEvent new=True oldFalse 2026-10-01T12:17:06.927 [Engine] RSIG_ENGINE_PRE_SHUTDOWN, 0x00007FFEEA77B020, lRefCount: 6, hr=0 2026-10-01T12:17:06.927 [Engine] New active engine 00007FFEE334B020 replacing engine 00007FFEEA77B020. Number of active engines: 2 2026-10-01T12:17:06.943 EngineInit:Global ASOC is enabled 2026-10-01T12:17:06.943 EngineInit:ASOO is enabled for developer volumes 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block use of copied or impersonated system tools", State=5, Action=0, Type=9, Duplicates(Interval=288000000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", State=5, Action=7, Type=1, Duplicates(Interval=288000000000, scope=0x380) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from injecting code into other processes", State=5, Action=2, Type=24, Duplicates(Interval=144000000000, scope=0x380) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Controlled folder access", State=0, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block untrusted and unsigned processes that run from USB", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block Adobe Reader from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block Office applications from creating executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block Webshell creation for Servers", State=5, Action=0, Type=1, Duplicates(Interval=0, scope=0x0) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block Office communication application from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block abuse of in-the-wild exploited vulnerable signed drivers", State=5, Action=0, Type=1, Duplicates(Interval=36000000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block all Office applications from creating child processes", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Use advanced protection against ransomware", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block Process Creations originating from PSExec & WMI commands", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block Launching of executable content from email attachment", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block JavaScript or VBScript from launching downloaded executable content", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block persistence through WMI event subscription", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block rebooting machine in Safe Mode", State=5, Action=1, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.036 Engine-HIPS:Loaded ASR vdm rule "Block execution of potentially obfuscated scripts", State=5, Action=0, Type=1, Duplicates(Interval=1200000000, scope=0x100) 2026-10-01T12:17:07.052 MpWriteUupSignatureVersion 1.459.501.0, hr = 0 2026-10-01T12:17:07.052 ForceSyncMoacInsertion config from engine is 0, hr = 0x0 2026-10-01T12:17:07.083 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-10-01T12:17:07.083 [HybridMode] HybridMode change notification isHybridModePolicyEnabled: 0, isVerifiedAndReputableTrustModeEnabled: 0 2026-10-01T12:17:07.083 Hybrid mode change notification called, no change detected in verified and reputable trust mode (0 -> 0)! 2026-10-01T12:17:07.083 Hybrid mode change notification called, no change detected in Hybrid mode (0 -> 0)!ApplyDefenderProcessTokenTrustLableAce succeeded to set. 2026-10-01T12:17:07.099 MpUpdateUpdateResiliencyConfiguration updated to 0 2026-10-01T12:17:07.099 [Plugin] Initializing RTP plugin state... 2026-10-01T12:17:07.099 [Plugin] Normal mode, or passive mode with shadow protection enabled. Will not force RTP off. 2026-10-01T12:17:07.099 [RTP] ****************************RTP Perf Log*************************** RTP Start:‎10‎-‎01‎-‎2026 14:06:05 Last Perf:‎10‎-‎01‎-‎2026 14:06:05 First RTP Scan:‎10‎-‎01‎-‎2026 14:06:05 Plugin States: AV:1 AS:1 RTP:1 OA:1 BM:1 Process Exclusions: Path Exclusions: Ext Exclusions: Temp Exclusions: Worker Threads: AM:14 Async:4 Cache Flushes: RTP:1 System File Cache: Hits:617 Misses:3931 BM Queue:0,52,0 Proc:0,51,0 File:0,21,0 NamedPipe:0,0,0 Plugin Queue:0,1,0 Threat:0,0,0 Susp:0,1,0 Unknown:0,0,0 Error:0,0,0 Request Queue:2,3,0 SetEngine:1,1,0 SetState:1,1,0 SetUser:0,0,0 Config:0,1,0 ProcExcl:0,1,0 FilterReload:0,0,0 FilterUnload:0,0,0 MpFilter: Scans:8385 Pending:0 RegSize:310616 AsyncQNotif:0 AsyncQMissed:0 AsyncQTotalSent:4536182 AsyncQCurrent:0 BMFlags:40127 ServiceMaj:0 ServiceMin:0 NumInstance:3 TotalStreamCon:11778 NTFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:38529 TotalHits:10476 InstanceCacheInserts:235 InstanceCacheUpdates:0 InstanceCacheDeletes:12 InstanceCacheHits:16 InstanceCacheMisses:27311 InstanceCacheOverflows:0 CSVFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 REFS Cache Statistics (Instance Cache Type:GenericTable): TotalMisses:0 TotalHits:0 InstanceCacheInserts:0 InstanceCacheUpdates:0 InstanceCacheDeletes:0 InstanceCacheHits:0 InstanceCacheMisses:0 InstanceCacheOverflows:0 SyncProcessCreateDuration:9ms (721/75) Success: 75, failures: 0 (last code: 0x0), timeouts: 0, baddata: 0 **************************END RTP Perf Log************************* 2026-10-01T12:17:07.114 [Engine] Loaded C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1D1803CF-C3BC-4C79-8B93-09D58EE1D900} 2026-10-01T12:17:07.114 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{39A585BB-24DA-4430-AD8F-6F5F1F96AEE7} removed 2026-10-01T12:17:07.114 [Engine] Skip removing C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89}\mpasbase.vdm in use, hr=0x80070020 2026-10-01T12:17:07.130 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-10-01T12:17:07.130 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-10-01T12:17:07.130 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-10-01T12:17:07.130 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-10-01T12:17:07.130 MdCoreSvc is supported in this platform and OS 2026-10-01T12:17:07.130 [RTP] Setting TrustedInstallerHardeningExcludeFlags to 7 (hr=0). Beginning quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Target: Flags:131074 Start time:10-01-2026 12:17:07 Finished quarantine recovery Quarantine ID:{00000000-0000-0000-0000-000000000000} Result:0 End time:10-01-2026 12:17:07 2026-10-01T12:17:07.130 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-10-01T12:17:07.130 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-10-01T12:17:07.130 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-10-01T12:17:07.130 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). BmLoggingDisabled:MpDisableBmLogging not set. 2026-10-01T12:17:07.130 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T12:17:07.130 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-10-01T12:17:07.130 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-10-01T12:17:07.130 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-10-01T12:17:07.130 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-10-01T12:17:07.130 MdCoreSvc is supported in this platform and OS Signature updated on 10-01-2026 12:17:07 Product Version: 4.18.26080.4 Service Version: 4.18.26080.4 Engine Version: 1.1.26080.3 AS Signature Version: 1.459.501.0 AV Signature Version: 1.459.501.0 ************************************************************ 2026-10-01T12:17:07.146 [Update] Performing ScanOnUpdate, GetConfigHr: 0x0, dwDisableScanOnUpdate: 0, passiveMode: 0, killbit: 0 2026-10-01T12:17:07.146 UpdateEngine finished with 0: Source: 1, szUpdateDirectory: C:\Windows\Temp\9B48CB20-F3A1-4589-BA5A-F57FCB5D3A1A1b7c.1dd519eae00dd9b 2026-10-01T12:17:07.208 Process scan (postsignatureupdatescan) started. 2026-10-01T12:17:07.227 [TP] State change. FeatureAvialable: True, NewState: 0, OldState: 0, Scenario: Consumer, Source: Signatures, ConfigChange: True 2026-10-01T12:17:07.227 [TP] TP Enabled: 0, SecureConfigEnabled: 0, DisableTPExclusionBypass: 0, EnableTPExclusion via FC: 0, IsIntuneManagedDefender: 0, IsSCCMManagedDefender: 0, IsMDEAttachManagedDefender: 0, IsSCCMOnlyManagedDefender: 0, IsStrictPolicyModeEnabled: 0 (from snapshot: 0), Effective EnableTPExclusions: 0, Previous EnableTPExclusions: 0, Delayed call: 0 Signature updated via MicrosoftUpdateServer on 10-01-2026 12:17:07 ************************************************************ 2026-10-01T12:17:07.489 Job Notification: Process exited from job (4504) 2026-10-01T12:17:07.489 Job Notification: Process exited from job (5340) 2026-10-01T12:17:07.489 [RTP] Setting RegLinkHardeningMode to 1 (hr=0). 2026-10-01T12:17:07.489 [RTP] Setting EfsHardeningFlags to 0 (hr=0). 2026-10-01T12:17:07.489 [RTP] Setting DisableDynamicFsHardening to 0 (hr=0). 2026-10-01T12:17:07.489 [RTP] PreventPagingFileAbuseKillbit[0]. 2026-10-01T12:17:07.489 [RTP] Setting PreventPagingFileAbuse to 0 (hr=0). 2026-10-01T12:17:07.505 Job Notification: Process exited from job (4552) 2026-10-01T12:17:07.527 [Engine] Engine 00007FFEEA77B020 no longer in use. Number of active engines: 1 2026-10-01T12:17:07.527 [RTP] OS Copy Accelerator feature is: 0 (0:Disabled, 1:Enabled) 2026-10-01T12:17:07.527 [RTP] Setting SetEnablePurgeHipsCache to 1 (hr=0). 2026-10-01T12:17:07.527 Job Notification: Process exited from job (5752) 2026-10-01T12:17:07.568 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-10-01T12:17:07.568 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-10-01T12:17:07.568 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-10-01T12:17:07.771 ProcessImageName: httpd.exe, Pid: 4956, TotalTime: 40248, Count: 2472, MaxTime: 390, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\gridtip\gridtip_dev\massmailer\tinymce\tinymce.min.js, EstimatedImpact: 6% 2026-10-01T12:17:07.771 ProcessImageName: taskhostw.exe, Pid: 4384, TotalTime: 1668, Count: 8, MaxTime: 1546, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\SecureBootUpdates\BucketConfidenceData.cab, EstimatedImpact: 30% 2026-10-01T12:17:07.771 ProcessImageName: WmiPrvSE.exe, Pid: 584, TotalTime: 1123, Count: 49, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\drivers\ndis.sys, EstimatedImpact: 5% 2026-10-01T12:17:07.771 ProcessImageName: WmiPrvSE.exe, Pid: 4812, TotalTime: 1092, Count: 44, MaxTime: 218, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wmp.dll, EstimatedImpact: 0% 2026-10-01T12:17:07.771 ProcessImageName: svchost.exe, Pid: 872, TotalTime: 1014, Count: 3, MaxTime: 875, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 100% 2026-10-01T12:17:07.771 ProcessImageName: svchost.exe, Pid: 6352, TotalTime: 832, Count: 22, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\servicing\CbsApi.dll, EstimatedImpact: 0% 2026-10-01T12:17:07.771 ProcessImageName: AgentShell.exe, Pid: 4996, TotalTime: 718, Count: 61, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll, EstimatedImpact: 0% 2026-10-01T12:17:07.771 ProcessImageName: powershell.exe, Pid: 1324, TotalTime: 519, Count: 52, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll, EstimatedImpact: 1% 2026-10-01T12:17:07.771 ProcessImageName: svchost.exe, Pid: 1668, TotalTime: 260, Count: 14, MaxTime: 93, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\dxgiadaptercache.exe, EstimatedImpact: 0% 2026-10-01T12:17:07.771 ProcessImageName: svchost.exe, Pid: 3276, TotalTime: 170, Count: 3, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\wbem\WMIADAP.exe, EstimatedImpact: 0% 2026-10-01T12:17:07.771 ProcessImageName: svchost.exe, Pid: 3220, TotalTime: 169, Count: 6, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\srumsvc.dll, EstimatedImpact: 7% 2026-10-01T12:17:07.771 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 92, Count: 4, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\microsoft-windows-system-events.dll, EstimatedImpact: 0% 2026-10-01T12:17:07.771 ProcessImageName: msdtc.exe, Pid: 3020, TotalTime: 91, Count: 7, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\msdtctm.dll, EstimatedImpact: 40% 2026-10-01T12:17:07.771 ProcessImageName: mysqld.exe, Pid: 2936, TotalTime: 90, Count: 61, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\limesurvey\db.opt, EstimatedImpact: 0% 2026-10-01T12:17:07.771 ProcessImageName: regsvr32.exe, Pid: 2228, TotalTime: 77, Count: 3, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\SysWOW64\PrintConfig.dll, EstimatedImpact: 55% 2026-10-01T12:17:07.833 [Engine] RSIG_UNLOADENGINE, 00007FFEEA77B020, err=0x0 2026-10-01T12:17:07.849 [Engine] C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A395E940-F0FD-4A3E-92C3-55FCFBB04B89} removed 2026-10-01T12:17:22.990 [RTP] [Mini-filter] Unsuccessful scan status(#1): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\e65e432116a7a2a551fda99ea39f995f\PresentationCore.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #8785, FileId: 0xb00000004eef2, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:17:30.528 Process scan (postsignatureupdatescan) completed. BEGIN BM telemetry GUID:{3BA8E90E-5478-67CE-2D4D-FC36DD4F68E4} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:4956 ProcessCreationTime:134353299481302281 SessionID:0 CreationTime:10-01-2026 12:17:44 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T12:17:44.930 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T12:17:44.930 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T12:17:44.930 [Cloud] Queued cloud request. 2026-10-01T12:17:44.930 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T12:17:44.930 [Cloud] Dequeued cloud request. 2026-10-01T12:17:44.930 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T12:17:44.945 [Cloud] SubmitReport(CMpBmSpyNetReportContext) 2026-10-01T12:17:44.945 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T12:17:44.945 [Cloud] Queued cloud request. 2026-10-01T12:17:44.945 [Cloud] Dequeued cloud request. 2026-10-01T12:17:44.945 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T12:17:45.008 [Cloud] End of cloud request. 2026-10-01T12:17:45.086 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-10-01T12:17:45.086 [Cloud] End of cloud request. 2026-10-01T12:17:45.523 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T12:20:39.603 [RTP] [Mini-filter] Unsuccessful scan status(#2): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Data\91ea8fe8967b788b6615d445b0d69376\System.Data.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #11542, FileId: 0x80000000111c6, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:20:45.541 [RTP] [Mini-filter] Unsuccessful scan status(#3): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\d7688da13a99b5c002b4bf8c7efddf85\System.Xml.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #11623, FileId: 0x1c00000004e4df, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:21:44.838 [RTP] [Mini-filter] Unsuccessful scan status(#4): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\dd9593e4e72daf301d7b85de403ad3b8\System.Web.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #12314, FileId: 0x700000011ab16, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:21:45.494 [RTP] [Mini-filter] Unsuccessful scan status(#5): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\System.Comp46f2b404#\664d3128c965699f7651abdf54aef810\System.ComponentModel.DataAnnotations.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #12320, FileId: 0x700000011aad2, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:22:06.994 [RbM] Setting Last known good engine candidate. hr = 0 2026-10-01T12:22:15.478 [RTP] [Mini-filter] Unsuccessful scan status(#6): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\13eb4be6456e6be8a03e3f5f67cdb7f8\System.Core.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #12660, FileId: 0x1000000000ade6, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:22:25.556 [RTP] [Mini-filter] Unsuccessful scan status(#7): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\880c78d979ed3c09771e5c61b8cfdbf0\WindowsBase.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #12797, FileId: 0x1300000000beaf, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:22:36.900 [RTP] [Mini-filter] Unsuccessful scan status(#8): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\e0ec756c1da78c74291eae7752befd82\PresentationCore.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #12926, FileId: 0x8a00000000c854, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:25:02.353 [RTP] [Mini-filter] Unsuccessful scan status(#9): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\e6dda54bea247b948993183686b9f6ab\System.Xml.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #14194, FileId: 0x140000000c3ddd, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:25:43.134 [RTP] [Mini-filter] Unsuccessful scan status(#10): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Web\a19e52c667792a980c4ef84896c2a64e\System.Web.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #14485, FileId: 0xa0000000ca56c, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:25:43.713 [RTP] [Mini-filter] Unsuccessful scan status(#11): \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.28b9ef5a#\cfc7fb738344fcb72456ea3738adb601\System.Web.Extensions.ni.dll. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #14493, FileId: 0x90000000ca5aa, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:26:10.182 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T12:33:51.703 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T12:33:51.703 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T12:33:51.703 [Cloud] Queued cloud request. 2026-10-01T12:33:51.703 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T12:33:51.703 [Cloud] Dequeued cloud request. 2026-10-01T12:33:51.703 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T12:33:51.890 [Cloud] End of cloud request. 2026-10-01T12:33:52.390 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T12:38:05.799 [RTP] [Mini-filter] OpenWithoutRead notification (524, 10038, \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe) sent successfully. 2026-10-01T12:38:13.753 Bm signature throttled:0x000135b39c9104ce 2026-10-01T12:38:29.847 [RTP] [Mini-filter] Unsuccessful scan status(#12): \Device\HarddiskVolume2\Windows\Temp\sess_jctp514m5p2t9cvlk7nb78tmc3. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #21253, FileId: 0xf000000009a84, Reason: OnClose, IoStatusBlockForNewFile: 0x2, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:41:15.191 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e 2026-10-01T12:44:12.816 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7 2026-10-01T12:44:12.847 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T12:44:12.847 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T12:44:12.847 [Cloud] Queued cloud request. 2026-10-01T12:44:12.847 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T12:44:12.847 [Cloud] Dequeued cloud request. 2026-10-01T12:44:12.847 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T12:44:13.409 [Cloud] End of cloud request. 2026-10-01T12:44:13.409 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40030000, statusex=0x200200, threatid=0x80000000, sigseq=0x4a291015f80c 2026-10-01T12:44:13.925 [NRI] Successfully updated NIS service with platform settings for enforcement level Log Internal signature match:subtype=Lowfi, sigseq=0x00003329FAF726B1, sigsha=24a98fc9ace3bc6c832adfe9223f40d181b6f76f, cached=false, source=2, resourceid=0x4652e614 2026-10-01T12:50:56.461 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\phpmyserver\help.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x3329faf726b1 2026-10-01T12:51:22.961 [RTP] [Mini-filter] Unsuccessful scan status(#13): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-18f-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #29055, FileId: 0x2b000000035ff2, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:51:22.961 [RTP] [Mini-filter] Unsuccessful scan status(#14): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-18f-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #29056, FileId: 0x1f000000035fd8, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T12:52:30.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T12:52:30.445 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T12:52:30.445 [Cloud] Queued cloud request. 2026-10-01T12:52:30.445 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T12:52:30.445 [Cloud] Dequeued cloud request. 2026-10-01T12:52:30.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T12:52:30.820 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{41A08547-FFA6-AC0D-378D-BE169563F479} SignatureID:55744863128705 SigSha:c539180aa086d9d13dc4b68983fe5c1ea447dc45 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 12:52:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T12:52:31.351 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T12:52:31.351 [Cloud] SubmitReport(CMpBmSpyNetReportContext) 2026-10-01T12:52:31.351 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T12:52:31.351 [Cloud] Queued cloud request. 2026-10-01T12:52:31.351 [Cloud] Dequeued cloud request. 2026-10-01T12:52:31.351 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T12:52:31.383 [Cloud] MpEngineParseSpyNetResponse(). hr = 0 2026-10-01T12:52:31.383 [Cloud] End of cloud request. 2026-10-01T12:52:31.898 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T12:56:20.198 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T13:07:42.048 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T13:07:42.048 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T13:07:42.048 [Cloud] Queued cloud request. 2026-10-01T13:07:42.048 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T13:07:42.048 [Cloud] Dequeued cloud request. 2026-10-01T13:07:42.048 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T13:07:52.189 [Cloud] End of cloud request. 2026-10-01T13:07:52.705 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T13:11:25.205 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T13:15:11.973 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T13:15:11.973 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T13:15:11.973 [Cloud] Queued cloud request. 2026-10-01T13:15:11.973 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T13:15:11.973 [Cloud] Dequeued cloud request. 2026-10-01T13:15:11.973 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T13:15:12.161 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E86D659D-DBC5-CE68-50EE-D4E356E288A4} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 13:15:12 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T13:15:12.661 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T13:19:46.413 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T13:19:46.413 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T13:19:46.413 [Cloud] Queued cloud request. 2026-10-01T13:19:46.413 [Cloud] Dequeued cloud request. 2026-10-01T13:19:46.413 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T13:19:46.729 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T13:19:47.694 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F90AAAD3-ABD1-48A2-4AE1-D846C08C21D9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 13:19:47 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T13:19:48.241 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T13:23:41.132 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T13:23:41.132 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T13:23:41.132 [Cloud] Queued cloud request. 2026-10-01T13:23:41.132 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T13:23:41.132 [Cloud] Dequeued cloud request. 2026-10-01T13:23:41.132 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T13:23:41.351 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{386C67C9-A632-F045-43F0-A1592A86A417} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 13:23:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T13:23:41.867 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T13:26:30.214 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T13:28:21.122 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T13:28:21.122 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T13:28:21.122 [Cloud] Queued cloud request. 2026-10-01T13:28:21.122 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T13:28:21.122 [Cloud] Dequeued cloud request. 2026-10-01T13:28:21.122 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T13:28:21.340 [Cloud] End of cloud request. 2026-10-01T13:28:21.856 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T13:31:31.762 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T13:31:31.762 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T13:31:31.762 [Cloud] Queued cloud request. 2026-10-01T13:31:31.762 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T13:31:31.918 [Cloud] Dequeued cloud request. 2026-10-01T13:31:31.918 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T13:31:32.106 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C4FDCED5-BCB0-1B25-D74B-6F920DC8837F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 13:31:32 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T13:31:32.622 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T13:35:33.530 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T13:35:33.530 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T13:35:33.530 [Cloud] Queued cloud request. 2026-10-01T13:35:33.530 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T13:35:33.530 [Cloud] Dequeued cloud request. 2026-10-01T13:35:33.530 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T13:35:33.749 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{10DFDFB0-E44B-112C-EA12-4D53C3AE9640} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 13:35:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T13:35:34.264 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T13:40:28.345 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T13:40:28.345 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T13:40:28.345 [Cloud] Queued cloud request. 2026-10-01T13:40:28.345 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T13:40:28.345 [Cloud] Dequeued cloud request. 2026-10-01T13:40:28.345 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T13:40:28.548 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CD9C0AED-E58B-635C-7C2C-1A0A84D6DF4F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 13:40:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T13:40:29.048 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T13:41:35.221 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T13:42:25.034 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T13:42:25.034 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T13:42:25.034 [Cloud] Queued cloud request. 2026-10-01T13:42:25.034 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T13:42:25.034 [Cloud] Dequeued cloud request. 2026-10-01T13:42:25.034 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T13:42:25.190 [Cloud] End of cloud request. 2026-10-01T13:42:25.706 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T13:45:52.566 [RTP] [Mini-filter] Unsuccessful scan status(#16): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-41e-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #54289, FileId: 0xf00000003ba06, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T13:45:52.566 [RTP] [Mini-filter] Unsuccessful scan status(#15): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-41e-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #54288, FileId: 0x1000000003ba07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T13:45:53.488 [RTP] [Mini-filter] Unsuccessful scan status(#17): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-41f-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #54297, FileId: 0x1100000003ba07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T13:45:53.488 [RTP] [Mini-filter] Unsuccessful scan status(#18): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-41f-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #54298, FileId: 0x1000000003ba06, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T13:45:53.956 [RTP] [Mini-filter] Unsuccessful scan status(#19): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-420-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #54304, FileId: 0x1200000003ba07, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T13:45:53.956 [RTP] [Mini-filter] Unsuccessful scan status(#20): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-420-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #54305, FileId: 0x1100000003ba06, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T13:50:54.053 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T13:50:54.053 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T13:50:54.053 [Cloud] Queued cloud request. 2026-10-01T13:50:54.053 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T13:50:54.053 [Cloud] Dequeued cloud request. 2026-10-01T13:50:54.053 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T13:50:54.225 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FF7CAC58-6EB0-0170-628C-3E1125BE5B73} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 13:50:54 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T13:50:54.725 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T13:55:28.071 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T13:55:28.071 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T13:55:28.071 [Cloud] Queued cloud request. 2026-10-01T13:55:28.071 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T13:55:28.071 [Cloud] Dequeued cloud request. 2026-10-01T13:55:28.071 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T13:55:28.227 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6D08EC60-8C6D-48ED-C15A-EBCB42653CD0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 13:55:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T13:55:28.742 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T13:56:40.227 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T13:58:20.964 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T13:58:20.964 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T13:58:20.964 [Cloud] Queued cloud request. 2026-10-01T13:58:20.964 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T13:58:20.964 [Cloud] Dequeued cloud request. 2026-10-01T13:58:20.964 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T13:58:21.121 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{87543FC1-AC74-D7A4-B39D-2BF16B11AB28} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 13:58:21 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T13:58:21.636 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T14:07:12.172 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T14:07:12.172 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T14:07:12.172 [Cloud] Queued cloud request. 2026-10-01T14:07:12.172 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T14:07:12.344 [Cloud] Dequeued cloud request. 2026-10-01T14:07:12.531 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T14:07:22.656 [Cloud] End of cloud request. 2026-10-01T14:07:23.172 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T14:07:38.001 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T14:07:38.001 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T14:07:38.001 [Cloud] Queued cloud request. 2026-10-01T14:07:38.001 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T14:07:38.001 [Cloud] Dequeued cloud request. 2026-10-01T14:07:38.001 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T14:07:38.094 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4375B7A8-8574-F6F1-870F-383CA885B007} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 14:07:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T14:07:38.594 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T14:10:16.627 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T14:10:16.627 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T14:10:16.627 [Cloud] Queued cloud request. 2026-10-01T14:10:16.627 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T14:10:16.627 [Cloud] Dequeued cloud request. 2026-10-01T14:10:16.627 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T14:10:16.830 [Cloud] End of cloud request. 2026-10-01T14:10:17.330 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T14:11:45.237 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T14:17:07.003 ProcessImageName: httpd.exe, Pid: 4956, TotalTime: 350435, Count: 27821, MaxTime: 1687, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 4% 2026-10-01T14:17:07.003 ProcessImageName: AgentShell.exe, Pid: 4996, TotalTime: 1702, Count: 171, MaxTime: 31, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-10-01T14:17:07.003 ProcessImageName: taskhostw.exe, Pid: 3404, TotalTime: 1364, Count: 20, MaxTime: 890, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 51% 2026-10-01T14:17:07.003 ProcessImageName: svchost.exe, Pid: 2996, TotalTime: 708, Count: 16, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SysWOW64\wmp.dll, EstimatedImpact: 1% 2026-10-01T14:17:07.003 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 169, Count: 6, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\dpapisrv.dll, EstimatedImpact: 0% 2026-10-01T14:17:07.003 ProcessImageName: svchost.exe, Pid: 1668, TotalTime: 136, Count: 13, MaxTime: 46, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\UsoClient.exe, EstimatedImpact: 0% 2026-10-01T14:17:07.003 ProcessImageName: mysqld.exe, Pid: 2936, TotalTime: 120, Count: 15, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\wordpress_mampress\mampress_categories.ibd, EstimatedImpact: 0% 2026-10-01T14:17:07.003 ProcessImageName: AggregatorHost.exe, Pid: 4436, TotalTime: 75, Count: 7, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 4% 2026-10-01T14:17:07.003 ProcessImageName: MESMTPC.exe, Pid: 2896, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-10-01T14:17:07.003 ProcessImageName: dllhost.exe, Pid: 4600, TotalTime: 45, Count: 3, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-10-01T14:17:07.003 ProcessImageName: cmd.exe, Pid: 5508, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\timesync.bat, EstimatedImpact: 8% 2026-10-01T14:25:18.367 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T14:25:18.367 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T14:25:18.367 [Cloud] Queued cloud request. 2026-10-01T14:25:18.367 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T14:25:18.367 [Cloud] Dequeued cloud request. 2026-10-01T14:25:18.367 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T14:25:18.554 [Cloud] End of cloud request. 2026-10-01T14:25:19.070 [NRI] Successfully updated NIS service with platform settings for enforcement level Log BEGIN BM telemetry GUID:{37DE2BDC-3E3C-3A75-D541-409289A8CA8C} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:4956 ProcessCreationTime:134353299481302281 SessionID:0 CreationTime:10-01-2026 14:25:34 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T14:25:35.773 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T14:25:35.773 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T14:25:35.773 [Cloud] Queued cloud request. 2026-10-01T14:25:35.773 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T14:25:35.773 [Cloud] Dequeued cloud request. 2026-10-01T14:25:35.773 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T14:25:35.851 [Cloud] End of cloud request. 2026-10-01T14:25:36.367 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T14:26:50.242 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T14:31:30.464 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T14:31:30.464 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T14:31:30.464 [Cloud] Queued cloud request. 2026-10-01T14:31:30.464 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T14:31:30.464 [Cloud] Dequeued cloud request. 2026-10-01T14:31:30.464 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T14:31:30.652 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{C553049B-A236-A4DD-A87D-25BD33B28374} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 14:31:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T14:31:31.167 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T14:32:22.667 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T14:32:22.667 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T14:32:22.667 [Cloud] Queued cloud request. 2026-10-01T14:32:22.667 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T14:32:22.667 [Cloud] Dequeued cloud request. 2026-10-01T14:32:22.667 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T14:32:22.776 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{504AEAFA-D6B9-6288-90E4-AB3377864106} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 14:32:22 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T14:32:23.277 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T14:38:23.031 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T14:38:23.031 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T14:38:23.031 [Cloud] Queued cloud request. 2026-10-01T14:38:23.031 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T14:38:23.031 [Cloud] Dequeued cloud request. 2026-10-01T14:38:23.031 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T14:38:23.219 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E976D33E-8022-CC5B-0C6B-77BC6A2C5034} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 14:38:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T14:38:23.719 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T14:38:28.860 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T14:38:28.860 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T14:38:28.860 [Cloud] Queued cloud request. 2026-10-01T14:38:28.860 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T14:38:28.860 [Cloud] Dequeued cloud request. 2026-10-01T14:38:28.860 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T14:38:28.953 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{965DB749-432A-F3C5-49DE-968C36A52C94} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 14:38:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T14:38:29.469 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T14:41:55.251 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T14:47:17.346 Bm signature throttled:0x000135b39c9104ce 2026-10-01T14:57:00.258 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T15:01:13.526 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T15:01:13.526 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T15:01:13.526 [Cloud] Queued cloud request. 2026-10-01T15:01:13.526 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T15:01:13.526 [Cloud] Dequeued cloud request. 2026-10-01T15:01:13.526 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T15:01:13.698 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{A1BBFDB8-24AD-9DCD-CD75-D039E154094D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 15:01:13 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T15:01:14.213 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T15:12:05.267 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T15:20:28.426 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T15:20:28.426 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T15:20:28.426 [Cloud] Queued cloud request. 2026-10-01T15:20:28.426 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T15:20:28.426 [Cloud] Dequeued cloud request. 2026-10-01T15:20:28.426 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T15:20:28.583 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{F9C99A2B-3827-719C-84E7-B8BDCAB7E046} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 15:20:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T15:20:29.098 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T15:21:31.708 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T15:21:31.708 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T15:21:31.708 [Cloud] Queued cloud request. 2026-10-01T15:21:31.708 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T15:21:31.708 [Cloud] Dequeued cloud request. 2026-10-01T15:21:31.708 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T15:21:31.864 [Cloud] End of cloud request. 2026-10-01T15:21:32.364 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T15:25:24.320 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T15:25:24.320 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T15:25:24.320 [Cloud] Queued cloud request. 2026-10-01T15:25:24.320 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T15:25:24.320 [Cloud] Dequeued cloud request. 2026-10-01T15:25:24.320 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T15:25:24.507 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2F5F3E7C-CB64-11D8-6BFD-AB4BE5249532} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 15:25:24 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T15:25:25.023 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T15:25:30.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T15:25:30.445 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T15:25:30.445 [Cloud] Queued cloud request. 2026-10-01T15:25:30.445 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T15:25:30.445 [Cloud] Dequeued cloud request. 2026-10-01T15:25:30.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T15:25:38.492 [Cloud] End of cloud request. 2026-10-01T15:25:39.007 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T15:27:10.273 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T15:27:18.445 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T15:27:18.445 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T15:27:18.445 [Cloud] Queued cloud request. 2026-10-01T15:27:18.445 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T15:27:18.445 [Cloud] Dequeued cloud request. 2026-10-01T15:27:18.445 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T15:27:18.586 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{D430A87D-8BC7-9180-75E8-C0CD54F8C59B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 15:27:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T15:27:19.086 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T15:34:07.590 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T15:34:07.590 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T15:34:07.590 [Cloud] Queued cloud request. 2026-10-01T15:34:07.590 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T15:34:07.590 [Cloud] Dequeued cloud request. 2026-10-01T15:34:07.590 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T15:34:07.793 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{921E795A-2C36-4ACD-D69A-538EF4535952} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 15:34:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T15:34:08.309 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T15:39:16.077 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T15:39:16.077 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T15:39:16.077 [Cloud] Queued cloud request. 2026-10-01T15:39:16.077 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T15:39:16.077 [Cloud] Dequeued cloud request. 2026-10-01T15:39:16.077 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T15:39:16.249 [Cloud] End of cloud request. 2026-10-01T15:39:16.765 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T15:41:05.561 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T15:41:05.561 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T15:41:05.561 [Cloud] Queued cloud request. 2026-10-01T15:41:05.561 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T15:41:05.561 [Cloud] Dequeued cloud request. 2026-10-01T15:41:05.561 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T15:41:05.749 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B43288A1-CCEC-646A-7ADC-DD2BB1EBA262} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 15:41:05 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T15:41:06.265 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T15:42:15.282 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T15:46:31.315 Bm signature throttled:0x000135b39c9104ce 2026-10-01T15:57:20.288 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T15:58:30.072 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T15:58:30.072 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T15:58:30.072 [Cloud] Queued cloud request. 2026-10-01T15:58:30.072 [Cloud] Dequeued cloud request. 2026-10-01T15:58:30.072 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T15:58:30.072 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T15:58:30.259 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{BEC55468-2958-BC38-00F7-A100B0FF9259} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 15:58:30 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T15:58:30.759 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T15:59:14.618 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T15:59:14.618 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T15:59:14.618 [Cloud] Queued cloud request. 2026-10-01T15:59:14.618 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T15:59:14.618 [Cloud] Dequeued cloud request. 2026-10-01T15:59:14.618 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T15:59:14.697 [Cloud] End of cloud request. 2026-10-01T15:59:15.197 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T16:03:10.745 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T16:03:10.745 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T16:03:10.745 [Cloud] Queued cloud request. 2026-10-01T16:03:10.745 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T16:03:10.745 [Cloud] Dequeued cloud request. 2026-10-01T16:03:10.745 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{84CCE757-1C5F-75D4-DD53-011C313FABF0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 16:03:10 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T16:03:10.901 [Cloud] End of cloud request. 2026-10-01T16:03:11.401 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T16:07:27.075 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T16:07:27.075 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T16:07:27.075 [Cloud] Queued cloud request. 2026-10-01T16:07:27.075 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T16:07:27.075 [Cloud] Dequeued cloud request. 2026-10-01T16:07:27.075 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T16:07:27.232 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{CA87DB9E-C2BC-9901-8D77-F98C164F32F9} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 16:07:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T16:07:27.747 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T16:12:25.297 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T16:14:16.454 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T16:14:16.454 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T16:14:16.454 [Cloud] Queued cloud request. 2026-10-01T16:14:16.454 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T16:14:16.454 [Cloud] Dequeued cloud request. 2026-10-01T16:14:16.454 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T16:14:16.610 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4440966F-035D-4AC6-B435-1E33010482C6} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 16:14:16 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T16:14:17.110 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T16:17:07.079 ProcessImageName: httpd.exe, Pid: 4956, TotalTime: 495633, Count: 38680, MaxTime: 1687, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 3% 2026-10-01T16:17:07.079 ProcessImageName: AgentShell.exe, Pid: 4996, TotalTime: 3699, Count: 338, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-10-01T16:17:07.079 ProcessImageName: taskhostw.exe, Pid: 3404, TotalTime: 1364, Count: 20, MaxTime: 890, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 51% 2026-10-01T16:17:07.079 ProcessImageName: svchost.exe, Pid: 2996, TotalTime: 708, Count: 16, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SysWOW64\wmp.dll, EstimatedImpact: 1% 2026-10-01T16:17:07.079 ProcessImageName: svchost.exe, Pid: 1668, TotalTime: 275, Count: 17, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\sc.exe, EstimatedImpact: 0% 2026-10-01T16:17:07.079 ProcessImageName: mysqld.exe, Pid: 2936, TotalTime: 240, Count: 33, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\wordpress_mampress\mampress_categories.ibd, EstimatedImpact: 0% 2026-10-01T16:17:07.079 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 169, Count: 6, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\dpapisrv.dll, EstimatedImpact: 0% 2026-10-01T16:17:07.079 ProcessImageName: AggregatorHost.exe, Pid: 4436, TotalTime: 75, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-10-01T16:17:07.079 ProcessImageName: dllhost.exe, Pid: 4600, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-10-01T16:17:07.079 ProcessImageName: MESMTPC.exe, Pid: 2896, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-10-01T16:17:07.079 ProcessImageName: cmd.exe, Pid: 5508, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\timesync.bat, EstimatedImpact: 8% 2026-10-01T16:27:30.305 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{EF7A270C-D29F-206E-BA1F-5A133926EC12} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:4956 ProcessCreationTime:134353299481302281 SessionID:0 CreationTime:10-01-2026 16:41:06 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T16:41:06.732 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T16:41:06.732 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T16:41:06.732 [Cloud] Queued cloud request. 2026-10-01T16:41:06.732 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T16:41:06.732 [Cloud] Dequeued cloud request. 2026-10-01T16:41:06.732 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T16:41:06.842 [Cloud] End of cloud request. 2026-10-01T16:41:07.373 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T16:41:56.639 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T16:41:56.639 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T16:41:56.639 [Cloud] Queued cloud request. 2026-10-01T16:41:56.639 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T16:41:56.639 [Cloud] Dequeued cloud request. 2026-10-01T16:41:56.639 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T16:41:56.717 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{26ADEEF6-FF38-5B83-5D3C-2E0BB49049AA} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 16:41:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T16:41:57.217 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T16:42:35.311 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T16:43:31.061 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T16:43:31.061 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T16:43:31.061 [Cloud] Queued cloud request. 2026-10-01T16:43:31.061 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T16:43:31.061 [Cloud] Dequeued cloud request. 2026-10-01T16:43:31.061 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T16:43:31.217 [Cloud] End of cloud request. 2026-10-01T16:43:31.732 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T16:45:02.046 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T16:45:02.046 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T16:45:02.046 [Cloud] Queued cloud request. 2026-10-01T16:45:02.046 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T16:45:02.046 [Cloud] Dequeued cloud request. 2026-10-01T16:45:02.046 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 BEGIN BM telemetry GUID:{00FCFB95-4029-238C-4E97-3080F9ABD6D0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 16:45:02 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T16:45:02.186 [Cloud] End of cloud request. 2026-10-01T16:45:02.686 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T16:46:52.891 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T16:46:52.891 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T16:46:52.891 [Cloud] Queued cloud request. 2026-10-01T16:46:52.891 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T16:46:52.891 [Cloud] Dequeued cloud request. 2026-10-01T16:46:52.891 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T16:46:53.031 [Cloud] End of cloud request. 2026-10-01T16:46:53.532 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T16:57:40.320 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T17:03:00.837 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T17:03:00.837 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T17:03:00.837 [Cloud] Queued cloud request. 2026-10-01T17:03:00.837 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T17:03:00.837 [Cloud] Dequeued cloud request. 2026-10-01T17:03:00.837 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T17:03:01.165 [Cloud] End of cloud request. 2026-10-01T17:03:01.665 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:12:45.328 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T17:18:07.659 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T17:18:07.659 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T17:18:07.659 [Cloud] Queued cloud request. 2026-10-01T17:18:07.659 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T17:18:07.659 [Cloud] Dequeued cloud request. 2026-10-01T17:18:07.659 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T17:18:07.800 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{968C5801-3AA9-42F2-24A0-4E0D9A8BD05F} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 17:18:07 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T17:18:08.300 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:18:18.206 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T17:18:18.206 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T17:18:18.206 [Cloud] Queued cloud request. 2026-10-01T17:18:18.206 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T17:18:18.206 [Cloud] Dequeued cloud request. 2026-10-01T17:18:18.206 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T17:18:18.284 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{B2648B7B-E969-3EE8-024D-1BBFD29E4BD7} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 17:18:18 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T17:18:18.800 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:27:50.336 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T17:31:04.945 [RTP] [Mini-filter] Unsuccessful scan status(#21): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-1781-81.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #141178, FileId: 0x1400000005d7eb, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T17:31:04.945 [RTP] [Mini-filter] Unsuccessful scan status(#22): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-1781-81.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #141180, FileId: 0x1c00000003c63b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T17:31:05.555 [RTP] [Mini-filter] Unsuccessful scan status(#24): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-1781-82.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #141191, FileId: 0x1d00000003c63b, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T17:31:05.555 [RTP] [Mini-filter] Unsuccessful scan status(#23): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-1781-82.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #141190, FileId: 0x1500000005d7eb, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T17:32:24.789 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T17:32:24.789 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T17:32:24.789 [Cloud] Queued cloud request. 2026-10-01T17:32:24.789 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T17:32:24.789 [Cloud] Dequeued cloud request. 2026-10-01T17:32:24.789 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T17:32:26.149 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{15140F30-F771-2030-DEDF-9AA5B7C2DEAC} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 17:32:26 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T17:32:26.664 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:32:35.914 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T17:32:35.914 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T17:32:35.914 [Cloud] Queued cloud request. 2026-10-01T17:32:35.914 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T17:32:35.914 [Cloud] Dequeued cloud request. 2026-10-01T17:32:35.914 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T17:32:35.992 [Cloud] End of cloud request. 2026-10-01T17:32:36.492 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:34:41.666 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T17:34:41.666 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T17:34:41.666 [Cloud] Queued cloud request. 2026-10-01T17:34:41.666 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T17:34:41.666 [Cloud] Dequeued cloud request. 2026-10-01T17:34:41.666 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T17:34:41.854 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{18CC1A5B-F19E-4B6C-C906-5A3EF6806BC0} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 17:34:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T17:34:42.354 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:35:13.088 [NRI] Successfully updated NIS service with platform settings for enforcement level Log IDynamicConfig::ReportError ECS value=EnableAdsSymlinkMitigation_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableBmProcessInfoMetastoreMaintenance_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=EnableCIWorkaroundOnCFAEnabled_MpRamp hr=0x8007007b IDynamicConfig::ReportError ECS value=MdDisableResController hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerInitalDelay hr=0x800700d4 IDynamicConfig::ReportError ECS value=MdTimerMonitorInterval hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpCopyAcceleratorCancellableCopyState hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisablePropBagNotification hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnableNoMetaStoreProcessInfoContainer hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpEnablePurgeHipsCache hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpForceDllHostScanExeOnOpen hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpDisableResourceMonitoring hr=0x8007007b IDynamicConfig::ReportError ECS value=EnableThreatIdKeyForSigExpiry_MpRamp hr=0x800700d4 IDynamicConfig::ReportError ECS value=MpFC_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=NIS_DisableTransportCallouts hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDlpClipboardSettings hr=0x8007007b IDynamicConfig::ReportError ECS value=MpDisablePerProcessLoopbackTraffic hr=0x800700d4 IDynamicConfig::ReportChange ECS value=MpFC_NisSrvWatchDogTimeoutSeconds new=120 old60 2026-10-01T17:35:13.120 [RTP] [Mini-filter] MpFC: MpFC_Kernel_HardenUxProcesses=0;MpFC_Kernel_SystemIoRequestWorkOnBehalfOf=0x1;MpFC_Kernel_PreventBindfltAbuse=0x1;MpFC_Kernel_ParentProcessObHardeningAllow=0;MpFC_Kernel_ReduceOfficeInjectRuleFP=0x1;MPC_Kernel_CheckValidityOfProcessFilterFlagsInASR=0x1;MpFc_Kernel_UseLowPrioThreadsForAsyncScans=0x1;MpFc_Kernel_DisableFileDirtyLogic=0;MpFC_Kernel_DisableDLPPort=0x1;MpFC_Kernel_DlpFeatures=0;MpFC_Kernel_EnableFolderGuardOnPostCreate=0x1;MpFC_Kernel_StrictTiChildrenMatch=0;MpFC_Kernel_PPLReduxMitigationFlags=0x3;MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly=0x1;MpFc_Kernel_DisableOfficeInjectUevSuppression=0x1;MpFc_Kernel_CopyChunkFileHintMask=0;MpFc_Kernel_DisableScanOnCloseForNetworkFiles=0x1;MpFc_Kernel_MaxAsyncWorkQueue=0x400;MpFc_Kernel_DlpIgnoreSystemFolder=0x1;MpFc_Kernel_DlpPassThroughMode=0;MpFc_Kernel_L2StateCache_DefaultStreamsOnly=0x1;MpFc_Kernel_L2StateCache_SupportGenericFileState=0x1;MpFc_Kernel_CryptSvcPreScanFilter=0x1;MpFc_Kernel_SystemPreScanFilter=0x1;MpFC_Kernel_CheckValidit 2026-10-01T17:35:13.135 MpPlatformKillbitsFromEngine (0x4000000) written, hr = 0 2026-10-01T17:35:13.135 MpPlatformKillbitsFromEngineEx (0x0) (0x0) written, hr = 0 2026-10-01T17:35:13.135 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:35:13.135 Failed to retrieve config value from engine or configurations for config key (MdCpuSensorCollectionLag) hr = 0x8050800f 2026-10-01T17:35:13.135 Failed to retrieve config value from engine or configurations for config key (MdCrashSensorCollectionLag) hr = 0x8050800f 2026-10-01T17:35:13.135 Failed to retrieve config value from engine or configurations for config key (MdDiskSensorCollectionLag) hr = 0x8050800f 2026-10-01T17:35:13.135 Failed to retrieve config value from engine or configurations for config key (MdMemorySensorCollectionLag) hr = 0x8050800f 2026-10-01T17:35:13.135 MdCoreSvc is supported in this platform and OS 2026-10-01T17:35:13.588 [KSL] Entering CKSLEngine::EnableKSL. State: [3] 2026-10-01T17:35:13.588 [KSL] CKSLEngine::EnableKSL feature is already enabled. 2026-10-01T17:35:13.588 [KSL] Leaving CKSLEngine::EnableKsl(0). 2026-10-01T17:36:40.637 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T17:36:40.637 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T17:36:40.637 [Cloud] Queued cloud request. 2026-10-01T17:36:40.637 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T17:36:40.637 [Cloud] Dequeued cloud request. 2026-10-01T17:36:40.637 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T17:36:40.809 [Cloud] End of cloud request. 2026-10-01T17:36:41.324 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:40:34.342 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T17:40:34.342 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T17:40:34.342 [Cloud] Queued cloud request. 2026-10-01T17:40:34.342 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T17:40:34.342 [Cloud] Dequeued cloud request. 2026-10-01T17:40:34.342 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T17:40:34.529 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{8F8533C8-15A8-D73B-D1CA-75F28283D5A3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 17:40:34 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T17:40:35.029 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:42:55.342 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T17:43:49.155 Bm signature throttled:0x000135b39c9104ce 2026-10-01T17:45:15.780 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T17:45:15.780 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T17:45:15.780 [Cloud] Queued cloud request. 2026-10-01T17:45:15.780 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T17:45:15.780 [Cloud] Dequeued cloud request. 2026-10-01T17:45:15.780 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T17:45:15.967 [Cloud] End of cloud request. 2026-10-01T17:45:16.467 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:45:30.498 [RTP] [Mini-filter] Unsuccessful scan status(#25): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #147038, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T17:45:32.170 [RTP] [Mini-filter] Unsuccessful scan status(#26): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #147123, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T17:45:32.295 [RTP] [Mini-filter] Unsuccessful scan status(#27): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #147131, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T17:45:33.576 [RTP] [Mini-filter] Unsuccessful scan status(#28): \Device\HarddiskVolume2\Windows\SystemTemp\msedge_installer.log. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #147139, FileId: 0x1600000006319f, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T17:49:56.314 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T17:49:56.314 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T17:49:56.314 [Cloud] Queued cloud request. 2026-10-01T17:49:56.314 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T17:49:56.314 [Cloud] Dequeued cloud request. 2026-10-01T17:49:56.314 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T17:49:56.611 [Cloud] End of cloud request. 2026-10-01T17:49:57.111 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:53:20.207 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T17:53:20.207 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T17:53:20.207 [Cloud] Queued cloud request. 2026-10-01T17:53:20.207 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T17:53:20.207 [Cloud] Dequeued cloud request. 2026-10-01T17:53:20.207 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T17:53:30.332 [Cloud] End of cloud request. 2026-10-01T17:53:30.832 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:56:17.301 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T17:56:17.301 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T17:56:17.301 [Cloud] Queued cloud request. 2026-10-01T17:56:17.301 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T17:56:17.301 [Cloud] Dequeued cloud request. 2026-10-01T17:56:17.301 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T17:56:17.504 [Cloud] End of cloud request. 2026-10-01T17:56:18.020 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T17:58:00.351 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T18:08:37.653 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:08:37.653 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:08:37.653 [Cloud] Queued cloud request. 2026-10-01T18:08:37.653 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:08:37.653 [Cloud] Dequeued cloud request. 2026-10-01T18:08:37.653 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:08:37.981 [Cloud] End of cloud request. 2026-10-01T18:08:38.496 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:10:26.762 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:10:26.762 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:10:26.762 [Cloud] Queued cloud request. 2026-10-01T18:10:26.762 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:10:26.762 [Cloud] Dequeued cloud request. 2026-10-01T18:10:26.762 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:10:27.012 [Cloud] End of cloud request. 2026-10-01T18:10:27.512 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:10:50.137 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:10:50.137 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:10:50.137 [Cloud] Queued cloud request. 2026-10-01T18:10:50.137 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:10:50.137 [Cloud] Dequeued cloud request. 2026-10-01T18:10:50.137 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:10:50.215 [Cloud] End of cloud request. 2026-10-01T18:10:50.715 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:12:06.356 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:12:06.356 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:12:06.356 [Cloud] Queued cloud request. 2026-10-01T18:12:06.356 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:12:06.356 [Cloud] Dequeued cloud request. 2026-10-01T18:12:06.356 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:12:06.559 [Cloud] End of cloud request. 2026-10-01T18:12:07.059 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:13:05.357 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{8C11B32E-3A8C-90C7-C470-215D78E313B9} SignatureID:55746285003867 SigSha:053433b4a1fafc4ab1360d4cde5d44f8ae7ac8df ThreatLevel:0 ProcessID:2896 ProcessCreationTime:134353299418586933 SessionID:0 CreationTime:10-01-2026 18:14:12 ImagePath:C:\Program Files (x86)\Mail Enable\Bin64\MESMTPC.exe Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T18:14:14.140 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:14:14.140 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:14:14.140 [Cloud] Queued cloud request. 2026-10-01T18:14:14.140 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:14:14.140 [Cloud] Dequeued cloud request. 2026-10-01T18:14:14.140 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:14:14.468 [Cloud] End of cloud request. 2026-10-01T18:14:14.968 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:15:03.640 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:15:03.640 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:15:03.640 [Cloud] Queued cloud request. 2026-10-01T18:15:03.640 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:15:03.640 [Cloud] Dequeued cloud request. 2026-10-01T18:15:03.640 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:15:03.718 [Cloud] End of cloud request. 2026-10-01T18:15:04.233 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:15:19.952 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:15:19.952 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:15:19.952 [Cloud] Queued cloud request. 2026-10-01T18:15:19.952 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:15:19.952 [Cloud] Dequeued cloud request. 2026-10-01T18:15:19.952 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:15:20.124 [Cloud] End of cloud request. 2026-10-01T18:15:20.640 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:16:07.765 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:16:07.765 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:16:07.765 [Cloud] Queued cloud request. 2026-10-01T18:16:07.765 [Cloud] Dequeued cloud request. 2026-10-01T18:16:07.765 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:16:07.765 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:16:07.843 [Cloud] End of cloud request. 2026-10-01T18:16:08.343 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:16:30.702 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:16:30.702 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:16:30.702 [Cloud] Queued cloud request. 2026-10-01T18:16:30.702 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:16:30.702 [Cloud] Dequeued cloud request. 2026-10-01T18:16:30.702 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:16:30.812 [Cloud] End of cloud request. 2026-10-01T18:16:31.312 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:17:07.155 ProcessImageName: httpd.exe, Pid: 4956, TotalTime: 562756, Count: 43558, MaxTime: 1687, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 2% 2026-10-01T18:17:07.155 ProcessImageName: setup.exe, Pid: 6696, TotalTime: 12997, Count: 688, MaxTime: 4953, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\154.0.4258.48\msedge.dll, EstimatedImpact: 17% 2026-10-01T18:17:07.155 ProcessImageName: AgentShell.exe, Pid: 4996, TotalTime: 5760, Count: 508, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-10-01T18:17:07.155 ProcessImageName: taskhostw.exe, Pid: 3404, TotalTime: 1364, Count: 20, MaxTime: 890, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 51% 2026-10-01T18:17:07.155 ProcessImageName: svchost.exe, Pid: 2996, TotalTime: 708, Count: 16, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SysWOW64\wmp.dll, EstimatedImpact: 1% 2026-10-01T18:17:07.155 ProcessImageName: svchost.exe, Pid: 1668, TotalTime: 320, Count: 23, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\sc.exe, EstimatedImpact: 0% 2026-10-01T18:17:07.155 ProcessImageName: mysqld.exe, Pid: 2936, TotalTime: 315, Count: 43, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\wordpress_mampress\mampress_categories.ibd, EstimatedImpact: 0% 2026-10-01T18:17:07.155 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 169, Count: 6, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\dpapisrv.dll, EstimatedImpact: 0% 2026-10-01T18:17:07.155 ProcessImageName: MicrosoftEdge_X64_154.0.4258.48_154.0.4258.37.exe, Pid: 1300, TotalTime: 155, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8AE813B7-4F41-42D0-B229-5D39E4C3B73F}\EDGEMITMP_58D38.tmp\setup.exe, EstimatedImpact: 76% 2026-10-01T18:17:07.155 ProcessImageName: svchost.exe, Pid: 6640, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ngcrecovery.dll, EstimatedImpact: 24% 2026-10-01T18:17:07.155 ProcessImageName: dllhost.exe, Pid: 4600, TotalTime: 90, Count: 6, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-10-01T18:17:07.155 ProcessImageName: AggregatorHost.exe, Pid: 4436, TotalTime: 75, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-10-01T18:17:07.155 ProcessImageName: MESMTPC.exe, Pid: 2896, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-10-01T18:17:07.155 ProcessImageName: cmd.exe, Pid: 5508, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\timesync.bat, EstimatedImpact: 8% 2026-10-01T18:17:19.781 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:17:19.781 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:17:19.781 [Cloud] Queued cloud request. 2026-10-01T18:17:19.781 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:17:19.781 [Cloud] Dequeued cloud request. 2026-10-01T18:17:19.781 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:17:19.859 [Cloud] End of cloud request. 2026-10-01T18:17:20.375 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:17:26.953 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:17:26.953 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:17:26.953 [Cloud] Queued cloud request. 2026-10-01T18:17:26.953 [Cloud] Dequeued cloud request. 2026-10-01T18:17:26.953 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:17:26.953 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:17:27.031 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{47A256EC-76BE-7C0C-9F80-945A8D5FB508} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 18:17:27 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T18:17:27.547 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:17:51.954 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:17:51.954 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:17:51.954 [Cloud] Queued cloud request. 2026-10-01T18:17:51.954 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:17:51.954 [Cloud] Dequeued cloud request. 2026-10-01T18:17:51.954 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:17:52.048 [Cloud] End of cloud request. 2026-10-01T18:17:52.564 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:18:38.892 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:18:38.892 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:18:38.892 [Cloud] Queued cloud request. 2026-10-01T18:18:38.892 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:18:38.892 [Cloud] Dequeued cloud request. 2026-10-01T18:18:38.892 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:18:38.970 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{54F7A5D4-8C4C-1E14-ABED-44D9522B516B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 18:18:38 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T18:18:39.486 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:19:06.611 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:19:06.611 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:19:06.611 [Cloud] Queued cloud request. 2026-10-01T18:19:06.611 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:19:06.611 [Cloud] Dequeued cloud request. 2026-10-01T18:19:06.611 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:19:06.689 [Cloud] End of cloud request. 2026-10-01T18:19:07.189 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:21:05.439 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:21:05.439 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:21:05.439 [Cloud] Queued cloud request. 2026-10-01T18:21:05.439 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:21:05.642 [Cloud] Dequeued cloud request. 2026-10-01T18:21:05.830 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:21:06.017 [Cloud] End of cloud request. 2026-10-01T18:21:06.517 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:21:20.923 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:21:20.923 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:21:20.923 [Cloud] Queued cloud request. 2026-10-01T18:21:20.923 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:21:20.923 [Cloud] Dequeued cloud request. 2026-10-01T18:21:20.923 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:21:21.017 [Cloud] End of cloud request. 2026-10-01T18:21:21.517 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:23:00.955 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:23:00.955 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:23:00.955 [Cloud] Queued cloud request. 2026-10-01T18:23:00.955 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:23:00.955 [Cloud] Dequeued cloud request. 2026-10-01T18:23:00.955 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:23:01.158 [Cloud] End of cloud request. 2026-10-01T18:23:01.674 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:24:55.957 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:24:55.957 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:24:55.957 [Cloud] Queued cloud request. 2026-10-01T18:24:55.957 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:24:55.957 [Cloud] Dequeued cloud request. 2026-10-01T18:24:55.957 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:24:56.160 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{6FAFE477-759F-8AA2-8315-4A32CA1E48EB} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 18:24:56 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T18:24:56.660 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:25:04.738 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:25:04.738 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:25:04.738 [Cloud] Queued cloud request. 2026-10-01T18:25:04.738 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:25:04.738 [Cloud] Dequeued cloud request. 2026-10-01T18:25:04.738 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:25:04.817 [Cloud] End of cloud request. 2026-10-01T18:25:05.317 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:25:11.848 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:25:11.848 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:25:11.848 [Cloud] Queued cloud request. 2026-10-01T18:25:11.848 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:25:11.848 [Cloud] Dequeued cloud request. 2026-10-01T18:25:11.848 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:25:11.926 [Cloud] End of cloud request. 2026-10-01T18:25:12.426 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:25:28.317 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:25:28.317 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:25:28.317 [Cloud] Queued cloud request. 2026-10-01T18:25:28.317 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:25:28.317 [Cloud] Dequeued cloud request. 2026-10-01T18:25:28.317 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:25:28.395 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{16465824-C2F4-6D11-81DE-56F0C3E4501E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 18:25:28 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T18:25:28.895 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:26:56.754 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:26:56.754 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:26:56.754 [Cloud] Queued cloud request. 2026-10-01T18:26:56.754 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:26:56.754 [Cloud] Dequeued cloud request. 2026-10-01T18:26:56.754 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:27:06.879 [Cloud] End of cloud request. 2026-10-01T18:27:07.379 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:28:10.366 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T18:28:56.631 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:28:56.631 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:28:56.631 [Cloud] Queued cloud request. 2026-10-01T18:28:56.631 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:28:56.631 [Cloud] Dequeued cloud request. 2026-10-01T18:28:56.631 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:28:56.819 [Cloud] End of cloud request. 2026-10-01T18:28:57.319 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:33:11.194 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:33:11.194 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:33:11.194 [Cloud] Queued cloud request. 2026-10-01T18:33:11.194 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:33:11.194 [Cloud] Dequeued cloud request. 2026-10-01T18:33:11.194 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:33:19.459 [Cloud] End of cloud request. 2026-10-01T18:33:19.959 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:33:54.179 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:33:54.179 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:33:54.179 [Cloud] Queued cloud request. 2026-10-01T18:33:54.179 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:33:54.179 [Cloud] Dequeued cloud request. 2026-10-01T18:33:54.179 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:33:54.273 [Cloud] End of cloud request. 2026-10-01T18:33:54.773 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:35:26.119 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:35:26.119 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:35:26.119 [Cloud] Queued cloud request. 2026-10-01T18:35:26.119 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:35:26.119 [Cloud] Dequeued cloud request. 2026-10-01T18:35:26.119 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:35:26.353 [Cloud] End of cloud request. 2026-10-01T18:35:26.869 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:39:22.089 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:39:22.089 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:39:22.089 [Cloud] Queued cloud request. 2026-10-01T18:39:22.089 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:39:22.089 [Cloud] Dequeued cloud request. 2026-10-01T18:39:22.089 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:39:32.167 [Cloud] End of cloud request. 2026-10-01T18:39:32.683 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:39:35.839 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:39:35.839 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:39:35.839 [Cloud] Queued cloud request. 2026-10-01T18:39:35.839 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:39:35.839 [Cloud] Dequeued cloud request. 2026-10-01T18:39:35.839 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:39:35.917 [Cloud] End of cloud request. 2026-10-01T18:39:36.417 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:40:04.417 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:40:04.417 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:40:04.417 [Cloud] Queued cloud request. 2026-10-01T18:40:04.417 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:40:04.417 [Cloud] Dequeued cloud request. 2026-10-01T18:40:04.417 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:40:04.511 [Cloud] End of cloud request. 2026-10-01T18:40:05.011 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:42:05.777 [RTP] [Mini-filter] Unsuccessful scan status(#30): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-1a06-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #167321, FileId: 0x1a000000038c44, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T18:42:05.777 [RTP] [Mini-filter] Unsuccessful scan status(#29): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-1a06-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #167320, FileId: 0x1800000003d7fd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T18:42:42.964 [RTP] [Mini-filter] Unsuccessful scan status(#32): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-1a18-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #167524, FileId: 0x1b000000038c44, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T18:42:42.964 [RTP] [Mini-filter] Unsuccessful scan status(#31): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-1a18-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #167523, FileId: 0x1900000003d7fd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T18:43:02.183 [RTP] [Mini-filter] Unsuccessful scan status(#34): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-1a21-0.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #167642, FileId: 0x1c000000038c44, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T18:43:02.183 [RTP] [Mini-filter] Unsuccessful scan status(#33): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-1a21-0.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #167641, FileId: 0x1a00000003d7fd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T18:43:15.370 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T18:43:26.621 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:43:26.621 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:43:26.621 [Cloud] Queued cloud request. 2026-10-01T18:43:26.621 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:43:26.621 [Cloud] Dequeued cloud request. 2026-10-01T18:43:26.621 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:43:27.027 [Cloud] End of cloud request. 2026-10-01T18:43:27.027 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:43:27.027 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:43:27.027 [Cloud] Queued cloud request. 2026-10-01T18:43:27.027 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:43:27.027 [Cloud] Dequeued cloud request. 2026-10-01T18:43:27.027 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:43:27.527 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:43:30.339 [RTP] [Mini-filter] Unsuccessful scan status(#36): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-1a2d-1.MAI. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #167795, FileId: 0x1d000000038c44, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 2026-10-01T18:43:30.339 [RTP] [Mini-filter] Unsuccessful scan status(#35): \Device\HarddiskVolume2\Windows\ServiceProfiles\MariaDB\AppData\Local\Temp\#sql-temptable-b78-1a2d-1.MAD. Process: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\bin\mysqld.exe, Status: 0xc0000001, State: 0, ScanRequest #167794, FileId: 0x1b00000003d7fd, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x1, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0 BEGIN BM telemetry GUID:{CDD5869F-18D8-FD45-0EB4-0FD204A5C5DD} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 18:43:31 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T18:43:37.042 [Cloud] End of cloud request. 2026-10-01T18:43:37.542 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:44:20.654 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:44:20.654 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:44:20.654 [Cloud] Queued cloud request. 2026-10-01T18:44:20.654 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:44:20.654 [Cloud] Dequeued cloud request. 2026-10-01T18:44:20.654 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:44:20.732 [Cloud] End of cloud request. 2026-10-01T18:44:21.232 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:52:36.283 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:52:36.283 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:52:36.283 [Cloud] Queued cloud request. 2026-10-01T18:52:36.283 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:52:36.283 [Cloud] Dequeued cloud request. 2026-10-01T18:52:36.283 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:52:36.440 [Cloud] End of cloud request. 2026-10-01T18:52:36.940 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:54:05.346 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:54:05.346 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:54:05.346 [Cloud] Queued cloud request. 2026-10-01T18:54:05.346 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:54:05.346 [Cloud] Dequeued cloud request. 2026-10-01T18:54:05.346 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:54:05.533 [Cloud] End of cloud request. 2026-10-01T18:54:06.033 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:54:40.643 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:54:40.643 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:54:40.643 [Cloud] Queued cloud request. 2026-10-01T18:54:40.643 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:54:40.643 [Cloud] Dequeued cloud request. 2026-10-01T18:54:40.726 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:54:41.315 [Cloud] End of cloud request. 2026-10-01T18:54:42.033 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:57:23.785 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T18:57:23.785 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T18:57:23.785 [Cloud] Queued cloud request. 2026-10-01T18:57:23.785 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T18:57:23.785 [Cloud] Dequeued cloud request. 2026-10-01T18:57:23.785 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T18:57:33.942 [Cloud] End of cloud request. 2026-10-01T18:57:34.458 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T18:58:20.381 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T19:01:32.304 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:01:32.304 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:01:32.304 [Cloud] Queued cloud request. 2026-10-01T19:01:32.304 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:01:32.304 [Cloud] Dequeued cloud request. 2026-10-01T19:01:32.304 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:01:42.444 [Cloud] End of cloud request. 2026-10-01T19:01:42.960 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:04:24.446 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:04:24.446 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:04:24.446 [Cloud] Queued cloud request. 2026-10-01T19:04:24.446 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:04:24.446 [Cloud] Dequeued cloud request. 2026-10-01T19:04:24.446 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:04:24.821 [Cloud] End of cloud request. 2026-10-01T19:04:25.321 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:04:52.758 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:04:52.758 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:04:52.758 [Cloud] Queued cloud request. 2026-10-01T19:04:52.758 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:04:52.758 [Cloud] Dequeued cloud request. 2026-10-01T19:04:52.758 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:04:52.946 [Cloud] End of cloud request. 2026-10-01T19:04:53.462 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:09:07.323 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:09:07.323 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:09:07.323 [Cloud] Queued cloud request. 2026-10-01T19:09:07.323 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:09:07.323 [Cloud] Dequeued cloud request. 2026-10-01T19:09:07.323 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:09:07.589 [Cloud] End of cloud request. 2026-10-01T19:09:08.089 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:11:44.949 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:11:44.949 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:11:44.949 [Cloud] Queued cloud request. 2026-10-01T19:11:44.949 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:11:44.949 [Cloud] Dequeued cloud request. 2026-10-01T19:11:44.949 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:11:45.152 [Cloud] End of cloud request. 2026-10-01T19:11:45.652 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:13:25.386 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T19:22:53.719 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:22:53.719 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:22:53.719 [Cloud] Queued cloud request. 2026-10-01T19:22:53.719 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:22:53.719 [Cloud] Dequeued cloud request. 2026-10-01T19:22:53.719 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:22:53.906 [Cloud] End of cloud request. 2026-10-01T19:22:54.422 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:27:11.441 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:27:11.441 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:27:11.441 [Cloud] Queued cloud request. 2026-10-01T19:27:11.441 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:27:11.441 [Cloud] Dequeued cloud request. 2026-10-01T19:27:11.441 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:27:11.644 [Cloud] End of cloud request. 2026-10-01T19:27:12.144 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:28:30.395 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T19:33:50.303 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:33:50.303 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:33:50.303 [Cloud] Queued cloud request. 2026-10-01T19:33:50.303 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:33:50.303 [Cloud] Dequeued cloud request. 2026-10-01T19:33:50.303 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:33:50.521 [Cloud] End of cloud request. 2026-10-01T19:33:51.037 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:34:35.211 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:34:35.211 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:34:35.211 [Cloud] Queued cloud request. 2026-10-01T19:34:35.211 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:34:35.211 [Cloud] Dequeued cloud request. 2026-10-01T19:34:35.211 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:34:35.289 [Cloud] End of cloud request. 2026-10-01T19:34:35.805 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:36:56.383 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:36:56.383 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:36:56.383 [Cloud] Queued cloud request. 2026-10-01T19:36:56.383 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:36:56.383 [Cloud] Dequeued cloud request. 2026-10-01T19:36:56.383 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:36:56.555 [Cloud] End of cloud request. 2026-10-01T19:36:57.055 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:38:55.432 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:38:55.432 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:38:55.432 [Cloud] Queued cloud request. 2026-10-01T19:38:55.432 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:38:55.432 [Cloud] Dequeued cloud request. 2026-10-01T19:38:55.432 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:38:55.604 [Cloud] End of cloud request. 2026-10-01T19:38:56.120 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:40:04.573 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:40:04.573 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:40:04.573 [Cloud] Queued cloud request. 2026-10-01T19:40:04.573 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:40:04.573 [Cloud] Dequeued cloud request. 2026-10-01T19:40:04.573 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:40:04.745 [Cloud] End of cloud request. 2026-10-01T19:40:05.245 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:40:07.729 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:40:07.729 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:40:07.729 [Cloud] Queued cloud request. 2026-10-01T19:40:07.729 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:40:07.729 [Cloud] Dequeued cloud request. 2026-10-01T19:40:07.729 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:40:17.760 [Cloud] End of cloud request. 2026-10-01T19:40:18.260 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:41:07.886 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:41:07.886 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:41:07.886 [Cloud] Queued cloud request. 2026-10-01T19:41:07.886 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:41:07.886 [Cloud] Dequeued cloud request. 2026-10-01T19:41:07.886 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:41:07.964 [Cloud] End of cloud request. 2026-10-01T19:41:08.480 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:41:25.308 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:41:25.308 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:41:25.308 [Cloud] Queued cloud request. 2026-10-01T19:41:25.308 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:41:25.308 [Cloud] Dequeued cloud request. 2026-10-01T19:41:25.308 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:41:25.386 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{E8D5CF8D-BBFD-C59D-FC36-258BF5322A27} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 19:41:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T19:41:25.902 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:43:35.403 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T19:43:42.591 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:43:42.591 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:43:42.591 [Cloud] Queued cloud request. 2026-10-01T19:43:42.591 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:43:42.591 [Cloud] Dequeued cloud request. 2026-10-01T19:43:42.591 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:43:42.778 [Cloud] End of cloud request. 2026-10-01T19:43:43.294 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:44:27.778 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:44:27.778 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:44:27.778 [Cloud] Queued cloud request. 2026-10-01T19:44:27.778 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:44:27.778 [Cloud] Dequeued cloud request. 2026-10-01T19:44:27.778 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:44:27.856 [Cloud] End of cloud request. 2026-10-01T19:44:28.356 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:57:59.286 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:57:59.286 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:57:59.286 [Cloud] Queued cloud request. 2026-10-01T19:57:59.286 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:57:59.286 [Cloud] Dequeued cloud request. 2026-10-01T19:57:59.286 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:57:59.426 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{85433090-1D78-80B1-5B46-717DC9FBAA63} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 19:57:59 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T19:57:59.942 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T19:58:40.411 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) BEGIN BM telemetry GUID:{E37C3452-DA9B-FBD8-15F6-B0112ED3F247} SignatureID:340520518878414 SigSha:e1735ced290d41223a12e50689d7c8ade6f705e0 ThreatLevel:0 ProcessID:4956 ProcessCreationTime:134353299481302281 SessionID:0 CreationTime:10-01-2026 19:59:45 ImagePath:C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe Taint Info:Friendly: Y; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T19:59:46.786 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T19:59:46.786 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T19:59:46.786 [Cloud] Queued cloud request. 2026-10-01T19:59:46.786 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T19:59:46.786 [Cloud] Dequeued cloud request. 2026-10-01T19:59:46.786 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T19:59:46.911 [Cloud] End of cloud request. 2026-10-01T19:59:47.411 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:02:07.443 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:02:07.443 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:02:07.443 [Cloud] Queued cloud request. 2026-10-01T20:02:07.443 [Cloud] Dequeued cloud request. 2026-10-01T20:02:07.443 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:02:07.443 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:02:09.834 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{4A1FB10F-62CD-FD80-9670-9E229852D671} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 20:02:09 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T20:02:10.334 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:05:17.427 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:05:17.427 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:05:17.427 [Cloud] Queued cloud request. 2026-10-01T20:05:17.427 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:05:17.427 [Cloud] Dequeued cloud request. 2026-10-01T20:05:17.427 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:05:17.568 [Cloud] End of cloud request. 2026-10-01T20:05:18.084 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:11:25.587 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:11:25.587 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:11:25.587 [Cloud] Queued cloud request. 2026-10-01T20:11:25.587 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:11:25.587 [Cloud] Dequeued cloud request. 2026-10-01T20:11:25.587 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:11:25.759 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{96E21129-0BE4-EDCB-AC88-FFFA0392742B} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 20:11:25 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T20:11:26.275 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:13:05.871 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:13:05.871 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:13:05.871 [Cloud] Queued cloud request. 2026-10-01T20:13:05.871 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:13:05.871 [Cloud] Dequeued cloud request. 2026-10-01T20:13:05.871 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:13:06.089 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{62A91B51-BC4D-15D6-F8F8-AF9625A7DA9E} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 20:13:06 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T20:13:06.605 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:13:45.418 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T20:14:17.449 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:14:17.449 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:14:17.449 [Cloud] Queued cloud request. 2026-10-01T20:14:17.449 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:14:17.449 [Cloud] Dequeued cloud request. 2026-10-01T20:14:17.449 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:14:17.621 [Cloud] End of cloud request. 2026-10-01T20:14:18.136 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:17:07.217 ProcessImageName: httpd.exe, Pid: 4956, TotalTime: 626895, Count: 48403, MaxTime: 1687, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\lks\_ARCHIV\_TEST\gamepad\js\plugin.js, EstimatedImpact: 2% 2026-10-01T20:17:07.217 ProcessImageName: setup.exe, Pid: 6696, TotalTime: 12997, Count: 688, MaxTime: 4953, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeCore\154.0.4258.48\msedge.dll, EstimatedImpact: 17% 2026-10-01T20:17:07.217 ProcessImageName: AgentShell.exe, Pid: 4996, TotalTime: 7799, Count: 682, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Connectivity Module\store.json, EstimatedImpact: 0% 2026-10-01T20:17:07.217 ProcessImageName: taskhostw.exe, Pid: 3404, TotalTime: 1364, Count: 20, MaxTime: 890, MaxTimeFile: \Device\Harddisk0\DR0, EstimatedImpact: 51% 2026-10-01T20:17:07.217 ProcessImageName: svchost.exe, Pid: 2996, TotalTime: 708, Count: 16, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\SysWOW64\wmp.dll, EstimatedImpact: 1% 2026-10-01T20:17:07.217 ProcessImageName: svchost.exe, Pid: 1668, TotalTime: 412, Count: 26, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\sc.exe, EstimatedImpact: 0% 2026-10-01T20:17:07.217 ProcessImageName: mysqld.exe, Pid: 2936, TotalTime: 390, Count: 56, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files\MariaDB 11.4\data\wordpress_mampress\mampress_categories.ibd, EstimatedImpact: 0% 2026-10-01T20:17:07.217 ProcessImageName: svchost.exe, Pid: 1080, TotalTime: 169, Count: 6, MaxTime: 78, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\dpapisrv.dll, EstimatedImpact: 0% 2026-10-01T20:17:07.217 ProcessImageName: MicrosoftEdge_X64_154.0.4258.48_154.0.4258.37.exe, Pid: 1300, TotalTime: 155, Count: 2, MaxTime: 140, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8AE813B7-4F41-42D0-B229-5D39E4C3B73F}\EDGEMITMP_58D38.tmp\setup.exe, EstimatedImpact: 76% 2026-10-01T20:17:07.217 ProcessImageName: dllhost.exe, Pid: 4600, TotalTime: 120, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk, EstimatedImpact: 0% 2026-10-01T20:17:07.217 ProcessImageName: svchost.exe, Pid: 6640, TotalTime: 93, Count: 2, MaxTime: 62, MaxTimeFile: \Device\HarddiskVolume2\Windows\System32\ngcrecovery.dll, EstimatedImpact: 24% 2026-10-01T20:17:07.217 ProcessImageName: AggregatorHost.exe, Pid: 4436, TotalTime: 75, Count: 8, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Spiceworks Agent Shell\modules\Inventory Module\scripts\win\inventory_scan.ps1, EstimatedImpact: 0% 2026-10-01T20:17:07.217 ProcessImageName: MESMTPC.exe, Pid: 2896, TotalTime: 60, Count: 4, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\Program Files (x86)\Mail Enable\Config\AUTH.TAB, EstimatedImpact: 0% 2026-10-01T20:17:07.217 ProcessImageName: cmd.exe, Pid: 5508, TotalTime: 15, Count: 2, MaxTime: 15, MaxTimeFile: \Device\HarddiskVolume2\SYSDOC\timesync.bat, EstimatedImpact: 8% 2026-10-01T20:21:41.780 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:21:41.780 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:21:41.780 [Cloud] Queued cloud request. 2026-10-01T20:21:41.780 [Cloud] Dequeued cloud request. 2026-10-01T20:21:41.780 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:21:41.780 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:21:41.936 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{1F6791BD-7792-44CA-D685-CD3CB7EF64F3} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 20:21:41 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T20:21:42.452 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:23:00.998 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:23:00.998 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:23:00.998 [Cloud] Queued cloud request. 2026-10-01T20:23:00.998 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:23:00.998 [Cloud] Dequeued cloud request. 2026-10-01T20:23:00.998 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:23:01.155 [Cloud] End of cloud request. 2026-10-01T20:23:01.655 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:23:23.483 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:23:23.483 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:23:23.483 [Cloud] Queued cloud request. 2026-10-01T20:23:23.483 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:23:23.483 [Cloud] Dequeued cloud request. 2026-10-01T20:23:23.483 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:23:23.561 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{FF8E70A4-E292-94D7-A677-F872A483EB1D} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 20:23:23 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T20:23:24.077 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:26:07.735 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:26:07.735 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:26:07.735 [Cloud] Queued cloud request. 2026-10-01T20:26:07.735 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:26:07.735 [Cloud] Dequeued cloud request. 2026-10-01T20:26:07.735 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:26:08.423 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{2D8E274F-BBD7-4532-22DF-D63A6BA56790} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 20:26:08 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T20:26:08.923 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:27:50.097 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:27:50.097 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:27:50.097 [Cloud] Queued cloud request. 2026-10-01T20:27:50.097 [Cloud] Dequeued cloud request. 2026-10-01T20:27:50.097 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:27:50.097 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:27:50.253 [Cloud] End of cloud request. 2026-10-01T20:27:50.753 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:28:50.425 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T20:31:03.519 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:31:03.519 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:31:03.519 [Cloud] Queued cloud request. 2026-10-01T20:31:03.519 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:31:03.519 [Cloud] Dequeued cloud request. 2026-10-01T20:31:03.519 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:31:03.660 [Cloud] End of cloud request. 2026-10-01T20:31:04.175 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:35:46.536 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:35:46.536 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:35:46.536 [Cloud] Queued cloud request. 2026-10-01T20:35:46.536 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:35:46.536 [Cloud] Dequeued cloud request. 2026-10-01T20:35:46.536 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:35:46.708 [Cloud] End of cloud request. 2026-10-01T20:35:47.208 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:43:55.431 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) 2026-10-01T20:44:18.540 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:44:18.540 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:44:18.540 [Cloud] Queued cloud request. 2026-10-01T20:44:18.540 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:44:18.540 [Cloud] Dequeued cloud request. 2026-10-01T20:44:18.540 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:44:18.946 [Cloud] End of cloud request. 2026-10-01T20:44:19.462 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:48:20.685 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:48:20.685 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:48:20.685 [Cloud] Queued cloud request. 2026-10-01T20:48:20.685 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:48:20.685 [Cloud] Dequeued cloud request. 2026-10-01T20:48:20.685 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:48:20.888 [Cloud] End of cloud request. 2026-10-01T20:48:21.404 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:53:32.982 [Cloud] SubmitReport(CMpSpyDssContext), ShouldSendEvenOnPaidNetworks: 1 2026-10-01T20:53:32.982 [Cloud] Start of cloud request. Passive mode: 0 2026-10-01T20:53:32.982 [Cloud] Queued cloud request. 2026-10-01T20:53:32.982 [Cloud] MpEngineCloudRequest(). hr = 0 2026-10-01T20:53:32.982 [Cloud] Dequeued cloud request. 2026-10-01T20:53:32.982 [Cloud] RpcSpynetQueueGenerateReport(). hr = 0 2026-10-01T20:53:33.154 [Cloud] End of cloud request. BEGIN BM telemetry GUID:{180E5413-B45D-6E83-9EF1-683107460A31} SignatureID:55745127179687 SigSha:db80fd21f16910326690bd4f12d2dfd418bdb0a4 ThreatLevel:0 ProcessID:0 ProcessCreationTime:42949672960 SessionID:4294967295 CreationTime:10-01-2026 20:53:33 Taint Info:Friendly: N; Reason: ; Modules: ; Parents: Operations:None END BM telemetry 2026-10-01T20:53:33.654 [NRI] Successfully updated NIS service with platform settings for enforcement level Log 2026-10-01T20:59:00.440 [ESU] ESU heartbeat: ESU disabled (explicit EnableEmergencySigs config) Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xd681195e 2026-10-01T21:03:30.208 [RTP] [MpRtp] Engine VFZ lofi/sample/expensive: \Device\HarddiskVolume2\Program Files (x86)\Apache Software Foundation\Apache2.2\htdocs\heimam\shell2.php. status=0x40050000, statusex=0x0, threatid=0x80000000, sigseq=0x4a291015f80c Internal signature match:subtype=Lowfi, sigseq=0x00004A291015F80C, sigsha=bea52af47128b67aab43e9f9472ee690dc563560, cached=false, source=2, resourceid=0xa9fc2db7