Skip to content

Instantly share code, notes, and snippets.

@jborean93

jborean93/1 - KB2267602 Info.md

Last active August 15, 2023 01:25
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jborean93/6f7dd949b163a204b1a9cb356cf71485 to your computer and use it in GitHub Desktop.
Save jborean93/6f7dd949b163a204b1a9cb356cf71485 to your computer and use it in GitHub Desktop.
Download ZIP
Windows Update API (WUA) KB2267602
Raw
1 - KB2267602 Info.md

This is to document some issues with trying to install KB2267602 on Windows Server 2016 using the Windows Updates API (WUA). The ansible.windows.win_updates.log shows the installation of KB2267602 and it's first failure when installed by the Ansible module, the manual MpCmdRun.exe workaround on this failure, then subsequent update runs that show the update no longer being required. The MpSigStub.log file shows the contents of that log file for the first failed install using WUA and then the subsequent working entries when using MpCmdRun.exe.

The update KB is the security intelligence updates for Microsoft Defender Antivirus and can be updated many times in one day. From what I can see it typically installs just fine but there is a chance where Windows Updates pulls down a new version before it is ready to be installed. For example the logs during a failed run indicates that the following update tried to be installed and resulted in the following error:

4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a:
  categories:
  - Definition Updates
  - Microsoft Defender Antivirus
  downloaded: false
  failure_hresult_code: 2147944003
  failure_msg: Unknown WUA HRESULT 2147944003 (UNKNOWN 0x80070643)
  id: 4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a
  installed: false
    kb:
    - '2267602'
    title: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.395.469.0)

Based on the update title the version here is 1.395.469.0 but the latest update information showed the latest version was at 1.395.466.0. The MpSigStub.log files showed the error reported by the update to be:

mpengine.dll version in package is 1.1.23070.1005, but after update machine has older version 1.1.12805.0
ERROR 0x8007051a : One or more of the packages found failed to update for Microsoft Windows Defender (RS1+).
ERROR 0x8007051a : 'Microsoft Windows Defender (RS1+)' failed to update.

Guessing at the error it seems to indicate that after WUA/MpCmdRun.exe attempts to install the package downloaded by WUA the revision stayed the same as to what it was before. There is nothing else in the logs that would indicate what may have gone wrong during the patching, except that it just didn't work.

On subsequent runs, WUA would report the update as successfully being installed but upon futher inspection it does still fail internally. This leads to subsequent runs continuing to report that KB2267602 still needed to be installed and it trying again leading to another internal failure. When analysing these failures I've found that the update immediately returns when the install API is called but internally MpSigStub.exe was still running in the background. After a few minutes the process finishes and the logs at C:\Windows\TEMP\MpSigStub.log contain the following entry

--------------------------------------------------------------------------------
Start time: 2023-08-15 01:05:25Z
Process: eb4.1d9cf1492e15a93
Command: /stub 1.1.23080.1001 /payload 1.1.23070.1005 /MpWUStub /program C:\Windows\SoftwareDistribution\Download\Install\AM_Engine.exe
Administrator: yes
Version: 1.1.23080.1001

================================ ProductSearch =================================

               Microsoft Windows Defender (RS1+):
       Status: Active
  ProductGUID: 77BDAF73-B396-481F-9042-AD358843EC24
       Engine: 46885b61f84eb9417c2ad3f951b030c5e7177a358d1d72b663ad0cb5c78d1ea2  1.1.12805.0
  AS base VDM: 9bc2a721794e46b45b1b701581c89665e23d186945418b14092ce11145b95f70  1.221.0.0
  AV base VDM: ad62f41b09ba107019376ca103f1fcf26124fc21b8dbc1fee4259db4dca6ee85  1.221.0.0
 AS delta VDM: 6a50f195b2dfda050c13a1c8faf2bf6beacaa78aea824928eb1201ae54cf6849  1.221.14.0
 AV delta VDM: 56fab8a5e9b93f7920f165fbe7ca27caa0d8bd52eeab6b05ac0bfa63197663e1  1.221.14.0
   NIS engine: b1c03b224d6779738548f04f29e1cbca02f74c714a7383c5d32cc76aadcf86be  2.1.14600.4
 NIS base VDM: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1  119.0.0.0
 NIS full VDM: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1  119.0.0.0
     Platform: 989257bddb756ce1c2af579be003962f5700cdec6f25e3b86b8cce5127bc11b4  4.10.14393.4651

============================== AccumulatePackages ==============================

PackageName: C:\Windows\SoftwareDistribution\Download\Install\AM_Engine.exe
PackageName: C:\Windows\SoftwareDistribution\Download\Install\AM_Base.exe
ERROR 0x800705b4 : AccumulatePackages

                         Watson Report:                     Position:
                HRESULT: 0x800705b4                         P1
         FailedFunction: AccumulatePackages                 P2
              Operation: N/A                                P3
 SourceComponentVersion: 1.1.23080.1001                     P4
    SourceComponentName: mpsigstub.exe                      P5
         ProductVersion: 4.10.14393.4651                    P6
            ProductName: Microsoft Windows Defender (RS1+)  P7

ERROR 0x800705b4 : MpSigStubMain
End time: 2023-08-15 01:07:28Z
--------------------------------------------------------------------------------

It seems like there is some sort of timeout during the AccumulatePackages stage but what that exactly means I am not sure.

Ultimately a new update is eventually issued after some time (maybe 30-90 minutes later) which ends up working. Curiously it only seems to work out of the box when the version on the defender definition updates page is the same as what WUA reports. It is also possible to run the following PowerShell code to manually run the sync outside of WUA which also works regardless.

& 'C:\Program Files\Windows Defender.exe\MpCmdRun.exe' -RemoveDefinitions -DynamicSignatures
& 'C:\Program Files\Windows Defender.exe\MpCmdRun.exe' -SignatureUpdate

When analyzing the log MpCmdRun.exe will pull down the version on the website (1.395.466.0) and not the newer one that WUA seems to detect (1.395.469.0).

At this point this is just a guess but it seems like WUAs source is too new and pulls down an update that is not ready for use. Using the MpCmdRun.exe will ensure the latest definiton offered manually by Microsoft is used which in my testing always seems to work. So as a workaround the win_updates module will now manually run those commands if KB2267602 fails to hopefully improve the stability of the module. The only downside is that the Windows Update GUI may still report an update is available even if WUA does not. This will go away once the GUI has been synchronised or a new version of KB2267602 has been pushed out.

Raw
ansible.windows.win_updates.log
2023-08-11 03:10:27Z pipe_server Starting to acquire WaitForConnection lock
2023-08-11 03:10:27Z pipe_server Acquired WaitForConnection lock
2023-08-11 03:10:27Z pipe_server Creating named pipe server 'Ansible.Windows.WinUpdates-d2bc565a-8d40-41e5-85b0-7236415565b2'
2023-08-11 03:10:27Z pipe_server Waiting for client to connect to pipe
2023-08-11 03:10:27Z pipe_server Client connect wait idx 0
2023-08-11 03:10:27Z pipe_server Client successfully connected to pipe
2023-08-11 03:10:27Z pipe_server Starting to release WaitForConnection lock
2023-08-11 03:10:27Z pipe_server Released WaitForConnection lock
2023-08-11 03:10:27Z pipe_server Starting pipe read
2023-08-11 03:10:27Z pipe_server Starting to acquire WriteLine lock
2023-08-11 03:10:27Z pipe_server Acquired WriteLine lock
2023-08-11 03:10:27Z pipe_server Writing to pipe server: {"task":"started","result":{}}
2023-08-11 03:10:27Z update_task Reboot requirement check: False
2023-08-11 03:10:27Z update_task Creating Windows Update session...
2023-08-11 03:10:27Z update_task Create Windows Update searcher...
2023-08-11 03:10:27Z update_task Setting the Windows Update Agent source catalog...
2023-08-11 03:10:27Z pipe_server Writing task successful
2023-08-11 03:10:27Z pipe_server Starting to release WriteLine lock
2023-08-11 03:10:27Z pipe_server Released WriteLine lock
2023-08-11 03:10:27Z pipe_server Pipe read returned: -1
2023-08-11 03:10:27Z pipe_server Starting to acquire WaitForConnection lock
2023-08-11 03:10:27Z pipe_server Acquired WaitForConnection lock
2023-08-11 03:10:27Z pipe_server Disposing pipe server for a new connection
2023-08-11 03:10:27Z pipe_server Creating named pipe server 'Ansible.Windows.WinUpdates-d2bc565a-8d40-41e5-85b0-7236415565b2'
2023-08-11 03:10:27Z pipe_server Waiting for client to connect to pipe
2023-08-11 03:10:27Z update_task Search source set to 'default' (ServerSelection = 0)
2023-08-11 03:10:27Z update_task Searching for updates to install with query 'IsInstalled = 0'
2023-08-11 03:10:28Z pipe_server Client connect wait idx 0
2023-08-11 03:10:28Z pipe_server Client successfully connected to pipe
2023-08-11 03:10:28Z pipe_server Starting to release WaitForConnection lock
2023-08-11 03:10:28Z pipe_server Released WaitForConnection lock
2023-08-11 03:10:28Z pipe_server Starting pipe read
2023-08-11 03:12:10Z update_task Found 1 updates
2023-08-11 03:12:10Z update_task Filtering found updates based on input search criteria
2023-08-11 03:12:10Z update_task Process filtering rules for
{
"id": "4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a",
"title": "Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.395.469.0)",
"description": "Install this update to revise the files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed.",
"kb": [
"KB2267602"
],
"type": "Software",
"deployment_action": "Installation",
"auto_select_on_websites": true,
"browse_only": false,
"revision_number": 200,
"categories": [
"Definition Updates",
"Microsoft Defender Antivirus"
],
"is_installed": false,
"is_hidden": false,
"is_present": false,
"reboot_required": false,
"impact": "Minor",
"reboot_behaviour": "NeverReboots",
"is_beta": false,
"is_downloaded": true,
"is_mandatory": false,
"is_uninstallable": false,
"auto_selection": "LetWindowsUpdateDecide",
"auto_download": "LetWindowsUpdateDecide"
}
2023-08-11 03:12:10Z update_task Adding update 4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a - Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.395.469.0)
2023-08-11 03:12:10Z pipe_server Starting to acquire WriteLine lock
2023-08-11 03:12:10Z pipe_server Acquired WriteLine lock
2023-08-11 03:12:10Z pipe_server Writing to pipe server: {"task":"search_result","result":{"updates":[{"impact":"Minor","categories":["Definition Updates","Microsoft Defender Antivirus"],"revision_number":200,"auto_download":"LetWindowsUpdateDecide","deployment_action":"Installation","description":"Install this update to revise the files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed.","title":"Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.395.469.0)","id":"4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a","is_beta":false,"is_present":false,"type":"Software","reboot_behaviour":"NeverReboots","is_downloaded":true,"auto_select_on_websites":true,"is_installed":false,"kb":["KB2267602"],"is_uninstallable":false,"browse_only":false,"auto_selection":"LetWindowsUpdateDecide","reboot_required":false,"is_hidden":false,"is_mandatory":false}],"filtered":[]}}
2023-08-11 03:12:10Z pipe_server Writing task successful
2023-08-11 03:12:10Z pipe_server Starting to release WriteLine lock
2023-08-11 03:12:10Z pipe_server Released WriteLine lock
2023-08-11 03:12:10Z update_task Update 4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a already downloaded, skipping...
2023-08-11 03:12:10Z update_task All updates selected have been downloaded...
2023-08-11 03:12:10Z update_task Installing updates...
2023-08-11 03:12:10Z update_task Received install progress update:
{
"result": {
"result": {
"ResultCode": 1,
"RebootRequired": false,
"HResult": 0
},
"progress": {
"PercentComplete": 25,
"CurrentUpdateIndex": 0,
"CurrentUpdatePercentComplete": 25,
"CurrentUpdateId": "4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a"
}
},
"task": "install"
}
2023-08-11 03:12:10Z pipe_server Starting to acquire WriteLine lock
2023-08-11 03:12:10Z pipe_server Acquired WriteLine lock
2023-08-11 03:12:10Z pipe_server Writing to pipe server: {"task":"install","result":{"result":{"ResultCode":1,"RebootRequired":false,"HResult":0},"progress":{"PercentComplete":25,"CurrentUpdateIndex":0,"CurrentUpdatePercentComplete":25,"CurrentUpdateId":"4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a"}}}
2023-08-11 03:12:10Z pipe_server Writing task successful
2023-08-11 03:12:10Z pipe_server Starting to release WriteLine lock
2023-08-11 03:12:10Z pipe_server Released WriteLine lock
2023-08-11 03:12:11Z update_task Received install progress update:
{
"result": {
"result": {
"ResultCode": 1,
"RebootRequired": false,
"HResult": 0
},
"progress": {
"PercentComplete": 50,
"CurrentUpdateIndex": 0,
"CurrentUpdatePercentComplete": 50,
"CurrentUpdateId": "4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a"
}
},
"task": "install"
}
2023-08-11 03:12:11Z pipe_server Starting to acquire WriteLine lock
2023-08-11 03:12:11Z pipe_server Acquired WriteLine lock
2023-08-11 03:12:11Z pipe_server Writing to pipe server: {"task":"install","result":{"result":{"ResultCode":1,"RebootRequired":false,"HResult":0},"progress":{"PercentComplete":50,"CurrentUpdateIndex":0,"CurrentUpdatePercentComplete":50,"CurrentUpdateId":"4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a"}}}
2023-08-11 03:12:11Z pipe_server Writing task successful
2023-08-11 03:12:11Z pipe_server Starting to release WriteLine lock
2023-08-11 03:12:11Z pipe_server Released WriteLine lock
2023-08-11 03:12:12Z update_task Received install progress update:
{
"result": {
"result": {
"ResultCode": 1,
"RebootRequired": false,
"HResult": 0
},
"progress": {
"PercentComplete": 75,
"CurrentUpdateIndex": 0,
"CurrentUpdatePercentComplete": 75,
"CurrentUpdateId": "4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a"
}
},
"task": "install"
}
2023-08-11 03:12:12Z pipe_server Starting to acquire WriteLine lock
2023-08-11 03:12:12Z pipe_server Acquired WriteLine lock
2023-08-11 03:12:12Z pipe_server Writing to pipe server: {"task":"install","result":{"result":{"ResultCode":1,"RebootRequired":false,"HResult":0},"progress":{"PercentComplete":75,"CurrentUpdateIndex":0,"CurrentUpdatePercentComplete":75,"CurrentUpdateId":"4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a"}}}
2023-08-11 03:12:12Z pipe_server Writing task successful
2023-08-11 03:12:12Z pipe_server Starting to release WriteLine lock
2023-08-11 03:12:12Z pipe_server Released WriteLine lock
2023-08-11 03:12:13Z pipe_server Pipe read returned: 1
2023-08-11 03:12:13Z pipe_server Waiting for client to acknowledge closing pipe
2023-08-11 03:12:13Z pipe_server Starting to acquire WaitForConnection lock
2023-08-11 03:12:13Z pipe_server Acquired WaitForConnection lock
2023-08-11 03:12:13Z pipe_server Disposing pipe server for a new connection
2023-08-11 03:12:13Z pipe_server Creating named pipe server 'Ansible.Windows.WinUpdates-d2bc565a-8d40-41e5-85b0-7236415565b2'
2023-08-11 03:12:13Z pipe_server Waiting for client to connect to pipe
2023-08-11 03:12:13Z pipe_server Client connect wait idx 0
2023-08-11 03:12:13Z pipe_server Client successfully connected to pipe
2023-08-11 03:12:13Z pipe_server Starting to release WaitForConnection lock
2023-08-11 03:12:13Z pipe_server Released WaitForConnection lock
2023-08-11 03:12:13Z pipe_server Starting pipe read
2023-08-11 03:12:15Z update_task Received install progress update:
{
"result": {
"result": {
"ResultCode": 4,
"RebootRequired": false,
"HResult": -2147023293
},
"progress": {
"PercentComplete": 100,
"CurrentUpdateIndex": 0,
"CurrentUpdatePercentComplete": 100,
"CurrentUpdateId": "4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a"
}
},
"task": "install"
}
2023-08-11 03:12:15Z pipe_server Starting to acquire WriteLine lock
2023-08-11 03:12:15Z pipe_server Acquired WriteLine lock
2023-08-11 03:12:15Z pipe_server Writing to pipe server: {"task":"install","result":{"result":{"ResultCode":4,"RebootRequired":false,"HResult":-2147023293},"progress":{"PercentComplete":100,"CurrentUpdateIndex":0,"CurrentUpdatePercentComplete":100,"CurrentUpdateId":"4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a"}}}
2023-08-11 03:12:15Z pipe_server Writing task successful
2023-08-11 03:12:15Z pipe_server Starting to release WriteLine lock
2023-08-11 03:12:15Z pipe_server Released WriteLine lock
2023-08-11 03:12:15Z update_task Install result for 4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a - ResultCode: Failed, HResult: -2147023293, RebootRequired: False
2023-08-11 03:12:15Z update_task Running defender command C:\Program Files\Windows Defender\MpCmdRun.exe -RemoveDefinitions -DynamicSignatures
2023-08-11 03:12:15Z update_task Defender command result - RC: 0
STDOUT:
Service Version: 4.10.14393.4651
Engine Version: 1.1.12805.0
AntiSpyware Signature Version: 1.221.14.0
AntiVirus Signature Version: 1.221.14.0
NRI Engine Version: 2.1.14600.4
NRI Signature Version: 119.0.0.0
Starting Dynamic Signature removal.
Done!
Service Version: 4.10.14393.4651
Engine Version: 1.1.12805.0
AntiSpyware Signature Version: 1.221.14.0
AntiVirus Signature Version: 1.221.14.0
NRI Engine Version: 2.1.14600.4
NRI Signature Version: 119.0.0.0
STDERR:
2023-08-11 03:12:15Z update_task Running defender command C:\Program Files\Windows Defender\MpCmdRun.exe -SignatureUpdate
2023-08-11 03:12:16Z pipe_server Pipe read returned: 1
2023-08-11 03:12:16Z pipe_server Waiting for client to acknowledge closing pipe
2023-08-11 03:12:16Z pipe_server Starting to acquire WaitForConnection lock
2023-08-11 03:12:16Z pipe_server Acquired WaitForConnection lock
2023-08-11 03:12:16Z pipe_server Disposing pipe server for a new connection
2023-08-11 03:12:16Z pipe_server Creating named pipe server 'Ansible.Windows.WinUpdates-d2bc565a-8d40-41e5-85b0-7236415565b2'
2023-08-11 03:12:16Z pipe_server Waiting for client to connect to pipe
2023-08-11 03:12:16Z pipe_server Client connect wait idx 0
2023-08-11 03:12:16Z pipe_server Client successfully connected to pipe
2023-08-11 03:12:16Z pipe_server Starting to release WaitForConnection lock
2023-08-11 03:12:16Z pipe_server Released WaitForConnection lock
2023-08-11 03:12:16Z pipe_server Starting pipe read
2023-08-15 00:50:21Z update_task Defender command result - RC: 0
STDOUT:
Signature update started . . .
Signature update finished. No updates needed
STDERR:
2023-08-15 00:50:23Z pipe_server Starting to acquire WriteLine lock
2023-08-15 00:50:23Z pipe_server Acquired WriteLine lock
2023-08-15 00:50:23Z pipe_server Writing to pipe server: {"task":"install_result","result":{"info":[{"result_code":2,"reboot_required":false,"id":"4ee7ce61-491b-4e2d-bfd9-a9decbb3ae1a","hresult":0}]}}
2023-08-15 00:50:23Z update_task Post-install reboot requirement False
2023-08-15 00:50:23Z pipe_server Writing task successful
2023-08-15 00:50:23Z pipe_server Starting to release WriteLine lock
2023-08-15 00:50:23Z pipe_server Released WriteLine lock
2023-08-15 00:50:23Z pipe_server Starting to acquire WriteLine lock
2023-08-15 00:50:23Z pipe_server Acquired WriteLine lock
2023-08-15 00:50:23Z pipe_server Writing to pipe server: {"task":"exit","result":{"action":null,"exception":null,"reboot_required":false,"failed":false,"changed":true}}
2023-08-15 00:50:23Z pipe_server Writing task successful
2023-08-15 00:50:23Z pipe_server Starting to release WriteLine lock
2023-08-15 00:50:23Z pipe_server Released WriteLine lock
2023-08-15 00:50:23Z pipe_server Starting to acquire WriteLine lock
2023-08-15 00:50:23Z pipe_server Acquired WriteLine lock
2023-08-15 00:50:23Z pipe_server Writing to pipe server: {"task":"exit","result":{"action":null,"exception":null,"reboot_required":false,"failed":false,"changed":true}}
2023-08-15 00:50:23Z pipe_server Pipe read returned: 1
2023-08-15 00:50:23Z pipe_server Waiting for client to acknowledge closing pipe
2023-08-15 00:50:23Z pipe_server Starting to acquire WaitForConnection lock
2023-08-15 00:50:23Z pipe_server Pipe failed to write: IOException(Pipe is broken.)
System.IO.IOException: Pipe is broken.
at System.IO.Pipes.PipeStream.WinIOError(Int32 errorCode)
at System.IO.Pipes.PipeStream.EndWrite(IAsyncResult asyncResult)
at System.IO.Stream.<>c.<BeginEndWriteAsync>b__53_1(Stream stream, IAsyncResult asyncResult)
at System.Threading.Tasks.TaskFactory`1.FromAsyncTrimPromise`1.Complete(TInstance thisRef, Func`3 endMethod, IAsyncResult asyncResult, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Ansible.Windows.WinUpdates.PipeServer.WriteLine(String line)
2023-08-15 00:50:23Z pipe_server Starting to release WriteLine lock
2023-08-15 00:50:23Z pipe_server Acquired WaitForConnection lock
2023-08-15 00:50:23Z pipe_server Disposing pipe server for a new connection
2023-08-15 00:50:23Z pipe_server Creating named pipe server 'Ansible.Windows.WinUpdates-d2bc565a-8d40-41e5-85b0-7236415565b2'
2023-08-15 00:50:23Z pipe_server Waiting for client to connect to pipe
2023-08-15 00:50:23Z pipe_server Released WriteLine lock
2023-08-15 00:50:24Z pipe_server Client connect wait idx 1
2023-08-15 00:50:24Z pipe_server Starting to release WaitForConnection lock
2023-08-15 00:50:24Z pipe_server Released WaitForConnection lock
2023-08-15 00:50:24Z pipe_server Pipe reader failed with OperationCanceledException Pipe WaitForConnect was cancelled
2023-08-15 00:50:24Z pipe_server Cancellation requested, shutting down output consumer
Raw
C:\Windows\TEMP\MpSigStub.log
--------------------------------------------------------------------------------
Start time: 2023-08-11 03:12:10Z
Process: 2c0.1d9cc019e5ce17d
Command: /Store
Administrator: yes
Version: 1.1.23080.1001
================================ CacheMpSigStub ================================
Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe
End time: 2023-08-11 03:12:10Z
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Start time: 2023-08-11 03:12:10Z
Process: f04.1d9cc019e659e8e
Command: /stub 1.1.23080.1001 /payload 1.1.23070.1005 /MpWUStub /program C:\Windows\SoftwareDistribution\Download\Install\AM_Engine.exe
Administrator: yes
Version: 1.1.23080.1001
================================ ProductSearch =================================
Microsoft Windows Defender (RS1+):
Status: Active
ProductGUID: 77BDAF73-B396-481F-9042-AD358843EC24
Engine: 46885b61f84eb9417c2ad3f951b030c5e7177a358d1d72b663ad0cb5c78d1ea2 1.1.12805.0
AS base VDM: 9bc2a721794e46b45b1b701581c89665e23d186945418b14092ce11145b95f70 1.221.0.0
AV base VDM: ad62f41b09ba107019376ca103f1fcf26124fc21b8dbc1fee4259db4dca6ee85 1.221.0.0
AS delta VDM: 6a50f195b2dfda050c13a1c8faf2bf6beacaa78aea824928eb1201ae54cf6849 1.221.14.0
AV delta VDM: 56fab8a5e9b93f7920f165fbe7ca27caa0d8bd52eeab6b05ac0bfa63197663e1 1.221.14.0
NIS engine: 84e4974e865d7db105686eee81f91aa702de3f6b7871a4b5303cb6ee611acd4b 2.1.12706.0
NIS base VDM: d8ffdd6fd87949fd83188fd54cf49a3aff830917186abcea745fe3203688d47b 116.0.0.0
NIS full VDM: c77c312b461fd74abfc7a6067394ce9e255c7b035f77e61cc7fff14993c8e56b 116.1.0.0
Platform: 989257bddb756ce1c2af579be003962f5700cdec6f25e3b86b8cce5127bc11b4 4.10.14393.4651
============================== AccumulatePackages ==============================
PackageName: C:\Windows\SoftwareDistribution\Download\Install\AM_Engine.exe
PackageName: C:\Windows\SoftwareDistribution\Download\Install\AM_Base.exe
PackageName:*C:\Windows\SoftwareDistribution\Download\Install\NIS_Full.exe
=============================== PackageDiscovery ===============================
Copied nisfull.vdm
Package files discovered:
Directory: C:\Windows\Temp\7DE8D0BC-21DE-4806-9104-A3735B15F44Bf04.1d9cc019e659e8e
gapaengine.dll: b1c03b224d6779738548f04f29e1cbca02f74c714a7383c5d32cc76aadcf86be 2.1.14600.4
mpasbase.vdm: 7dee8e8017fda76c3c39344fb0322f9c73b719ad2ca72e31cda79e155e3e4eff 1.395.0.0
mpavbase.vdm: e3c53c25aecf11fedab57393ed6b6e40d98a5be32b1cba9a3707f5573b932eb9 1.395.0.0
mpengine.dll: 7a360e86085f69c54824e4819f28a7ee92bbff6c88f592bb71d819561cb7fa5d 1.1.23070.1005
nisbase.vdm: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1 119.0.0.0
nisfull.vdm: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1 119.0.0.0
NIS Engine and Base: Engine only:
NIS engine: 2.1.14600.4 Engine: 1.1.23070.1005
NIS base VDM: 119.0.0.0 AS base VDM: Not included
NIS full VDM: 119.0.0.0 AV base VDM: Not included
AS delta VDM: Not included
AV delta VDM: Not included
==================================== Update ====================================
Product name: Microsoft Windows Defender (RS1+)
Package files:
Directory: C:\Windows\Temp\7DE8D0BC-21DE-4806-9104-A3735B15F44Bf04.1d9cc019e659e8e
gapaengine.dll: b1c03b224d6779738548f04f29e1cbca02f74c714a7383c5d32cc76aadcf86be 2.1.14600.4
mpasbase.vdm: 7dee8e8017fda76c3c39344fb0322f9c73b719ad2ca72e31cda79e155e3e4eff 1.395.0.0
mpavbase.vdm: e3c53c25aecf11fedab57393ed6b6e40d98a5be32b1cba9a3707f5573b932eb9 1.395.0.0
mpengine.dll: 7a360e86085f69c54824e4819f28a7ee92bbff6c88f592bb71d819561cb7fa5d 1.1.23070.1005
nisbase.vdm: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1 119.0.0.0
nisfull.vdm: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1 119.0.0.0
NISSignatureLocation changed from C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default to C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7226C607-9AEC-4830-87F2-79BF110C742A}
Signatures updated from C:\Windows\Temp\7DE8D0BC-21DE-4806-9104-A3735B15F44Bf04.1d9cc019e659e8e
================================ ValidateUpdate ================================
MpSigStub successfully updated Microsoft Windows Defender (RS1+) using the NIS Engine and Base package.
Original: Updated to:
NIS engine: 2.1.12706.0 2.1.14600.4
NIS base VDM: 116.0.0.0 119.0.0.0
NIS full VDM: 116.1.0.0 119.0.0.0
NISDeltaUpdateFailure set to 0
mpengine.dll version in package is 1.1.23070.1005, but after update machine has older version 1.1.12805.0
ERROR 0x8007051a : One or more of the packages found failed to update for Microsoft Windows Defender (RS1+).
ERROR 0x8007051a : 'Microsoft Windows Defender (RS1+)' failed to update.
Watson Report: Position:
HRESULT: 0x8007051a P1
FailedFunction: ValidateUpdate P2
Operation: NIS Engine and Base,Engine only P3
SourceComponentVersion: 1.1.23080.1001,1.1.23070.1005 P4
SourceComponentName: mpsigstub.exe P5
ProductVersion: 4.10.14393.4651 P6
ProductName: Microsoft Windows Defender (RS1+) P7
ERROR 0x8007051a : MpSigStubMain
End time: 2023-08-11 03:12:15Z
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Start time: 2023-08-11 03:12:18Z
Process: f0c.1d9cc01a30e0831
Command: /stub 1.1.23080.1001 /payload 1.1.23070.1005 /MpWUStub /program C:\Windows\SoftwareDistribution\Download\Install\AM_Engine.exe
Administrator: yes
Version: 1.1.23080.1001
================================ ProductSearch =================================
Microsoft Windows Defender (RS1+):
Status: Active
ProductGUID: 77BDAF73-B396-481F-9042-AD358843EC24
Engine: 46885b61f84eb9417c2ad3f951b030c5e7177a358d1d72b663ad0cb5c78d1ea2 1.1.12805.0
AS base VDM: 9bc2a721794e46b45b1b701581c89665e23d186945418b14092ce11145b95f70 1.221.0.0
AV base VDM: ad62f41b09ba107019376ca103f1fcf26124fc21b8dbc1fee4259db4dca6ee85 1.221.0.0
AS delta VDM: 6a50f195b2dfda050c13a1c8faf2bf6beacaa78aea824928eb1201ae54cf6849 1.221.14.0
AV delta VDM: 56fab8a5e9b93f7920f165fbe7ca27caa0d8bd52eeab6b05ac0bfa63197663e1 1.221.14.0
NIS engine: b1c03b224d6779738548f04f29e1cbca02f74c714a7383c5d32cc76aadcf86be 2.1.14600.4
NIS base VDM: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1 119.0.0.0
NIS full VDM: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1 119.0.0.0
Platform: 989257bddb756ce1c2af579be003962f5700cdec6f25e3b86b8cce5127bc11b4 4.10.14393.4651
============================== AccumulatePackages ==============================
PackageName: C:\Windows\SoftwareDistribution\Download\Install\AM_Engine.exe
PackageName: C:\Windows\SoftwareDistribution\Download\Install\AM_Base.exe
ERROR 0x800705b4 : AccumulatePackages
Watson Report: Position:
HRESULT: 0x800705b4 P1
FailedFunction: AccumulatePackages P2
Operation: N/A P3
SourceComponentVersion: 1.1.23080.1001 P4
SourceComponentName: mpsigstub.exe P5
ProductVersion: 4.10.14393.4651 P6
ProductName: Microsoft Windows Defender (RS1+) P7
ERROR 0x800705b4 : MpSigStubMain
End time: 2023-08-15 00:50:14Z
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Start time: 2023-08-15 00:50:15Z
Process: 2a4.1d9cc01aacec298
Command: /stub 1.1.23080.1001 /payload 1.395.466.0 /program C:\Users\vagrant\AppData\Local\Temp\mpam-ab2f0060.exe /q WD
Administrator: yes
Version: 1.1.23080.1001
================================ ProductSearch =================================
Microsoft Windows Defender (RS1+):
Status: Active
ProductGUID: 77BDAF73-B396-481F-9042-AD358843EC24
Engine: 46885b61f84eb9417c2ad3f951b030c5e7177a358d1d72b663ad0cb5c78d1ea2 1.1.12805.0
AS base VDM: 9bc2a721794e46b45b1b701581c89665e23d186945418b14092ce11145b95f70 1.221.0.0
AV base VDM: ad62f41b09ba107019376ca103f1fcf26124fc21b8dbc1fee4259db4dca6ee85 1.221.0.0
AS delta VDM: 6a50f195b2dfda050c13a1c8faf2bf6beacaa78aea824928eb1201ae54cf6849 1.221.14.0
AV delta VDM: 56fab8a5e9b93f7920f165fbe7ca27caa0d8bd52eeab6b05ac0bfa63197663e1 1.221.14.0
NIS engine: b1c03b224d6779738548f04f29e1cbca02f74c714a7383c5d32cc76aadcf86be 2.1.14600.4
NIS base VDM: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1 119.0.0.0
NIS full VDM: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1 119.0.0.0
Platform: 989257bddb756ce1c2af579be003962f5700cdec6f25e3b86b8cce5127bc11b4 4.10.14393.4651
=============================== PackageDiscovery ===============================
Package files discovered:
Directory: C:\Users\vagrant\AppData\Local\Temp\76EE2705-28B3-4070-83FB-55BF3AB7DB45
mpasbase.vdm: 7dee8e8017fda76c3c39344fb0322f9c73b719ad2ca72e31cda79e155e3e4eff 1.395.0.0
mpasdlta.vdm: fa226c60705674c2dd72093ae4cd3a48bdb9f90048510682c95eba7b748d59ea 1.395.466.0
mpavbase.vdm: e3c53c25aecf11fedab57393ed6b6e40d98a5be32b1cba9a3707f5573b932eb9 1.395.0.0
mpavdlta.vdm: 07211bdf4fddceafd96e045de3830b5c4a67a84f3793d167a54d664bbb29417f 1.395.466.0
mpengine.dll: 7a360e86085f69c54824e4819f28a7ee92bbff6c88f592bb71d819561cb7fa5d 1.1.23070.1005
MpSigStub.exe: 896f1793ca8bda909a71217f41a93af5a06354c1ea9ea81c975d429224b28e19 1.1.23080.1001
AM FE:
Engine: 1.1.23070.1005
AS base VDM: 1.395.0.0
AV base VDM: 1.395.0.0
AS delta VDM: 1.395.466.0
AV delta VDM: 1.395.466.0
==================================== Update ====================================
Product name: Microsoft Windows Defender (RS1+)
Package files:
Directory: C:\Users\vagrant\AppData\Local\Temp\76EE2705-28B3-4070-83FB-55BF3AB7DB45
mpasbase.vdm: 7dee8e8017fda76c3c39344fb0322f9c73b719ad2ca72e31cda79e155e3e4eff 1.395.0.0
mpasdlta.vdm: fa226c60705674c2dd72093ae4cd3a48bdb9f90048510682c95eba7b748d59ea 1.395.466.0
mpavbase.vdm: e3c53c25aecf11fedab57393ed6b6e40d98a5be32b1cba9a3707f5573b932eb9 1.395.0.0
mpavdlta.vdm: 07211bdf4fddceafd96e045de3830b5c4a67a84f3793d167a54d664bbb29417f 1.395.466.0
mpengine.dll: 7a360e86085f69c54824e4819f28a7ee92bbff6c88f592bb71d819561cb7fa5d 1.1.23070.1005
MpSigStub.exe: 896f1793ca8bda909a71217f41a93af5a06354c1ea9ea81c975d429224b28e19 1.1.23080.1001
SignatureLocation changed from C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default to C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{72C6821D-BC77-4772-A32E-DE5F55B1613C}
Signatures updated from C:\Users\vagrant\AppData\Local\Temp\76EE2705-28B3-4070-83FB-55BF3AB7DB45
================================ ValidateUpdate ================================
MpSigStub successfully updated Microsoft Windows Defender (RS1+) using the AM FE package.
Original: Updated to:
Engine: 1.1.12805.0 1.1.23070.1005
AS base VDM: 1.221.0.0 1.395.0.0
AV base VDM: 1.221.0.0 1.395.0.0
AS delta VDM: 1.221.14.0 1.395.466.0
AV delta VDM: 1.221.14.0 1.395.466.0
DeltaUpdateFailure set to 0
BddUpdateFailure set to 0
End time: 2023-08-15 00:50:20Z
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Start time: 2023-08-15 00:50:39Z
Process: ae4.1d9cf1282ddc290
Command: /stub 1.1.16500.1 /payload 4.18.2001.10 /program C:\Windows\SoftwareDistribution\Download\Install\UpdatePlatform.exe
Administrator: yes
Version: 1.1.16500.1
================================ ProductSearch =================================
ERROR 0x800700cb : CreateAntimalwareProduct(UpdateStubTest)
Microsoft Windows Defender (RS1+):
Status: Active
ProductGUID: 77BDAF73-B396-481F-9042-AD358843EC24
Engine: 7a360e86085f69c54824e4819f28a7ee92bbff6c88f592bb71d819561cb7fa5d 1.1.23070.1005
AS base VDM: 7dee8e8017fda76c3c39344fb0322f9c73b719ad2ca72e31cda79e155e3e4eff 1.395.0.0
AV base VDM: e3c53c25aecf11fedab57393ed6b6e40d98a5be32b1cba9a3707f5573b932eb9 1.395.0.0
AS delta VDM: fa226c60705674c2dd72093ae4cd3a48bdb9f90048510682c95eba7b748d59ea 1.395.466.0
AV delta VDM: 07211bdf4fddceafd96e045de3830b5c4a67a84f3793d167a54d664bbb29417f 1.395.466.0
NIS engine: b1c03b224d6779738548f04f29e1cbca02f74c714a7383c5d32cc76aadcf86be 2.1.14600.4
NIS base VDM: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1 119.0.0.0
NIS full VDM: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1 119.0.0.0
Platform: 989257bddb756ce1c2af579be003962f5700cdec6f25e3b86b8cce5127bc11b4 4.10.14393.4651
=============================== PackageDiscovery ===============================
Package files discovered:
Directory: C:\Users\vagrant\AppData\Local\Temp\6D63C69D-73EE-49F8-B65F-C51E94E248F5
DefenderCSP.dll: af38574e1c037b24a8f27a9b5d31e4b5561c46a755574b92f525b25dc7eba245 4.18.2001.10
endpointdlp.dll: df28fae3d94e162b5fbf39bd0473da6f838d2a57bd1b2f226dd9e67c1a8739ba 4.18.2001.10
MpAzSubmit.dll: 7d57d610ba3a9ed74606234edb7967fcecbb2d1fb83558bddfd400d2f41deabe 4.18.2001.10
MpClient.dll: c00a9965c5c693b582b12bedbf5c263107195e3c85fce14a5f2148aec91a7972 4.18.2001.10
MpCmdRun.exe: 9acefdfa6f7eb49142b545b085a46e481cf7b137ef7e48f36fc966410929c1aa 4.18.2001.10
MpCommu.dll: 03eb4f6bd0f225a54be9166eb0dd73a4ceeb1c1e4cbbdee67c01b161cb9b5039 4.18.2001.10
MpOAV.dll: 67f91c64f5b129c44a662d87e8e28946c5cb0442d378df9776b1abcce88c536a 4.18.2001.10
MpPrintFlt.dll: 742fad542366d708c6858538bba8b6e297763dca2342a2365d82cee8e03752db 4.18.2001.10
MpRtp.dll: 2d2332495da464f76257f6f26de8581fe6a3115bfb3fc1ab49d63f387483ad72 4.18.2001.10
MpSigStub.exe: f3bf989add4b18e246cdab149df46b71c8fe5315875ffc988b7289be737d4ec0 1.1.16500.1
MpSvc.dll: de81fa9cb5c79a55e58838631e339dda63e74ed441a5ea664b9a7bb7f1132594 4.18.2001.10
MpUpdate.dll: 4868bd53d49c74c29695f0bb3ed8f2c7c6af62b22076bdb48da9b1c5168b75ac 4.18.2001.10
MsMpEng.exe: 55cb6465f4038330e4705440cc5623d79805bbd1d33db0cff8b016eb2ac20d3f 4.18.2001.10
MsMpLics.dll: 4eaa6b23a1cba72f908f21a09fd3adabf28ca599ac5b1e099a501361c81ac248 4.18.2001.10
NisSrv.exe: a9c1546530183f9af38f38adaa531df514e1e35eb62fc289d7f7af27551d1979 4.18.2001.10
ProtectionManagement.dll: 415cf905c5cb8b3dcac5b0d2752ccc9459090ceaf4b2f6b360b7cc7489d0db8c 4.18.2001.10
ProtectionManagement.mof: 1a3279e31fb9a46172dd27b93ac66e1277baaf5b36fdf892bd4717dd924f7b62
ProtectionManagement_uninstall.mof: 30a0ad834d7b3f4fb47010b4bb6905576792e83064e9dd858eabf0cca17fc3df
ThirdPartyNotices.txt: 5b7ab569ee9afe542df59608e9e1ee6787329d49329b477a4078e41c99108d7f
x86\MpClient.dll: 91caa20176e51d6e8b01b00dec704ab0bbab1ac4e41cb724b97cf05ce7e6a9cb 4.18.2001.10
x86\MpOAV.dll: 18ec7afcd34ab3bd3705a7b8d10f9891de54bbdee973f4160ad7b790eacac549 4.18.2001.10
x86\MsMpLics.dll: 9918eec185e2b6528551164f976796e9b1878064ad835861d09ef7eef209852d 4.18.2001.10
Powershell\Defender.psd1: be45ab3ccf886a31b6ea3e9945a4f91b7aef21146bff07a825f8ed146a11a12e
Powershell\MSFT_MpComputerStatus.cdxml: ebdf8afc9ebd87ff49a4a8a741df346cadad599712a7be2671056215a1485106
Powershell\MSFT_MpPreference.cdxml: d3f27b82f671226888745d011631b6d22056d107c40394b5d771e9f78fae1a3c
Powershell\MSFT_MpScan.cdxml: 060d9de3691a96cd1f294852afbec63daabf9a4980f0aaf6295d7d66457a35f2
Powershell\MSFT_MpSignature.cdxml: c4725b4b9d0d5b526d46336ea7722c361999ee7e2e94f7b617c98feff95ef07a
Powershell\MSFT_MpThreat.cdxml: 60aba6dfc6c2e5296476f211188fd603e518fab1cde88deae916988b68458b24
Powershell\MSFT_MpThreatCatalog.cdxml: c3bb21dc34355e174376c44f2979345c57738df25111d244f86e3001d1bf9505
Powershell\MSFT_MpThreatDetection.cdxml: 00a4b258bee7ac67247ac54f9a0dfc3db2ab12a97904c404b0bc9976e2d55e46
Powershell\MSFT_MpWDOScan.cdxml: 1059af21ca4e5225ec2adb9a5e3e3d6f46f291605b9114eef0e1e3f9897b1a4f
Drivers\WdBoot.sys: f135a315afc8513d51fff147ba7eb53227b9b386f484edd1f3e21bf0c91dcf9f 4.18.2001.10
Drivers\WdFilter.sys: 712b1cba339eb4e11ebe944fd088f4a7b1a45177e902a1cf1627833e8de5eb82 4.18.2001.10
Drivers\WdNisDrv.sys: f72b252732c3dafccdccaad132bc89c23fcf49ba99ccd8511d723604851f8b44 4.18.2001.10
Platform update:
Platform: 4.18.2001.10
==================================== Update ====================================
Product name: Microsoft Windows Defender (RS1+)
Old platform directory: C:\Program Files\Windows Defender
New platform directory: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2001.10-0
Service windefend is running (pid=980)
MpOpen succeeded(0)
Platform updated from C:\Users\vagrant\AppData\Local\Temp\6D63C69D-73EE-49F8-B65F-C51E94E248F5
================================ ValidateUpdate ================================
MpSigStub successfully updated Microsoft Windows Defender (RS1+) using the Platform update package.
Original: Updated to:
Platform: 4.10.14393.4651 4.18.2001.10
End time: 2023-08-15 00:50:47Z
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Start time: 2023-08-15 00:51:01Z
Process: eb0.1d9cf12902bbece
Command: /stub 1.1.20300.1 /payload 4.18.23070.1004 /program C:\Windows\SoftwareDistribution\Download\Install\UpdatePlatform.amd64fre.exe
Administrator: yes
Version: 1.1.20300.1
================================ ProductSearch =================================
Microsoft Windows Defender (RS1+):
Status: Active
ProductGUID: 77BDAF73-B396-481F-9042-AD358843EC24
Engine: 7a360e86085f69c54824e4819f28a7ee92bbff6c88f592bb71d819561cb7fa5d 1.1.23070.1005
AS base VDM: 7dee8e8017fda76c3c39344fb0322f9c73b719ad2ca72e31cda79e155e3e4eff 1.395.0.0
AV base VDM: e3c53c25aecf11fedab57393ed6b6e40d98a5be32b1cba9a3707f5573b932eb9 1.395.0.0
AS delta VDM: fa226c60705674c2dd72093ae4cd3a48bdb9f90048510682c95eba7b748d59ea 1.395.466.0
AV delta VDM: 07211bdf4fddceafd96e045de3830b5c4a67a84f3793d167a54d664bbb29417f 1.395.466.0
NIS engine:
NIS base VDM:
NIS full VDM:
Platform: c00a9965c5c693b582b12bedbf5c263107195e3c85fce14a5f2148aec91a7972 4.18.2001.10
=============================== PackageDiscovery ===============================
Package files discovered:
Directory: C:\Users\vagrant\AppData\Local\Temp\07956D5A-BF52-49CB-946F-6D6D1EB5D946
com.microsoft.defender.be.chrome.json: 8602faba22d8e06ccb146707b4a10f6256799ffe854d37781156a5a6d6120369
com.microsoft.defender.be.firefox.json: e2a0b5b4f64653c86b71231eb3ff5abed56b4180c90234de2c008456e270f8e3
ConfigSecurityPolicy.exe: 855c418d923665715c72e241b6f51c29fe4769287e7959eb883472659077dade 4.18.23070.1004
DefenderCSP.dll: 3fa9c92eb62cab2c25b14ffd9630456ac537d6a7a32f6677b977c41009217d2b 4.18.23070.1004
endpointdlp.dll: d421f09a6f5f1edc976c87d997234ad7cf80af16b5adaa9d40966fdd2e280039 4.18.23070.1004
Microsoft-Antimalware-AMFilter.man: b783898bd2c680a58f4e41d899adf7c3438b06e426fdaccbeaa68e7a720171d0
Microsoft-Antimalware-NIS.man: ea64be59286b67ae930729fa92b2b08dce5c2eaeb70feabe2320c47fb6ddac6c
Microsoft-Antimalware-Protection.man: df9ad93cdb61587a35fcdce996955a64413439a474d85c86133a9e9c185d1966
Microsoft-Antimalware-RTP.man: fad08683b176dfc27ff428a6f05d10982fcf20afc59daab21539296ff50f5002
Microsoft-Antimalware-Service.man: 3982e3620282a820412c825c0f3c9451cf697f11a83aee527c48e10b06e95b17
Microsoft-Windows-Windows Defender.man: f6267fcad9c25f4288914ca920ba0dc06277ed71ba688803b56e458823cc74aa
MpAsDesc.dll: 2bb7b419e1581f409fd0f4adf4745fc4a953cc1f8caa6f33a333713c496b10b1 4.18.23070.1004
MpAzSubmit.dll: 1ca6c9c293617d920eaf1b33f957c0471098adc71766ea26849af13a45ff3c06 4.18.23070.1004
MpClient.dll: dc8a3489a30665d58e9dd8341a3c62bd5108e324a6ed27465695af7207d90b0a 4.18.23070.1004
MpCmdRun.exe: 90f5dfa0713779ea892f5fbd8f66cb085d290f63e469645335c78da245842253 4.18.23070.1004
MpCommu.dll: 96cd338e1f9d831fa655848397ba7d8a8c71ede046dd07b0e07be0b29c7635a1 4.18.23070.1004
MpCopyAccelerator.exe: 2bc576d3553ca32ae8a3287ffce2be955b1b57b238f384f93b6e6dcd1fbfff77 4.18.23070.1004
MpDetours.dll: 73a55db8701ae7184080d07ece4269e0f2f07f982e8f4376815789da0a238e9e 4.18.23070.1004
MpDetoursCopyAccelerator.dll: 05e80b0b86893e172bcd282f559cd3ec3c13fb6c96a013a0c389d2cbd16677ff 4.18.23070.1004
MpDlpCmd.exe: 1f335421cd6e51a4df5a9addcb3eef860e3db78421d96163e47c88f17e2718b6 4.18.23070.1004
MpEvMsg.dll: 86abc46335ac315be5ab784866d2444354009df64584003c093ba1e47de19ccf 4.18.23070.1004
mpextms.exe: fb7ef708f34b4c49ee0fef7d1cf5aca0593129dc18936d79209b149d9294d692 4.18.23070.1004
MpOAV.dll: 7f8e951d028f3041829aaee38888230de71db88adb74772d96eda731414f212c 4.18.23070.1004
MpRecovery.exe: e359ab673e24698cccfb783a2d840e428b910940659e589dcc5fd316ecff18c9 4.18.23070.1004
MpRtp.dll: 9beccf271fc03c746215f5c5c01f24b2ac09a487da36d48d98f77c54e1fdae33 4.18.23070.1004
MpSenseComm.dll: 1e0f714fb1068b6e9ff38012caa2d9408a59982206f138cbc36cbc88a02696f9 4.18.23070.1004
MpSigStub.exe: 03410cb89092b20188e30aae345a92ab1efa4f21b5229e3b1a7c57b424e976f0 1.1.20300.1
MpSvc.dll: 7307354c72e16a156c034518cb39b5b4ecc18933a54948af6e96e66967a48cd9 4.18.23070.1004
MpUpdate.dll: 42ab85b90555b19f37c0b63a0f59db4a4349658837ca2dccd044e6ea6e5fb068 4.18.23070.1004
MpUxAgent.dll: e747a0874a6c6a0a9ff5e091f9c0e701d78c62187fd85651ce6538b9e0c216e7 4.18.23070.1004
MsMpEng.exe: 812f5f6a77ee21e88b3c8e0b324a9c51ef00e40d737d851335e0d8a41cb090aa 4.18.23070.1004
MsMpLics.dll: c324f4c6ed2c83485f1e698c6d7903a8ae1aacb0092f3fecb889ad6e2f9f37d9 4.18.23070.1004
NisSrv.exe: 75a65033e851fcf2eb0d042ebbb3aeaae700f3b12264da4b28158782886d20c7 4.18.23070.1004
ProtectionManagement.dll: 919c3d114aeb13317e85d51d50b18afb186932efb24676cb7904f10e642595a8 4.18.23070.1004
ProtectionManagement.mof: d6eda8d962f11ab79715824cfb59fed734b41a6c449e95c74f0bdb23ff038ee4
ProtectionManagement_uninstall.mof: 5172863c41e84024799b2034d42f10e9720fc53171a4f6c1ca2fdb2c6f71dfe9
ThirdPartyNotices.txt: 73e26404b3571a9e859b3a1144f54c353172479586e0a23c3a7dda0c1c0ae919
zh-TW\MpAsDesc.dll.mui: 0cac32b3bc1b80d1063f0d2993178a37c6191d655d22c7e62dfd808fd5b9241a 4.18.23070.1004
zh-TW\MpEvMsg.dll.mui: fbe750ba2a497208edc28c305ad0b6916ea53db23fd6dbb001f39d782531c475 4.18.23070.1004
zh-TW\mpuxagent.dll.mui: 78d5a85c6c41d851b968ba1e49c7372137443a90a58a0499ef5b36b4ff806773 4.18.23070.1004
zh-TW\ProtectionManagement.dll.mui: 03a671818b960e35f6b044929e96a76fd6c87bd3192c7cf3172a22f50d121311 4.18.23070.1004
zh-CN\MpAsDesc.dll.mui: 3c776ec6414dd8b270ea0d65bed0a13d86e24016feddc374f33088de4c29faef 4.18.23070.1004
zh-CN\MpEvMsg.dll.mui: 7201999c61c739483db31639f7c894c640a15fd81311e9b263037ec0ef478841 4.18.23070.1004
zh-CN\mpuxagent.dll.mui: 3f9f2a52a77de09be0f160e7811d84730d70d89e3b54acde279cbd5299cc6715 4.18.23070.1004
zh-CN\ProtectionManagement.dll.mui: 2e859c214d9c02a62290c6d41a72dc5aa2209404ec02be87895e57d23826d6fb 4.18.23070.1004
x86\endpointdlp.dll: 09ec448ed3cd7dfb15b2c68740e50f07599c52ba6295d93c1a21520279665769 4.18.23070.1004
x86\MpAsDesc.dll: cfc0f7bff9213889df89a4a5c41a17cb4f12911b7f2706aedda9196033bceed4 4.18.23070.1004
x86\MpClient.dll: 9ba679a6cfe6d0411667ed82a89283379bcd86e059e60af513c43cb980854d95 4.18.23070.1004
x86\MpCmdRun.exe: e26e363daae49b1bc7800e1cb6502a532079087c1662992cf66bdbdd6aaa3c79 4.18.23070.1004
x86\MpCopyAccelerator.exe: dd18d440d690c8ed54c523f643376852418d742ab9d50a1c1f31b7d4260a4556 4.18.23070.1004
x86\MpDetours.dll: bc83e82a2710b7fa74971cc54e2f2260a72da495a910e89b2694e65f757baa7b 4.18.23070.1004
x86\MpDetoursCopyAccelerator.dll: c3b031a6cd7e61f0e1914191110024efe97be4c14bb4a169186aef14d02f4a88 4.18.23070.1004
x86\MpOAV.dll: cbd1adec6907bbf673969c4d5162103a957c5a1317be3b2e366da154ab35dbf5 4.18.23070.1004
x86\MsMpLics.dll: 6e094c878bb3c45fee7ee78a0009a080b6e30515a2a4c68550864cff15e927a2 4.18.23070.1004
x86\en-US\MpAsDesc.dll.mui: ea6b8aea68d0590960e278c43eb7b84dec08bbd5879e22dc7b437421081f29cc 4.18.23070.1004
vi-VN\MpAsDesc.dll.mui: 8d24f63b3f006339001aa598a73a86983c2f545da1d05f5ec3588ad23a980ed1 4.18.23070.1004
vi-VN\mpuxagent.dll.mui: c9da7ee7a3a7352b9038cd276d2bc3aa3e2c906fbf9bb80b09f86f903d02f318 4.18.23070.1004
ur-PK\mpuxagent.dll.mui: 72212d15c0cace5a0c85f8133c9c08803d273a6f0f84c5134ad5609f4de32ef2 4.18.23070.1004
uk-UA\MpAsDesc.dll.mui: 6dbe9ecb57c81ded4cd789db5730a2b024e5e334700b0fffc1cae77e23f9c440 4.18.23070.1004
uk-UA\mpuxagent.dll.mui: 069938a4fec1620c300b694a7906c205c9b45a93ffb47ae8da19844f9cca5620 4.18.23070.1004
ug-CN\mpuxagent.dll.mui: 4ef96fc6877b09f630dd53d8ef27efe8fe84cae97b8ff89d5003f970c61171fe 4.18.23070.1004
tt-RU\mpuxagent.dll.mui: 149a002a47f2995a663c674d75fa9af2bb04a14cf2cc37c44877681fa9b713ba 4.18.23070.1004
tr-TR\MpAsDesc.dll.mui: 7a56d5b5bbcbbd3105975bffb7d371f6c48a2e59c0ec84b2f970b5edc25afc93 4.18.23070.1004
tr-TR\MpEvMsg.dll.mui: 7f878cfeda36a1834fcce8b204ba3da3578f646857bef03070d93ee82a29ea02 4.18.23070.1004
tr-TR\mpuxagent.dll.mui: 180c3e2149170ad020f38aef919736e52a3e4c70c99061fecce089756e2c612d 4.18.23070.1004
th-TH\MpAsDesc.dll.mui: 27a6355fca9691550cfe4b9d967052b81fbc46aec7532edf7a236bed24e171bc 4.18.23070.1004
th-TH\mpuxagent.dll.mui: 8c36bc02a6d097d64c57a5a06791e629cf3130cab1f537d1f8a06713d1f60e93 4.18.23070.1004
te-IN\mpuxagent.dll.mui: 6bd7e25285d47002f9d6e2b13fea33a577e0b072b01867f165b11f1123cf3e3d 4.18.23070.1004
ta-IN\mpuxagent.dll.mui: 38d75d8b6c55cef22f7a60e352eed6f45cb6ddb248971084f577928cdbe9c1c0 4.18.23070.1004
sv-SE\MpAsDesc.dll.mui: 76dd85940b3d9ae6d0a09659a7333e295ee9b0b100084446f803ccd7d5482b26 4.18.23070.1004
sv-SE\MpEvMsg.dll.mui: d976f3ac9b43e175c83287e470edfe65b9b7395fd7de1bd099d2c8fd77b8d0ea 4.18.23070.1004
sv-SE\mpuxagent.dll.mui: a534f3fbc4c977deab6834059c5b406913b5e6081073dcabf661966caa0e8aaa 4.18.23070.1004
sr-Latn-RS\MpAsDesc.dll.mui: 5b3e1f42295103efe7155ebdf4a4abef1eabe48e8dd94049b0bd9bc9b6339f14 4.18.23070.1004
sr-Latn-RS\mpuxagent.dll.mui: b2a9dcfa461a27b51621062893f2466bef9c4d87e878efd929fb3dcd15625866 4.18.23070.1004
sr-Cyrl-RS\mpuxagent.dll.mui: 808795df86f53e897321d56ded7659fc5b6feb78bcbbd93db63742432b9cfc14 4.18.23070.1004
sr-Cyrl-BA\mpuxagent.dll.mui: 2156ec3fbfc342ac3a82160eb3133208d491edce28575bd9d763ddd44e2e1196 4.18.23070.1004
sq-AL\mpuxagent.dll.mui: efef9933955c2209aa1b939b1dfee25576e35e37dac55cada8919df8c28f0a59 4.18.23070.1004
sl-SI\MpAsDesc.dll.mui: 1d0671be88c3bd27c25824c2fee6c0b382bc81e074fde26e8724bdbb2dd23d7b 4.18.23070.1004
sl-SI\mpuxagent.dll.mui: 2bb5ee6f26fc01fa3b0fc39b4b41333e8836e3e831c0bb89f602eb68c3a45104 4.18.23070.1004
sk-SK\MpAsDesc.dll.mui: 1ddc98e3f14f0fcbf06301ee3788a71fd3d14d08f78b5d84706651c2955d73c3 4.18.23070.1004
sk-SK\mpuxagent.dll.mui: a1825ef3b8b997793382195d5771d4f4e5cc48594b6d886151f335e5a20ab133 4.18.23070.1004
ru-RU\MpAsDesc.dll.mui: ba3e29516ca91c889f59efd88e858e9403371a6865c19b0e419e06478753a1d1 4.18.23070.1004
ru-RU\MpEvMsg.dll.mui: c1cc378d9c0a865064c885a7837d95cb36a5bd89b49c6b231e9155236b98e88b 4.18.23070.1004
ru-RU\mpuxagent.dll.mui: da9294091c7c04c87aaba9ec3ffeaca0df933359d00a4997976e2e69ff478317 4.18.23070.1004
ru-RU\ProtectionManagement.dll.mui: 3cefde30631fe2d5ae32ea31307ccf87cb5515e3bdc36d1be3e2f7bd471590ca 4.18.23070.1004
ro-RO\MpAsDesc.dll.mui: f7ff4381b12be58d47941957c693af91bdf422cbb02636cd6b3f3d16f5d9fae3 4.18.23070.1004
ro-RO\mpuxagent.dll.mui: 6f6aebd804f6515b9ff3348994ae03f41d45ea5f85acf9e25a5ba93a861e5e9b 4.18.23070.1004
quz-PE\mpuxagent.dll.mui: 4ce63774376e7ee1c5fbec901a45a3c1a58996586bc064a57f9962e07e68b26e 4.18.23070.1004
pt-PT\MpAsDesc.dll.mui: 228ee0f7f610c0a095d443f95db105282e6a7b93d21e0a0574b66560109f4c7c 4.18.23070.1004
pt-PT\MpEvMsg.dll.mui: b13221fd746559538a1289dd91d5d2110489601ab4a8aaa9214208c8372c0847 4.18.23070.1004
pt-PT\mpuxagent.dll.mui: a9e6ec177d02544b5236dadcb68f54f55bd5508f08894cadbdb7c4492860058d 4.18.23070.1004
pt-BR\MpAsDesc.dll.mui: ba7fdc463b3d4a03269954013c6af59cdbef0ad98e20636b89d4d212f5455e3b 4.18.23070.1004
pt-BR\MpEvMsg.dll.mui: 467f4f40f86039fa82d4b62fe4914d9a54108ce4efd53f5c4b3d8628ea3168f5 4.18.23070.1004
pt-BR\mpuxagent.dll.mui: 95d2208a1f63d4ab94e36843cc2beedd0028260f95a79e7626953474f3d48969 4.18.23070.1004
pt-BR\ProtectionManagement.dll.mui: 46deb91c4ea0e923b57cb9d2baaa01b8b822feadd4b73426afefc181eac465f5 4.18.23070.1004
Powershell\Defender.psd1: 8b123e443707a1239f5bcc7490bb55d47f9fff8b43bf873fc44f4ebe680c47ef
Powershell\DefenderPerformance.psd1: 9d1d2e771f97753ce9756137063e462aa131fa0eaf77de3f4ce50b6e633ce2c2
Powershell\MSFT_MpComputerStatus.cdxml: bb74a7aef53e1082147cba6bf80d9cc7721d476b22c60caf255f3ab3152e5896
Powershell\MSFT_MpPerformanceRecording.psm1: aea38f1b92836ba5a30adbf5f59becadedf8efe8c1c8aa298b0d692374b4e40d
Powershell\MSFT_MpPerformanceRecording.wprp: e796454fee4cf17efdc25db5feef00a5d7c1b335e6c4b4fe996e8ad7cab01bc8
Powershell\MSFT_MpPerformanceReport.Format.ps1xml: 61e04033338ebe08b52d569d143d3f3985fe073827175ef9ff5583404eeb1b05
Powershell\MSFT_MpPreference.cdxml: e69fd71f281ae7657053246037394b4bc4fb512bc0efd9f158d575dfaa553210
Powershell\MSFT_MpRollback.cdxml: 3171f7e990cc4f76cfb618408b991ce9dc54141bd0ad6cfac8268d726c08d4b5
Powershell\MSFT_MpScan.cdxml: 524907bc38b3f3c5579d67809cf87854d4f05393b7af975fb754c7dfae64a5cb
Powershell\MSFT_MpSignature.cdxml: d79e7a79707b1fb49cdcbcb6c57a5a8f8ad0567bddd6162718b8566709048f5c
Powershell\MSFT_MpThreat.cdxml: 6f95a2fbb1e51fb7dd98a8599006ca410dee8702a5b5d172522c3a637679e15d
Powershell\MSFT_MpThreatCatalog.cdxml: 34f89a5e55572db60b1a24c30062c1eaa789300eb2b38bec89d3d4841fbcc4b3
Powershell\MSFT_MpThreatDetection.cdxml: 61a5c780a615d28b1b9e457563c763edc28ed8a4161aad5b812db24e2adcf180
Powershell\MSFT_MpWDOScan.cdxml: 62473bf70596173d07a0274baacb185c220bc88631d634b18337150902adde40
pl-PL\MpAsDesc.dll.mui: b8cedbe29474bbb6ee4dd1b75c4623acdf68b964c26af3d8e108d9e10c2662e2 4.18.23070.1004
pl-PL\MpEvMsg.dll.mui: e22eec87425dde9bf860fdee43169490db88b07b2edf11d9b741d629264509ac 4.18.23070.1004
pl-PL\mpuxagent.dll.mui: 5e1cfd28b52329177c8837b4a5735a0c0e998712e5e17548a0cef6ac1c1287e6 4.18.23070.1004
pa-IN\mpuxagent.dll.mui: d861898b7c4e50249e7991ada5316ca8894060e52b057ffb5f2b7886d0271975 4.18.23070.1004
or-IN\mpuxagent.dll.mui: 4f1c542f22c9a143b7394b1c9014bb793e7f06052e5edfeab1a8ee5181e57bbe 4.18.23070.1004
nn-NO\mpuxagent.dll.mui: 53f59832fbf9d8cfe4a8ad0026071f373cad12e61519c9025be24a00afcdbe8c 4.18.23070.1004
nl-NL\MpAsDesc.dll.mui: 921cc8ae4c002a0dd10374efbc5cdf0ea72bebe7d7aa1dda7820bb16fa0b055e 4.18.23070.1004
nl-NL\MpEvMsg.dll.mui: f827b76e4e3fc534c130c6d96a4db1c361501450c3264287ee1f315214225599 4.18.23070.1004
nl-NL\mpuxagent.dll.mui: 9410598d61e3787fbe88ecf0af0ca2d1d013d2431d716595107d3d4fcc64a68b 4.18.23070.1004
ne-NP\mpuxagent.dll.mui: a45506f9b54e2673fd7a10eb09cbfc27619cd813e4b43c301ecc07beaccaa215 4.18.23070.1004
nb-NO\MpAsDesc.dll.mui: d7bc625aac5b9c7acd842ad49fea43592a7e1ecddbaed85a93d44681cc162bb3 4.18.23070.1004
nb-NO\MpEvMsg.dll.mui: 8fdb856f671fce0b5ee0f7d37b3a4b07ff3ad57e8d109db057b2f31eec22851b 4.18.23070.1004
nb-NO\mpuxagent.dll.mui: fa1f5a0490949b8d3512b53221a818281909462b81135ec2c91d79c6f6ee8a85 4.18.23070.1004
mt-MT\mpuxagent.dll.mui: 355d2409d100c0158c9597a83f1719044095646b1d96f2814df2cd5b2c33ba43 4.18.23070.1004
ms-MY\mpuxagent.dll.mui: b43b40af29598fa3dc4b2ea06e3dac419a4b605521fa809310de22617b47aee7 4.18.23070.1004
mr-IN\mpuxagent.dll.mui: 073d8fe7f71fe7139032e5733d801742dd41687b08a6cb9363b86c4e9b011ead 4.18.23070.1004
ml-IN\mpuxagent.dll.mui: 91a1545a86660af11e71b17901504bcd07e2ae4d46613b73d75950142ac8b9ec 4.18.23070.1004
mk-MK\mpuxagent.dll.mui: 1bd4e970ec899a221f0b8f26724956e34110b33699fa88b50daa0258427cbbbb 4.18.23070.1004
mi-NZ\mpuxagent.dll.mui: c461a24cec3abff1dff63d0dbec26fb7a6eb77fcc0f5c599d078025599b286b5 4.18.23070.1004
lv-LV\MpAsDesc.dll.mui: e10b8da6353b4cadf12cc896bd740a7499a6bc9977cb379c8c2bc180347d397d 4.18.23070.1004
lv-LV\mpuxagent.dll.mui: 133d1f7b52236fb99852071dd5a807bda4f85e278980f8479a22b13ee03e3dfe 4.18.23070.1004
lt-LT\MpAsDesc.dll.mui: 264000fda1233547a84234647e26a9ed5e4764224322a9997f0be3f3bc625c69 4.18.23070.1004
lt-LT\mpuxagent.dll.mui: 2fb67d642da20ccc8560af8bc126468c2ebe694502a6e65fed822427cea1bb7b 4.18.23070.1004
lo-LA\mpuxagent.dll.mui: 1d0f04acd86413b2db743bcdb3b50e8a21345ea511caa23af5371649fdef1b02 4.18.23070.1004
lb-LU\mpuxagent.dll.mui: e7cde1f5c4df099298fb9b603252d3157e077bb2109bfe9a0e3ce869c4588d0a 4.18.23070.1004
kok-IN\mpuxagent.dll.mui: 34d289b0fe002751105501fd3606b1d689730be201d9ef76a75c6b4d7037d78d 4.18.23070.1004
ko-KR\MpAsDesc.dll.mui: a8faa0ceafe782509e3bb2f1a85bc0ddf8aa45d8905a2ca3db54520930bc06ac 4.18.23070.1004
ko-KR\MpEvMsg.dll.mui: 80c03c2e89d6368bf640cb0e1e9517bfad43984d253aaa16dd5d294b2198175a 4.18.23070.1004
ko-KR\mpuxagent.dll.mui: 5915b8d70d7d13e7508c66b0ce024d133f217776cbb3a135717e124a03ffc764 4.18.23070.1004
ko-KR\ProtectionManagement.dll.mui: f31851806f166c512598e559e2b3a97769820292749d52de5e21efbd4996602b 4.18.23070.1004
kn-IN\mpuxagent.dll.mui: 95f1b56c4834deddeaaa72aef575eef46eb04645067f48c596a0871cb65f1db4 4.18.23070.1004
km-KH\mpuxagent.dll.mui: 01bc9c9e1c4036726ba857ecf2fbebdc3fae4a0d3d8542cbc55f5092c3ba3da9 4.18.23070.1004
kk-KZ\mpuxagent.dll.mui: a753fb9d40e83a5068a26b9d8fd53703d12a69b556c16839ba4da3c77369ec61 4.18.23070.1004
ka-GE\mpuxagent.dll.mui: eaccbcf38d33aa41e936bd9f6b6a7768289ed12e0e86ff031e10a8b62ccd88a0 4.18.23070.1004
ja-JP\MpAsDesc.dll.mui: 63028af780f3d723a57bc87dcc46f7ecb21bbfa5a9bdcdc003e4fc4cee3a66ef 4.18.23070.1004
ja-JP\MpEvMsg.dll.mui: 8e0b642f2a4001e5f9e35ebcf07162fbfdd30b3451ffdf725c091c388f8e55f4 4.18.23070.1004
ja-JP\mpuxagent.dll.mui: 09475e228b9d62c8ab81966b1c7c451f68463f12894fff4f3a45bdecc0a47ab3 4.18.23070.1004
ja-JP\ProtectionManagement.dll.mui: 932fb570a318c10178726bba29f7b33a967893c488721eb62b7b607520bc72c5 4.18.23070.1004
it-IT\MpAsDesc.dll.mui: c5ed54ca2ac5cfcf2e835789ff20ce4574eb371697a67e4630edfd03130d9bde 4.18.23070.1004
it-IT\MpEvMsg.dll.mui: da66ec9c449b0feb651bf0eb122d820f2c702d0939a3c80409fb9f1f127e8217 4.18.23070.1004
it-IT\mpuxagent.dll.mui: b9a7a951bfcc54ea950b3e938acf8ddf8193dc3fbf319489cce29a37036fd38c 4.18.23070.1004
it-IT\ProtectionManagement.dll.mui: d7d573faa5fef529f28d59fb74605f0df4a8709c072d0510f304b414f4daedc8 4.18.23070.1004
is-IS\mpuxagent.dll.mui: d6cb6c86676e3b550930e27554eee60314830505a2ed727491c5855c55aeb97b 4.18.23070.1004
id-ID\MpAsDesc.dll.mui: cb3ab0ecc597718a829dde5654adca091f06f16514ebe8b58a54231e43639cd2 4.18.23070.1004
id-ID\mpuxagent.dll.mui: 9e76393b89a933fcad564c513832a4732a994fbaa2c8545d638175f029c2464f 4.18.23070.1004
hu-HU\MpAsDesc.dll.mui: b449512bb4241decf4b230e4ee8f1ca9b67b47466cfaaabc739ae41fc8298f1b 4.18.23070.1004
hu-HU\MpEvMsg.dll.mui: 3e7c9fa13e4340422e62a2df1911d338fa9396c841b6885cba42e0e2307e9bea 4.18.23070.1004
hu-HU\mpuxagent.dll.mui: 9de7b4e339f14676d075f5a2f08456eb24af4badbbe9b75374efcec764d3fa1f 4.18.23070.1004
hr-HR\MpAsDesc.dll.mui: 4e48bf07bade61a777070d2939b1b4762ab8cd54221c74f95cd8f50cf1710a4e 4.18.23070.1004
hr-HR\mpuxagent.dll.mui: ead9b4256b14df907b1e6d04484688928caac467f0401aa8b7b7832fb1a6c966 4.18.23070.1004
hi-IN\mpuxagent.dll.mui: ad344ffdf2dda95602085c933b9c38861dacab467f94551dcf6772807d0f3f51 4.18.23070.1004
he-IL\MpAsDesc.dll.mui: 5c20f83637ef36c9db5c4f94dd658f1941bcd2af1c56fb8acff3b6ed236f3367 4.18.23070.1004
he-IL\mpuxagent.dll.mui: 388458f0944d7d239d7aa65848601c1e21f13921608ca2e678a1c34b99b19deb 4.18.23070.1004
gu-IN\mpuxagent.dll.mui: db89f5bf93bc19ec2172bc4460bf6c97649a4aecb4fd01c8e95f49d2ccd1b66f 4.18.23070.1004
gl-ES\mpuxagent.dll.mui: 41e09a65bb562de2246a46eb7e3e325c7c567fb763d06ddef89885d31306f619 4.18.23070.1004
gd-GB\mpuxagent.dll.mui: c28e01cd5a9eb8ce9ac0ceaf87d986db5f26669e75ace441225008ce30ffd777 4.18.23070.1004
ga-IE\mpuxagent.dll.mui: 7035432d38bcfd38a4fd523990e95f297617da212ce1206f0198db0a59d5ba57 4.18.23070.1004
fr-FR\MpAsDesc.dll.mui: b1b2002317c3a70a3076f8ff7e770bdcdee16549308befc8520284a5b94b0cda 4.18.23070.1004
fr-FR\MpEvMsg.dll.mui: 2b3ef2b1ae9a6b1b09b8cab66796b154d421eedb08649b7645babecca5df41aa 4.18.23070.1004
fr-FR\mpuxagent.dll.mui: 7c9a8077a8e2841964e31b37cb56af4c7f4169b677609aa81890ed97f1747298 4.18.23070.1004
fr-FR\ProtectionManagement.dll.mui: f4622969f23e3cf5905bfc427cff1eeff9f8b4dae99227e47d0c44b712e0b04f 4.18.23070.1004
fr-CA\MpAsDesc.dll.mui: e39c5e919601723daee6e4521432a49f62363346ccc30b51e8307be12a648303 4.18.23070.1004
fr-CA\mpuxagent.dll.mui: c54c2ca0f313b4c62e475f72c0a176faa98b68758dc56d10e6f2a04b2601621e 4.18.23070.1004
fil-PH\mpuxagent.dll.mui: f1a068b1f590a84368467b246adb1bd8355a7f89d0bb456717821b9532e7beea 4.18.23070.1004
fi-FI\MpAsDesc.dll.mui: dc7bbc1858c6804bf52413cedc677f6a0b5ee07774aa6f792839b9945873653e 4.18.23070.1004
fi-FI\MpEvMsg.dll.mui: 7a90fc53b7287e1105f039902f4baaa07ece6ac91475ef363bdc22715ae17d39 4.18.23070.1004
fi-FI\mpuxagent.dll.mui: 27c5ed0059e247404f392e780c4ee7dd30ce1184cb51b0527e898829eb4059d6 4.18.23070.1004
fa-IR\mpuxagent.dll.mui: cdc0d4d7e1a9ff157623f876a11939a3c4835e36118b8495bca01ddd551ae0c9 4.18.23070.1004
eu-ES\mpuxagent.dll.mui: 2ae816dcc3a9ac217f74b3bff7fa54173329e98b3cfa183f764e37e8aaa51aab 4.18.23070.1004
et-EE\MpAsDesc.dll.mui: 4f3e0f738371e8703823bff83ce1a8e3606ad0fad2350f8d7fc8fb5a3e2ff1ad 4.18.23070.1004
et-EE\mpuxagent.dll.mui: a1e82b2d296871d93ac6aca553878d7b988decdf4897f190ea63be1c408350cb 4.18.23070.1004
es-MX\MpAsDesc.dll.mui: a98210b55d021092788c6f1f095866d077256d239e77ac354143021515490c05 4.18.23070.1004
es-MX\mpuxagent.dll.mui: 4d57078f4df1eab180dfe8587908266f89fef0b2831fe68d384cb0041c0ba30c 4.18.23070.1004
es-ES\MpAsDesc.dll.mui: aea72ce80195134621dd0c1a14f8f4e7d25be11044ba634d2ebf7e01a124ed10 4.18.23070.1004
es-ES\MpEvMsg.dll.mui: e9926a8489992d2677a43ecb65d5330835760e28da2569b71626ed4e996b27ea 4.18.23070.1004
es-ES\mpuxagent.dll.mui: 16ab910dfa5e5500f0c3357677519bcceb82d52c67a5f23f97b7bcaa09b63f21 4.18.23070.1004
es-ES\ProtectionManagement.dll.mui: d8e5ce2698b60aa08b4d0a80c5650bd1795a45ed3d4fc26d4705bb776f8ef401 4.18.23070.1004
en-US\MpAsDesc.dll.mui: c091f1543510cb907cb2f36eb3513810543e79c6f2293c65d89d2cfb40053a05 4.18.23070.1004
en-US\MpEvMsg.dll.mui: 97a1e3705949b5a2f841d568b4418254d138557b4d49f47718109f87a52e017d 4.18.23070.1004
en-US\mpuxagent.dll.mui: 325ed1104e7a2302ea273e6a417f48819e6457436bcc892df2c379aed54cc121 4.18.23070.1004
en-US\ProtectionManagement.dll.mui: 84f3971fbb8d6ad634fa7d653528096dc91b4ef2407d46eb4c5ef9fcfb374940 4.18.23070.1004
en-GB\MpAsDesc.dll.mui: 6e699898cdbd1633f921bb5e716a91049eb6d50beeb7d717d1ad143fd6fc154b 4.18.23070.1004
en-GB\mpuxagent.dll.mui: 91048108a69b5cab9bc888c8f0e8d6e53b25d73e56faa40cda79717c94c474ac 4.18.23070.1004
el-GR\MpAsDesc.dll.mui: b6c5ad4f1bb68d88c812066b60304c817117b4910300a2df53c14c2e74dfd382 4.18.23070.1004
el-GR\MpEvMsg.dll.mui: 2a8ca1e35e53a8264a1b638fc8f7970762c35e21e5957bf4a1f28aeebe8dcffe 4.18.23070.1004
el-GR\mpuxagent.dll.mui: 502f43587d09ffc77bf9446327b9b170bfdaaf6888bd088022deda2c2a095bc0 4.18.23070.1004
Drivers\WdBoot.sys: 4e702ee7fba38ca5142c01bb6d202882372efbea0052c9a54dba582ada52d37f 4.18.23070.1004
Drivers\WdDevFlt.sys: 9d0c74fbccaf3faf08a01e21fdc7f5eda13e58c170194b419886e6814e3ded18 4.18.23070.1004
Drivers\WdFilter.sys: e551daacac93e559214a5ad24201dc8b4dfe3d9d0efa4b3136c4b26c63c2b1ff 4.18.23070.1004
Drivers\WdNisDrv.sys: c0022dae9f51e2c9be17e7a8624b8a5c6b9d9a9da4b74f3f363753f9924bf124 4.18.23070.1004
de-DE\MpAsDesc.dll.mui: ccce4ac12420de507e2cad3d77ecce4ce524d488776d7e5addaca657d0fc411a 4.18.23070.1004
de-DE\MpEvMsg.dll.mui: ad0db3d810c4d377c30696e849d547eee76d46cf896834d616a7f35cb36d3040 4.18.23070.1004
de-DE\mpuxagent.dll.mui: 7aad2aa56df65e2cb18024babf40f88b6e9170a47a5070595fb089fb90bb71a2 4.18.23070.1004
de-DE\ProtectionManagement.dll.mui: 9c1519c0f40057196fe82945453a0b4b1a9e38f1a8248f2676f01ace48ac2b18 4.18.23070.1004
da-DK\MpAsDesc.dll.mui: 4e164bafaf27c56a1a5288bcb29219384c025dab8a4a134ac6a110e95d86f05c 4.18.23070.1004
da-DK\MpEvMsg.dll.mui: ec80b4fd2d34ac06211412b20077d4ec56fdc4b314a0cb61baf8ab2fe4c461e7 4.18.23070.1004
da-DK\mpuxagent.dll.mui: 6877ece3584a0de54be0857e864d46713d116194f32f5724bab050b6f5182405 4.18.23070.1004
cy-GB\mpuxagent.dll.mui: a83a18cbf6c9f57dedeb7fe4324234b61ab68809ec07252d2cd191a12466d2dc 4.18.23070.1004
cs-CZ\MpAsDesc.dll.mui: 0e8a5d50c799be57cd0f89485bc2239d507b044fd81c4947fbb9a71309891ab9 4.18.23070.1004
cs-CZ\MpEvMsg.dll.mui: a7f8beabf376fa7c7edf36f0c2301721685a155e5d69a2b5447906a680791f38 4.18.23070.1004
cs-CZ\mpuxagent.dll.mui: 1c8430dc580cbf35f4b103114a2750f3a3faf3fa0f02fb45e552d28c35dc6441 4.18.23070.1004
Catalogs\igd.cat: 96e3612ab97ed3ff1a0872f5ebfcf0b5561db6806d59dea4f6310dc78a94f622
ca-ES-valencia\mpuxagent.dll.mui: 8a15ad607d66cdb4898e1f00584ee2e922fbd80b73b44964913fccbac347174f 4.18.23070.1004
ca-ES\MpAsDesc.dll.mui: 95c5fdecf9e0ebeb93ee2fcbbdf170317c0d70e0107bfbf8581ed71c451a3a08 4.18.23070.1004
ca-ES\mpuxagent.dll.mui: c9e92a0e3a44ec050a37a33b93bce34588d5cebe337baf459e1a81277055e1fe 4.18.23070.1004
bs-Latn-BA\mpuxagent.dll.mui: 1051e3c30cf8a70823a414515e852235c21aa6d90c8f845059f40087dd9f77d1 4.18.23070.1004
bn-IN\mpuxagent.dll.mui: 8a1acea69fdd1b64571f6f63d06ec9c0572106ee2455c117e0f7be8765b9fe3b 4.18.23070.1004
bg-BG\MpAsDesc.dll.mui: dc2a8e8f2394fa1fac300bc5ae70097b94a9bbc51bf858a7b87ef048c2863222 4.18.23070.1004
bg-BG\mpuxagent.dll.mui: ce025d81065b1db7cdcd666cd49da82f25084867e2446df0ff58eed3da665713 4.18.23070.1004
az-Latn-AZ\mpuxagent.dll.mui: 07a5b17cd183e964c67dbbd3f7ec5daec81d9db62e2964c6e98640121e45b031 4.18.23070.1004
as-IN\mpuxagent.dll.mui: d49cc651261cc45214bb4362a1ceb5d27cfb8e3325dd8ac91bfb843f814f2884 4.18.23070.1004
ar-SA\MpAsDesc.dll.mui: 201bfbc47426745ea4341618e7b402b86acd316aca4acb447d5e025203b64894 4.18.23070.1004
ar-SA\mpuxagent.dll.mui: 15fc4327ae7c7fe3722dcc081b5422eed47ce31a47b0ce51f1dd181e6bb0be90 4.18.23070.1004
am-ET\mpuxagent.dll.mui: 877c123a7c1e2beb095df4cec97b27fbe7c2f67da7a55c996a2fb2b51de5f726 4.18.23070.1004
af-ZA\mpuxagent.dll.mui: 5d8e9ffe094fdfbe17fe7cc0f1d004951d126478739bf280049a815779f9e2f2 4.18.23070.1004
Platform update:
Platform: 4.18.23070.1004
==================================== Update ====================================
Product name: Microsoft Windows Defender (RS1+)
Old platform directory: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2001.10-0
New platform directory: C:\ProgramData\Microsoft\Windows Defender\platform\4.18.23070.1004-0
Service windefend is running (pid=1756)
MpOpen succeeded(0)
Platform updated from C:\Users\vagrant\AppData\Local\Temp\07956D5A-BF52-49CB-946F-6D6D1EB5D946
================================ ValidateUpdate ================================
MpSigStub successfully updated Microsoft Windows Defender (RS1+) using the Platform update package.
Original: Updated to:
Platform: 4.18.2001.10 4.18.23070.1004
End time: 2023-08-15 00:51:14Z
--------------------------------------------------------------------------------
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment